Searching over 5,500,000 cases.


searching
Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

McGinnis v. United States Cold Storage, Inc.

United States District Court, N.D. Illinois, Eastern Division

December 23, 2019

RICHARD MCGINNIS, individually and on behalf of all others similarly situated, Plaintiff,
v.
UNITED STATES COLD STORAGE, INC., Defendant.

          MEMORANDUM OPINION AND ORDER

          Edmond E. Chang, United States District Judge.

         Back in 2017, Richard McGinnis filed a class-action complaint in this Court against his employer, United States Cold Storage, Inc., under the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq. See No. 17 C 00854, R. 1. Early on in that case, this Court directed the parties to file position papers on whether McGinnis had Article III standing to bring the case. U.S. Cold Storage filed a position paper contending that McGinnis had not sufficiently alleged a concrete harm; meanwhile, McGinnis (unsurprisingly, at least at that time) took the opposite position. This Court agreed with U.S. Cold Storage and dismissed that case for lack of subject matter jurisdiction. R. 4, Notice of Removal ¶ 3; McGinnis v. United States Cold Storage, Inc., 382 F.Supp.3d 813, 820 (N.D. Ill. 2019).

         The next day, McGinnis filed a new complaint, this time in Will County Circuit Court. Notice of Removal, Exh. B, Will County Compl. McGinnis's claims again arise out of U.S. Cold Storage's requirement that employees scan their fingerprints or handprints[1] in U.S. Cold Storage's time-tracking system. Id. His allegations are virtually the same as the ones in the prior federal complaint, with one exception: McGinnis now also alleges that U.S. Cold Storage disclosed McGinnis' fingerprints to a non-party payroll vendor without his consent. Id. ¶ 21; see also Notice of Removal, ¶ 3. U.S. Cold Storage then filed a notice of removal, bringing the Will County complaint back to this Court on the basis of diversity jurisdiction, 28 U.S.C. § 1332. Notice of Removal ¶ 11.[2]

         So now the parties are back in this Court, and the standing issue that was once put in a deep freeze has been revived in light of the payroll-vendor disclosure allegation. This time around, the parties have switched places on the standing issue. U.S. Cold Storage now argues that the Article III standing is satisfied because the alleged disclosure is a sufficiently concrete harm. Notice of Removal ¶¶ 3-4. And McGinnis contends that there is no concrete harm under Article III. R. 27-1, Pl.'s Resp. Br.[3] For the reasons stated below, the case is dismissed for lack of Article III standing, and remanded back to Will County Circuit Court.

         I. Background

         B. Factual Background

         For purposes of evaluating the dismissal motion, the Court must accept as true the allegations in the Complaint, Erickson v. Pardus, 551 U.S. 89, 94 (2007), although if a factual dispute arises over subject matter jurisdiction, the Court may engage in jurisdictional fact-finding. The Court assumes familiarity with the facts of the dispute between the parties as described more fully in the opinion that dismissed McGinnis' prior federal complaint. See McGinnis, 382 F.Supp.3d at 816. In addition to the notice-and-consent violations alleged in the federal complaint, McGinnis now also alleges that U.S. Cold Storage disclosed McGinnis' fingerprint data (without his consent) to a non-party payroll[4] vendor that maintains U.S. Cold Storage's timekeeping system. Will County Compl. ¶¶ 20-22. McGinnis again alleges that U.S. Cold Storage violated his privacy interests, and that he has experienced mental anguish as a result. Id. ¶¶ 24-25. Specifically, McGinnis alleges that he experiences mental anguish when he thinks about the possibility of U.S. Cold Storage's database being hacked and his biometric information being stolen. Id. The question before this Court is whether these new disclosure allegations are sufficient to establish Article III standing.[5]

         II. Legal Standard

         “Subject-matter jurisdiction is the first issue in any case.” Miller v. Southwest Airlines Co., 926 F.3d 898, 902 (7th Cir. 2019). If, after removal, “it appears that the district court lacks subject matter jurisdiction, the case shall be remanded.” 28 U.S.C. 1447(c); see also Collier v. SP Plus Corporation, 889 F.3d 894, 895 (7th Cir. 2018) (per curium) (explaining that remand is required when jurisdiction is lacking). “[T]he party seeking removal … bears the burden of establishing federal jurisdiction.” Tri-State Water Treatment, Inc. v. Bauer, 845 F.3d 350, 352 (7th Cir. 2017). So in removal cases such as this, the defendant bears the burden of showing that the plaintiff had Article III standing at the time of removal. Miller v. Southwest Airlines Co., 2018 WL 4030590, *3 (N.D. Ill. August 23, 2018) aff'd 926 F.3d 898 (7th Cir. 2019); see also Collier, 889 F.3d at 896. Finally, “federal courts should interpret the removal statute narrowly, resolving any doubt in favor of the plaintiff's choice of forum in state court.” Schur v. L.A. Weight Loss Centers, Inc., 577 F.3d 752, 758 (7th Cir. 2009).

