McGinnis v. United States Cold Storage, Inc.
Filing
30
MEMORANDUM Opinion and Order signed by the Honorable Edmond E. Chang. For the reasons stated in the Opinion, the Court concludes that it lacks subject matter jurisdiction. The status hearing of 01/11/2019 is vacated. A separate AO-450 judgment shall be entered. Civil case terminated. Mailed notice (mw, )
UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF ILLINOIS
EASTERN DIVISION
RICHARD MCGINNIS, individually and on
behalf of all others similarly situated,
Plaintiff,
v.
UNITED STATES COLD STORAGE, INC.,
Defendant.
)
)
)
)
)
)
)
)
)
)
No. 17 C 08054
Judge Edmond E. Chang
MEMORANDUM OPINION AND ORDER
Richard McGinnis filed this class-action complaint against his former
employer, United States Cold Storage, Inc., alleging violations of the Illinois
Biometric Information Privacy Act.1 740 ILCS 14/1, et seq. R. 1, Compl.2 The Act
prohibits private entities from collecting a person’s “biometric identifier”—including
1The
Court has diversity jurisdiction over McGinnis’s state-law claims under
28 U.S.C. § 1332. McGinnis is a citizen of Illinois. Compl. ¶¶ 8, 11. U.S. Cold Storage is a
citizen of New Jersey (its place of incorporation and principal place of business). R. 14, Def.’s
Answer ¶ 10. The amount in controversy requirement is satisfied. Based on the potential
class action, the aggregate claims of hundreds of class members could exceed $5,000,000,
exclusive of interest and costs. 28 U.S.C. § 1332(d)(6). Even setting aside the class allegation,
it is not “legally impossible” for McGinnis alone to recover more than $75,000 in this action.
Back Doctors Ltd v. Metro. Prop. & Cas. Ins. Co., 637 F.3d 827, 830 (7th Cir. 2011) (amountin-controversy requirement satisfied unless it is “legally impossible” for a plaintiff to recover
that amount).
That said, a plaintiff must also satisfy Article III’s requirements to establish subject
matter jurisdiction over a case, in addition to statutorily conferred jurisdiction. See Moore v.
Olson, 368 F.3d 757, 760 (7th Cir. 2004) (“If Congress has authorized federal courts to resolve
particular claims, and if the claim presents a case or controversy within the scope
of Article III, then federal courts have subject-matter jurisdiction.”) (emphasis added). As
discussed in this Opinion, Article III’s standing requirement is not met in this case.
2Citations to the record are noted as “R.” followed by the docket number and the page
or paragraph number.
fingerprints—unless that person has consented and the private entity has provided
certain disclosures. 740 ILCS 14/15. McGinnis’s claims arise out of U.S. Cold
Storage’s requirement that employees scan their fingerprints or handprints3 in U.S.
Cold Storage’s time-clock system as part of its time-tracking system. Compl. ¶ 2.
McGinnis alleges that U.S. Cold Storage negligently violated the Act by collecting,
storing, and using McGinnis’s biometric identifiers and biometric information
without obtaining written releases and without providing required information to
McGinnis. Id. ¶¶ 55-58, 69. U.S. Cold Storage initially moved to dismiss under
Federal Rule of Civil Procedure 12(b)(6), contending that McGinnis’s claims are timebarred by the applicable statute of limitations. R. 12, Def.’s Mot. Dismiss at 1.
Because this Court has an independent obligation to ensure that it has subject matter
jurisdiction over a case before deciding the merits, United States v. $304,980.00 in
U.S. Currency, 732 F.3d 812, 817-18 (7th Cir. 2013), it terminated that motion (with
leave to renew it if subject matter jurisdiction indeed existed) and requested that the
parties submit position papers on whether McGinnis adequately alleged Article III
standing. R. 24, 09/30/2018 Order. U.S. Cold Storage filed a position paper contending
McGinnis had not established standing, R. 25, Def.’s Pos. Paper, whereas McGinnis
(unsurprisingly) took the position that standing exists, R. 27, Pl.’s Pos. Paper. For the
reasons below, the case is dismissed for lack of Article III standing.
