Aguilar v. Rexnord Corporation
Filing
50
MEMORANDUM Opinion and Order. Signed by the Honorable Manish S. Shah on 7/3/2018: Because this court lacks subject-matter jurisdiction, the action is remanded to the Circuit Court of Cook County, Illinois, forthwith pursuant to 28 U.S.C. § 1447 (c). No fees or costs will be awarded under § 1447(c), because jurisdiction was reasonably debatable and plaintiff's failure to seek a remand indicates that he was not prejudiced by the removal. Defendants' motion to dismiss 22 will be transferred to the Circuit Court of Cook County. [For further detail see attached order.] Notices mailed. (psm, )
UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF ILLINOIS
EASTERN DIVISION
SALVADOR AGUILAR,
Plaintiff,
No. 17 CV 9019
v.
REXNORD LLC and REXNORD
INDUSTRIES LLC,
Judge Manish S. Shah
Defendants.
MEMORANDUM OPINION AND ORDER
Plaintiff Salvador Aguilar alleges that his employer collected and stored his
and other similarly-situated individuals’ fingerprints in violation of the Illinois
Biometric Information Privacy Act, 740 ILCS 14/1, et seq. Aguilar initially filed this
action against Rexnord LLC and Rexnord Industries LLC in state court, but
Rexnord removed the lawsuit to this court. Rexnord now moves to dismiss the
complaint for the failure to state a claim. For the reasons below, the action is
remanded to state court for a lack of subject-matter jurisdiction.
I.
Facts
Plaintiff Salvador Aguilar worked for Rexnord Industries LLC, a subsidiary
of Rexnord LLC. [16] ¶¶ 10, 32.1 While Aguilar was an employee, Rexnord
implemented a time clock system that used employees’ fingerprints to track when
employees began and ended their workdays. [16] ¶¶ 29–33. The system required
Bracketed numbers refer to docket numbers on the district court docket. Page numbers
are taken from the CM/ECF header at the top of filings. The facts are taken from the
operative complaint, [16].
1
employees to have their fingerprints collected so the prints could be stored and used
to authenticate the employees’ identities when they clocked in and out. [16] ¶¶ 33–
34. When Aguilar got to work, he clocked in by scanning his fingerprint and clocked
out by scanning it again when he left. [16] ¶ 35. Aguilar never signed a written
release allowing Rexnord to collect or store his fingerprint, and Rexnord never
explained the specific purposes of collecting the fingerprint or told Aguilar how long
it would keep or use his fingerprint, including what the retention policy was and
whether the fingerprint would ever be deleted. [16] ¶¶ 36–38.
Aguilar filed suit in the Circuit Court of Cook County, Illinois, [1-2], and
Rexnord removed the suit to this court. [1].
II.
Analysis
A.
Biometric Information Privacy Act
The Biometric Information Privacy Act “regulat[es] the collection, use,
safeguarding, handling, storage, retention, and destruction of biometric identifiers
and information.” 740 ILCS 14/5(g). “Biometric identifier” is defined to include a
fingerprint, among other things. 740 ILCS 14/10. Biometric information is
particularly sensitive because unlike social security numbers, which can be changed
if necessary, biometric identifiers cannot be changed. 740 ILCS 14/5(c). Recognizing
this concern, the Illinois legislature enacted a statute to protect the privacy of
biometric information.
The act requires private entities that possess biometric information to
develop a publicly available written policy that includes a retention schedule and
2
destruction guidelines. 740 ILCS 14/15(a). In order to collect biometric information,
private entities must first (1) inform the person whose biometric information is
being collected that it is being collected or stored; (2) inform the person of the
“specific purpose and length of term” for which the biometrics are being collected,
stored, and used; and (3) receive a written release from the person. 740 ILCS
14/15(b). The act also regulates the sale, disclosure, and careful storage of biometric
information. 740 ILCS 14/15(c)–(e). The statute is enforced by a private right of
action, available to “[a]ny person aggrieved by a violation.” 740 ILCS 14/20.
B.
Rexnord’s Motion to Dismiss under Rule 12(b)(6)
Rexnord’s core argument for dismissal of Aguilar’s BIPA claim is that Aguilar
has suffered no actual injury from any alleged violation and therefore is not an
“aggrieved” person entitled to a private right of action under the act.2 But if
Rexnord is correct that Aguilar has not alleged any actual injury from the purported
privacy violations, how can he satisfy the injury-in-fact requirement for Article III
standing? Although constitutional and statutory standing are separate inquiries,
here they raise similar (but not identical) questions. As other courts have observed,
many of the federal cases cited by the parties that examine the issue of whether a
plaintiff is “aggrieved” under BIPA also address standing issues. See, e.g., Dixon v.
