In Snider v. Heartland Beef, No. 4:20-cv-04026-SLD-JEH, 2020 U.S. Dist. LEXIS 152791 (C.D. Ill. Aug. 14, 2020), Plaintiff (a former Arby’s employee) filed a lawsuit against Heartland Beef (an Arby’s franchisee). In the lawsuit, Plaintiff alleged that Heartland violated the Illinois Biometric Information Privacy Act (“BIPA”) by “scanning and retaining employee fingerprints without informed consent and failing to maintain and publish a data-retention policy.” Plaintiff’s lawsuit asserts claims on behalf of herself and a putative class of “citizens of Illinois who have had their fingerprints collected, captured, received, or otherwise obtained by Heartland … in Illinois.”

The suit, filed in the Circuit Court of Cook County, Illinois, was removed to the Northern District of Illinois under diversity jurisdiction (28 U.S.C. § 1332(a)) and the Class Action Fairness Act (28 U.S.C. § 1332(d)). Subsequently, the case was transferred to the immediate court where Heartland moves to dismiss the Complaint pursuant to Federal Rule of Civil Procedure 12(b)(6).

In its analysis, the Court first undertook a sua sponte review of Plaintiff’s Article III standing based on her BIPA claims. The Court’s analysis hinged on its reading of Bryant v. Compass Grp. USA, Inc., 958 F.3d 617 (7^th Cir. 2020). In Bryant, the Seventh Circuit considered whether the plaintiff had standing to bring claims under sections 15(a) and 15(b) of BIPA. Ultimately, the Bryant court held that a plaintiff could meet Article III’s standing requirements if her section 15(b) allegation contemplated a defendant’s failure to “make the requisite disclosures … or obtain her informed consent before collecting her biometric identifier.” However, concerning a section 15(a) claim, the Bryant court held that “the duty to disclose under section 15(a) is owed to the public generally, not to particular persons whose biometric information the entity collects.” Accordingly, if a plaintiff does not allege a particularized harm resulting from the defendant’s violation of section 15(a), a plaintiff cannot suffer a concrete and particularized injury and therefore lacks standing under Article III.

Based upon the Bryant court’s analysis, the Court here found Plaintiff adequately alleged a violation of BIPA’s section 15(b) (i.e.,“alleging that Heartland did not inform [Plaintiff] and the putative class that their identifiers would be collected and stored … the purpose and length of time … their identifiers were being collected, stored, and used, and did not receive written releases from [Plaintiff] and the putative class authorizing such collection, storage, and use”), but not section 15(a). Regarding section 15(a), the Court reasoned, Plaintiff’s allegations (i.e., “Heartland failed and continues to fail to maintain a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information”) lend themselves to alleging a harm to the public, not a harm particular to the plaintiff. Thus, even though Plaintiff, “as compared to a member of the public would have been in a position to make use of the missing section 15(a) information … any particularized need for the section 15(a) information is properly traced to the concomitant Section 15(b) violation.” In short, the Court here found it lacked subject matter jurisdiction over Plaintiff’s 15(a) claim because Plaintiff’s Complaint did not allege she suffered a concrete and particularized harm from Heartland’s “failure to develop and make public a data-retention policy.” Accordingly, the Court granted Plaintiff leave to amend her Complaint within 14 days to properly alleged standing in order to pursue a claim under section 15(a). Having determined jurisdiction over Plaintiff’s 15(b) claim the Court turned to an analysis of Heartland’s motion to dismiss.

Heartland asserted three arguments for why Plaintiff’s Complaint should be dismissed: (1) her BIPA claims are preempted by the Illinois Workers’ Compensation Act (“IWCA”), (2) she failed to allege the requisite negligence, recklessness, or intent to support her BIPA claims, and (3) her claims are barred by assumption of the risk. In dismissing Heartland’s first argument, the Court held that Plaintiff asserts an injury to “a right to privacy in and control over their biometric identifiers and biometric information,” not a “physical or psychological injury.” Because physical or psychological injuries are compensable under the IWCA, but – injuries to a right of privacy are not, the Court held that the IWCA cannot preempt Plaintiff’s BIPA claims.

Heartland’s next argument on behalf of its motion to dismiss, that Plaintiff did not allege state of mind, “is a common one in BIPA litigation.” Ultimately, the Court found that Plaintiff had “plausibly alleged at least negligence and therefore had plausibly pleaded an entitlement to damages.” Specifically, Plaintiff alleged that despite its illegality since at least 2008, Heartland continued to collect biometric identifiers without written consent as late as December 2018. Due to this, the Court held, “it is plausible that Heartland acted at least negligently in failing to follow the law for ten years.”

Lastly, Heartland argued, “[a] plaintiff, including an employee, assumes risks that are inherent in the nature of an activity, including employment.” The Court found this assertion unavailing as well, noting, “Heartland does not address the other part of the assumption of risk defense—a plaintiff must implicitly consent to encounter a known risk.” Due to Plaintiff not pleading that she consented to encounter a known risk, it follows that it would be inappropriate for the Court to dismiss her Complaint. Thus, Heartland’s motion to dismiss was denied and Plaintiff was given leave to amend her BIPA section 15(a) to effectuate standing or risk the Court severing that particular claim and having it remanded to state court. The decision to sever Plaintiff’s case and send part of it back to state court is significant from a defense perspective, as Heartland will be stuck defending two lawsuits instead of one. Not only will Heartland be required to defend multiple lawsuits, it will be required to do so in state and federal court and it did not even challenge standing in the first place.