3For
brevity’s sake, the Opinion will refer just to the collection of fingerprints,
although that is meant to include handprints as well as fingerprints.
2
I. Background
For purposes of evaluating the dismissal motion, the Court must accept as true
the allegations in the Complaint. Erickson v. Pardus, 551 U.S. 89, 94 (2007).
McGinnis worked for U.S. Cold Storage between 2011 and 2015, at several of its
Illinois locations. Compl. ¶ 30. When U.S. Cold Storage started using a time-tracking
system based on biometrics in around mid-2012, McGinnis and other employees were
required to scan their fingerprints at the beginning and end of each work day as an
authentication method to track the time worked. Id. ¶¶ 2, 32. McGinnis’s fingerprint
was stored in U.S. Cold Storage’s databases. Id. ¶ 33. U.S. Cold Storage failed to
inform McGinnis of the specific purpose of collecting his fingerprint, did not tell him
how long it would store or use his fingerprint, and did not otherwise provide him a
copy of U.S. Cold Storage’s biometric data-retention policy. Id. ¶¶ 35-36. McGinnis
also never signed a written release allowing U.S. Cold Storage to collect or store his
fingerprint. Id. ¶ 37.
In support of Article III standing, McGinnis alleges that his privacy interests
have been violated by U.S. Cold Storage’s violation of the Act, and that he has
experienced mental anguish as a result. Id. ¶¶ 4, 6, 29, 39, 59. U.S. Cold Storage
argues that these alleged injuries are insufficient to establish Article III standing.
Def.’s Pos. Paper.
II. Standard of Review
The Court evaluates U.S. Cold Storage’s position paper as a motion under
Federal Rule of Civil Procedure 12(b)(1). A Rule 12(b)(1) motion tests whether the
3
Court has subject matter jurisdiction, Hallinan v. Fraternal Order of Police of Chi.
Lodge No. 7, 570 F.3d 811, 820 (7th Cir. 2009); Long v. ShoreBank Dev. Corp., 182
F.3d 548, 554 (7th Cir. 1999). In order to survive a Rule 12(b)(1) motion, the plaintiff
must establish that the district court has subject matter jurisdiction. United
Phosphorous, Ltd. v. Angus Chem. Co., 322 F.3d 942, 946 (7th Cir. 2011), overruled
on other grounds, Minn-Chem, Inc. v. Agrium, Inc., 683 F.3d 845 (7th Cir. 2012). “If
subject matter jurisdiction is not evident on the face of the complaint, [then] the
... Rule 12(b)(1) [motion is] analyzed [like] any other motion to dismiss, by assuming
for purposes of the motion that the allegations in the complaint are true.” Id.
III. Analysis
This case is one of several filed in this District alleging violations of the Act.
See, e.g., Miller v. Sw. Airlines Co., 2018 WL 4030590 (N.D. Ill. Aug. 23, 2018);
Johnson v. United Air Lines, Inc., 2018 WL 3636556 (N.D. Ill. July 31, 2018); Aguilar
v. Rexnord LLC, 2018 WL 3239715 (N.D. Ill. July 3, 2018); Goings v. UGN, Inc., 2018
WL 2966970 (N.D. Ill. June 13, 2018); Dixon v. Washington & Jane Smith Cmty.Beverly, 2018 WL 2445292 (N.D. Ill. May 31, 2018). Indeed, the allegations here are
substantially similar to those advanced in other actions that have been dismissed (or
remanded to state court) for failure to sufficiently plead an Article III injury-in-fact.