Washington & Jane Smith Cmty.-Beverly, No. 17 C 8033, 2018 WL 2445292, at *4
(N.D. Ill. May 31, 2018) (collecting cites); Howe v. Speedway LLC, No. 17-CV-07303,
2018 WL 2445541, at *3 (N.D. Ill. May 31, 2018) (same).
The complaint pleaded a negligence claim, which Rexnord also moved to dismiss. Aguilar
voluntarily withdrew the negligence claim in his response brief. [25] at 15.
2
3
Rexnord does not argue that Aguilar lacks standing to pursue his claims in
federal court, likely to avoid remand of the lawsuit that it removed; nor does
Aguilar request remand based on standing, likely to avoid the somewhat awkward
(but not impossible) position of arguing that he did not suffer sufficient injury to
confer Article III standing but that the injury was sufficient to render him
aggrieved within the meaning of the statute. See Howe, 2018 WL 2445541, at *3–4.
Nevertheless, I have an independent obligation to ensure subject-matter jurisdiction
exists, even if no party raises the issue, and standing is an important component of
subject-matter jurisdiction. United States v. $304,980.00 in U.S. Currency, 732 F.3d
812, 817 (7th Cir. 2013).
C.
Article III Standing
Article III of the Constitution limits the jurisdiction of federal courts to
“Cases” and “Controversies,” and the doctrine of standing enforces that limitation.
Spokeo, Inc. v. Robins, 136 S.Ct. 1540, 1547 (2016). A plaintiff has standing to sue if
she “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged
conduct of the defendant, and (3) that is likely to be redressed by a favorable
judicial decision.” Id. Aguilar alleges that Rexnord violated the statute’s notice and
consent provisions, and the question is whether he has alleged an injury in fact as a
result of those violations. Not just any injury will do—Aguilar must have suffered
“‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and
‘actual or imminent, not conjectural or hypothetical.’” Id. at 1548 (citation omitted).
Tangible harms, like financial losses, may be more easily identifiable as concrete
4
injuries, but intangible harms can also satisfy the injury-in-fact requirement.
Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 886 (7th Cir. 2017).
Sometimes a procedural statutory violation constitutes an injury in fact on its
own and does not require a showing of any additional harm. Spokeo, 136 S.Ct. at
1549. That is because legislatures can “elevat[e] to the status of legally cognizable
injuries concrete, de facto injuries that were previously inadequate in law.” Lujan v.
Defs. of Wildlife, 504 U.S. 555, 578 (1992).3 Even so, a procedural statutory violation
“divorced from any concrete harm” does not satisfy standing requirements. Spokeo,
136 S.Ct. at 1549. Rather, a statutory violation only causes an injury concrete
enough to satisfy Article III standing if it “present[s] an ‘appreciable risk of harm’ to
the underlying concrete interest that [the legislature] sought to protect by enacting
the statute.” Groshek, 865 F.3d at 887. So the question becomes whether Rexnord’s
alleged violations of the act’s notice and consent provisions create a risk of harm to
the concrete interests the statute was enacted to protect.4
The statute lists legislative findings including the growing use of biometric
information and the unique sensitivity of biometric data given that “once
compromised, the individual has no recourse.” 740 ILCS 14/5(a)–(c). The legislature
also found that the public was wary of entering into transactions that used
Just as the United States Congress can create injuries in fact, so too can state
legislatures. See Patel v. Facebook Inc., 290 F.Supp.3d 948, 953 (N.D. Cal. 2018).
3
This argument could also be articulated as one of “informational injury,” in which a
“plaintiff fails to obtain information which must be publicly disclosed pursuant to a
statute.” Fed. Election Comm’n v. Akins, 524 U.S. 11, 21 (1998). Whether phrased as an
informational injury or a violation of a statute mandating the disclosure of information, the
question is the same.
4
5
biometric identifiers. 740 ILCS 14/5(d)–(e). So the legislature concluded that “[t]he
public welfare, security, and safety will be served by regulating the collection, use,
safeguarding, handling, storage, retention, and destruction of biometric identifiers
and information.” 740 ILCS 14/5(g). These findings demonstrate that the core
interest the legislature sought to protect is the privacy of biometric information. See
Howe, 2018 WL 2445541, at *5 (“[T]he concrete interest underlying BIPA is the
protection and security of biometric data.”); Dixon, 2018 WL 2445292, at *9 (“The
Illinois legislature’s intent to create a legal right to privacy in personal biometric
data and to protect the right to control one’s biometric identifiers and information is
evident from its statement of legislative findings and intent as well as from the
substantive provisions of the Act.”); In re Facebook Biometric Info. Privacy Litig.,
185 F.Supp.3d 1155, 1169 (N.D. Cal. 2016) (“BIPA manifests Illinois’ substantial
policy of protecting its citizens’ right to privacy in their personal biometric data.”).