See Aguilar, 2018 WL 3239715, at *1; Goings, 2018 WL 2966970, at *1; Howe, 2018
WL 2445541, at *1. McGinnis does not actually attempt to distinguish the reasoning
of these cases and has essentially forfeited the Article III standing argument in his
two-page position paper. The position paper confuses two separate legal issues: what
4
it means to be “aggrieved” under the Illinois Biometric Privacy Act—which is a
question of state statutory interpretation—versus what it means to have suffered an
Article III injury-in-fact. McGinnis’s position paper relies entirely on a state court
opinion that deals solely with the state statutory interpretation issue. Pl.’s Pos. Paper
(citing Sekura v. Krishna Schaumburg Tan, Inc., 2018 WL 4699213, *1-2 (Ill. App.
Ct. 2018) (holding that allegations of mental anguish are sufficient to render a person
“aggrieved” under the Act)). “Standing to sue in any Article III court is, of course, a
federal question which does not depend on the party’s prior standing in state court.”
Phillips Petroleum Co. v. Shutts, 472 U.S. 797, 804 (1985); see also Howe, 2018 WL
2445541, at *3 (noting that although similar, the statutory requirement that a
plaintiff be “aggrieved” is different than the Article III standing requirement); Soto
v. Great Am. LLC, 2018 WL 2364916, at *4-5 (N.D. Ill. May 24, 2018) (collecting cases
and noting the differences between state and federal standing requirements). So
Sekura is of very limited relevance to the Article III standing analysis. That said, for
the sake of completeness, this Court will engage in an analysis of why McGinnis has
failed to allege a concrete injury for Article III purposes.
To establish standing, a plaintiff “must have (1) suffered an injury in fact, (2)
that is fairly traceable to the challenged conduct of the defendant, and (3) that is
likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 136 S.
Ct. 1540, 1547 (2016). Here, the dispute over standing turns on whether U.S. Cold
Storage’s alleged violations of the Act’s notice-and-consent provisions resulted in an
injury-in-fact. A plaintiff establishes an injury-in-fact by showing that he or she
5
“suffered an invasion of a legally protected interest that is concrete and
particularized.” Id. at 1548 (cleaned up).4 The Court explained, “[a]lthough tangible
injuries are perhaps easier to recognize, we have confirmed in many of our previous
cases that intangible injuries can nevertheless be concrete.”5 Id. at 1549 (emphasis
added).
In determining which intangible injuries are sufficient to confer standing and
which are not, Spokeo set out basic principles: a “bare procedural violation” of a
statute is not automatically enough to satisfy Article III’s concreteness requirement.
136 S. Ct. at 1549. To be sure, “[i]n determining whether an intangible harm
constitutes injury in fact, both history and the judgment of Congress play important
roles.” Id. When Congress has created a cause of action for a statutory violation, by
definition it has created a legally protected interest that Congress, at least, deems
important enough for a lawsuit. Going beyond federal statutes, the Seventh Circuit
has recognized the importance of state legislative judgments as well. See Scanlan v.
Eisenberg, 669 F.3d 838, 845 (7th Cir. 2012) (noting the importance of federal
congressional judgments and reasoning “the same must also be true of legal rights
growing out of state law”) (cleaned up). Spokeo explained that the legislative branch,
4This
Opinion uses (cleaned up) to indicate that internal quotation marks, alterations,
and citations have been omitted from quotations. See Jack Metzler, Cleaning Up Quotations,
18 Journal of Appellate Practice and Process 143 (2017).
5At the same time, concreteness is indeed a requirement that is separate and apart
from the Article III requirement that the injury be “particularized” to the individual plaintiff.
Spokeo, 136 S. Ct. at 1548. Specifically, “[t]o establish injury in fact, a plaintiff must show
that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and
particularized.’” Id. at 1548 (emphasis added) (quoting Lujan v. Defs. of Wildlife, 504 U.S.
555, 560 (1992)).
6
with its fact-finding ability and responsiveness to public interest, “is well positioned
to identify intangible harms that meet minimum Article III requirements,” so
Congress’s (or the state legislature’s) judgment on the nature of the injury is
“instructive and important.” 136 S. Ct. at 1549. Still, the legislature’s “role in
identifying and elevating intangible harms does not mean that a plaintiff
automatically satisfies the injury-in-fact requirement whenever a statute grants a
person a statutory right … . Article III standing requires a concrete injury even in
the context of a statutory violation.” Id. (emphasis added). And the concrete injury, if
based on a risk of harm, must present an “appreciable risk of harm.” Groshek v. Time
Warner Cable, Inc., 865 F.3d 884, 886-87, 889 (7th Cir. 2017) (plaintiff lacked
standing to sue for a violation of the Fair Credit Reporting Act where the defendant
obtained a credit report without providing the required disclosures; although the
defendant’s action violated plaintiff’s privacy, it was merely a “statutory violation
completely removed from any concrete harm or appreciable risk of harm”).6 So the
question is whether the notice-and-consent violations pled by McGinnis create an
“appreciable risk of harm” to the interests that the statute was enacted to protect.
The Illinois legislature found that (1) biometrics are uniquely sensitive and
when compromised, put individuals at a heightened risk for identity theft; (2)
biometric technology is cutting edge, and “[t]he full ramifications of biometric
6As
this Court detailed in Rivera v. Google, 2018 WL 6830332, at *7-11 (N.D. Ill. Dec.
29, 2018), the examples offered in Spokeo of cases involving common law torts or purely
procedural violations of information-access statutes are distinguishable from the notice-andconsent violations of the Act as pled here.
7
technology are not fully known”; (3) the public is “weary”7 of using biometrics when
tied to personal information; and (4) regulating biometric collection, use, and storage
serves the public interest. 740 ILCS 14/5(c)-(g). To those ends, the Act requires that
any private entity that possesses biometric information or identifiers must develop
and make available a retention schedule and guidelines for destroying that
information. 740 ILCS 14/15(a). And even before collecting or storing biometric
information or identifiers, the private entity must provide certain information to and
obtain the consent of the person whose information is being collected. Id. § 14/15(b).
But U.S. Cold Storage’s failure to provide and obtain the statutorily required
notice or consent when collecting and retaining McGinnis’s fingerprint—without
more—does not constitute a concrete injury for Article III purposes. To be sure,
disclosing a biometric identifier to a third-party might very well constitute a concrete
injury to an individual’s privacy. See Dixon, 2018 WL 2445292, at *9 (“Obtaining or
disclosing a person’s biometric identifiers or information without her consent or
knowledge necessarily violates that person’s right to privacy in her biometric
information.”). U.S. Cold Storage questions whether all disclosures to any third-party
really present a concrete injury, arguing that “[p]ayroll vendors typically are privy to
all kinds of confidential information … and have strong protocols and practices in
place to protect such data,” so it was not clear that Dixon was harmed by the alleged
violation. Def.’s Pos. Paper at 6 (discussing Dixon, 2018 WL 2445292, at *8-9). There
is some force to that line of reasoning when the third-party is a payroll vendor, but
7It
is possible that the word “weary” in the Act, 740 ILCS 14/5(d), was intended to be
“wary.”
8
this Court need not determine whether that sort of disclosure qualifies as a sufficient
concrete injury, because McGinnis does not allege any such disclosure (nor did he ask
for jurisdictional discovery). The Seventh Circuit has held that the mere retention of
personally identifying information that was obtained with the person’s knowledge is
insufficient to confer Article III standing if there is no risk of unauthorized disclosure.
Gubala v. Time Warner Cable, Inc., 846 F.3d 909, 912-13 (7th Cir. 2016); see also
Aguilar, 2018 WL 3239715, at *3 (“[N]otice and consent violations [of the Act] do not
without more create a risk of disclosure … .”).