The complaint also adopts this understanding of the act’s purpose. [16] ¶ 16 (noting
the statute’s “goal of protecting individuals’ privacy rights”).
Rexnord’s violations of the notice and consent provisions do not create an
“appreciable risk of harm” to Aguilar’s right to privacy in his fingerprints. A
person’s privacy may be invaded if her biometric information is obtained or
disclosed without her consent or knowledge. See Dixon, 2018 WL 2445292, at *9
(“Obtaining or disclosing a person’s biometric identifiers or information without her
consent or knowledge necessarily violates that person’s right to privacy in her
biometric information.”). But notice and consent violations do not without more
6
create a risk of disclosure,5 and Aguilar knew his biometric information was being
collected, even though he did not receive formal notice and give formal consent.
Aguilar knew his fingerprints were being collected because he scanned them each
time he clocked in and out at work, and it was clear that the fingerprints were
stored since they were used for authentication purposes. So “proper compliance with
BIPA’s disclosure and written authorization requirements would only have made
explicit what should have already been obvious,” and “the procedural violation from
disclosure omissions causes negligible harm for Article III purposes.” Howe, 2018
WL 2445541, at *6. This has also been the conclusion of other courts that have
considered the question in the context of an employer’s biometric clocking system,
and I agree with their analysis. See id.; Goings v. UGN, Inc., No. 17-CV-9340, 2018
WL 2966970, at *3 (N.D. Ill. June 13, 2018).
That is not to say that violations of the notice and consent provisions can
never constitute an injury in fact without additional harm. For instance, collecting a
person’s biometric information without her knowledge or consent could violate her
privacy interests and constitute an injury in fact. See Patel, 290 F.Supp.3d at 955;
Monroy v. Shutterfly, Inc., No. 16 C 10984, 2017 WL 4099846, at *8 n.5 (N.D. Ill.
Sept. 15, 2017). And violations of the statute’s other provisions may also be enough
to satisfy the injury-in-fact requirement without other harms. See Dixon, 2018 WL
Whether Aguilar was given notice of the contents of Rexnord’s retention policy would not
make it any more or less likely that his biometric information would be compromised.
Whether the practices outlined in the retention policy violated the statute’s requirements
for safeguarding biometric information (and therefore potentially created a risk of
disclosure) is a separate question and a different statutory violation that is not alleged in
Aguilar’s complaint.
5
7
2445292, at *10 (finding Article III standing in a BIPA case where biometric
information was alleged to have been disclosed to a third party). But here, the
violations are divorced from concrete harm, including harm to Aguilar’s privacy
interest in his biometric information and harm to his right to know that the
information was collected, and therefore do not constitute injuries in fact.
Apart from the statutory violations, the privacy and emotional injuries
pleaded in the complaint do not constitute injuries in fact either. Violations of
privacy are actionable and can constitute injuries in fact. See Gubala v. Time
Warner Cable, Inc., 846 F.3d 909, 912 (7th Cir. 2017); Patel, 290 F.Supp.3d at 954.
But, as explained above, there is no allegation that Rexnord ever disclosed Aguilar’s
biometric information and there are no alleged facts from which to infer a risk of
disclosure, so any privacy injury is conjectural. See Gubala, 846 F.3d at 912. Since
Aguilar knew his fingerprints were being scanned and stored, at least for timekeeping purposes, the absence of additional disclosures required by the act did not
cause any appreciable risk of harm to his right to know that his biometric
information was collected. And Aguilar’s alleged emotional injuries, even those
based on the unknown retention period, are based on fears that derive from his
biometric data being compromised or disclosed, [16] ¶ 40, which similarly have no
factual basis in the allegations of the complaint and are therefore “precisely the
type of conjectural or hypothetical injury that cannot support Article III standing.”
Howe, 2018 WL 2445541, at *4. See also Goings, 2018 WL 2966970, at *4.
8
Without an injury in fact sufficient to satisfy Article III standing
requirements, Aguilar cannot maintain his action in federal court.
III.
Conclusion
Because this court lacks subject-matter jurisdiction, the action is remanded
to the Circuit Court of Cook County, Illinois, forthwith pursuant to 28 U.S.C.
§ 1447(c). No fees or costs will be awarded under § 1447(c), because jurisdiction was
reasonably debatable and plaintiff’s failure to seek a remand indicates that he was
not prejudiced by the removal. Defendants’ motion to dismiss [22] will be
transferred to the Circuit Court of Cook County.
ENTER:
___________________________
Manish S. Shah
United States District Judge
Date: July 3, 2018
9
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?