Here, there is no allegation that McGinnis did not know that his fingerprint
was being collected. Rather, he alleges that after U.S. Cold Storage implemented its
biometric time-tracking system in 2012, he was “required to scan his fingerprint
and/or handprint so that [U.S.] Cold could use it as an authentication method to track
his time.” Compl. ¶ 32. McGinnis knew his fingerprints were being collected because
he scanned them in every time he clocked in or out of work, and he knew they were
being stored because the time-clock-scanned prints were obviously being compared to
a stored set of prints. All other courts in this District that have considered whether a
person suffers a concrete injury from the known collection and retention of a
fingerprint, without disclosure to a third-party, have answered the question no. See
Johnson, 2018 WL 3636556; Aguilar, 2018 WL 3239715; Goings, 2018 WL 2966970;
Howe, 2018 WL 2445541; McCollough v. Smarte Carte, Inc., 2016 WL 4077108 (N.D.
Ill. Aug. 1, 2016). This Court agrees.8
8This
Court recently held that even if a plaintiff does not know that biometric
information is being collected, then the plaintiff still might fail to adequately allege a concrete
9
Finally, as noted above, McGinnis does not plead any facts suggesting that
there is a risk of disclosure, either intentionally to a third-party vendor as in Dixon,
or via a data breach of U.S. Cold Storage’s system. For a plaintiff to rely on a risk of
future harm to satisfy Article III’s concrete injury requirement, the plaintiff must
establish a “substantial risk” that the future harm will occur. Clapper v. Amnesty Int’l
USA, 568 U.S. 398, 414 n.5 (2013). Nowhere in the complaint is there any allegation
of disclosure, other than a speculative note that “[U.S.] Cold fails to inform its workers
… to whom the [biometric] data is disclosed, if at all.” Compl. ¶ 26 (emphasis added).
That allegation does not come close to the kind of situation in which the risk of future
harm satisfies Article III concreteness requirements. See, e.g., Lewert v. P.F. Chang’s
China Bistro, Inc., 819 F.3d 963, 968-69 (7th Cir. 2016) (hackers already had
breached the defendant’s database and stolen customers’ payment-card information,
so the risk of identity theft and the precautions customers took to mitigate the risk
constituted a concrete injury). The mental anguish alleged by McGinnis arises from
the possible disclosure of his biometric data, as well as the unknown period of
retention. Compl. ¶ 39. But as discussed, McGinnis does not allege that his data was
already—or is even likely to be—compromised or disclosed, so any emotional injury
he suffers from that fear is a product of the sort of hypothetical injury the Supreme
Court has held cannot support Article III standing. Clapper, 568 U.S. at 402
injury if there is no risk of identity theft. See Rivera, 2018 WL 6830332, at *8-11 (holding
that the creation and retention of face templates created from photographs of plaintiffs’ faces
without their knowledge did not constitute an injury-in-fact where there was no disclosure to
a third-party and no imminent risk of identity theft). But it is a much easier question here,
because McGinnis does not allege that his biometric information was collected without his
knowledge.
10
(“[R]espondents cannot manufacture standing by choosing to make expenditures
based on hypothetical future harm that is not certainly impending.”). His anxiety
about “whether [U.S.] Cold will ever delete his biometric information” Compl. ¶ 39,
does not on its own constitute a concrete injury because the mere retention of data
does not in itself cause an injury-in-fact absent a substantial risk of disclosure.
Gubala, 846 F.3d at 912. What’s more, that fear of indefinite retention arises out of
the same underlying fear that the fingerprints will be compromised or disclosed,
which is too speculative to satisfy the requirement of concrete injury under Article
III.9
IV. Conclusion
The Court lacks subject matter jurisdiction because McGinnis has not alleged
a concrete injury sufficient to satisfy Article III. The case is dismissed for lack of
subject matter jurisdiction. The status hearing of January 11, 2019 is vacated.
ENTERED:
s/Edmond E. Chang
Honorable Edmond E. Chang
United States District Judge
DATE: January 3, 2019
9In
its answer, U.S. Cold Storage stated that it destroyed McGinnis’s biometric data
as required by Section 15(a) of the Act. Answer ¶¶ 35-36. Whether U.S. Cold Storage complied
with the Act’s destruction requirements is not at issue for purposes of determining standing,
but that representation supports a holding that any emotional injury based on a fear of future
disclosure of his biometric data is purely speculative.
11
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?