         III. Analysis

         To have standing to bring a federal case, a “plaintiff must have (1) suffered an injury in fact (2) that is fairly traceable to the challenged conduct of the defendant and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 136 S.Ct. 1540, 1547 (2016). The question here is whether McGinnis suffered an injury in fact from the alleged unauthorized disclosure. An injury in fact occurs when a plaintiff “suffered an invasion of a legally protected interest that is concrete and particularized.” Id. at 1548 (emphasis added) (cleaned up)[6]. In Spokeo, the Supreme Court explained that “[a]lthough tangible injuries are perhaps easier to recognize, we have confirmed in many of our previous cases that intangible injuries can nevertheless be concrete.”[7] Id. at 1549 (emphasis added). In determining which intangible injuries are sufficient to confer standing and which are not, Spokeo set out a basic principle: a “bare procedural violation” of a statute is not automatically enough to satisfy Article III's concreteness requirement. 136 S.Ct. at 1549. A legislature's judgment in creating a legally protected interest protected by a statute is an important consideration, but to be concrete, the interest must still be accompanied by “an appreciable risk of harm to the underlying concrete interest that [the legislature] sought to protect by enacting the statute.” Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 887 (7th Cir. 2017) (cleaned up); see also Scanlan v. Eisenberg, 669 F.3d 838, 845 (7th Cir. 2012) (recognizing the importance of state legislative judgments).

         In passing the Biometric Information Privacy Act (BIPA), the Illinois legislature found that (1) biometrics are uniquely sensitive and when compromised, put individuals at a heightened risk for identity theft; (2) biometric technology is cutting edge, and “[t]he full ramifications of biometric technology are not fully known”; (3) the public is “weary” of using biometrics when tied to personal information; and (4) regulating biometric collection, use, and storage serves the public interest. 740 ILCS 14/5(c)-(g). To those ends, the Act prohibits any private entity in possession of biometric information from “disclos[ing], redisclos[ing], or otherwise disseminat[ing] a person's … biometric identifier or biometric information” unless the person consents to the disclosure or redisclosure. 740 ILCS 14/15(d). McGinnis alleges that he never consented to disclosure and that U.S. Cold Storage nevertheless disclosed his fingerprints to an outside payroll vendor. Will County Compl. ¶ 50. That is no doubt a violation of the statute. As the Court previously explained, though, absent an allegation of disclosure beyond the employer or a risk of disclosure beyond the employer, the retention of personally identifying information obtained without the employee's consent is not a sufficiently concrete harm under Article III. 382 F.Supp.3d at 819.

         The key question here is whether the alleged disclosure to U.S. Cold Storage's payroll vendor is enough to satisfy the concrete-harm requirement. As far as the allegations and record go, there is an insufficient risk of future harm to the privacy interests that BIPA seeks to protect, that is, the risk of identity theft.[8] 740 ILCS 14/5(c)-(g). Risk of future harm might be enough to satisfy Article III standing, but the risk still must be concrete. See, e.g., Clapper v. Amnesty Int'l USA, 568 U.S. 398, 414 n.5 (2013); see also Lewert v. P.F. Chang's China Bistro, Inc., 819 F.3d 963, 968-69 (7th Cir. 2016). McGinnis has not alleged, for instance, that the disclosure subjected his biometric information to a heightened risk of identity theft now that it has been disclosed to the payroll vendor, nor does U.S. Cold Storage offer any evidence of that risk. Indeed, last time around, U.S. Cold Storage argued that disclosure to a non-party payroll vendor would not pose a substantial risk of injury because “[p]ayroll vendors typically are privy to all kinds of confidential information … and have strong protocols and practices in place to protect such data.” See McGinnis, 382 F.Supp.3d at 819. And this time, McGinnis takes U.S. Cold Storage's previous argument one step further by presenting an example of the extensive data security policies and procedures that payroll vendors implement. See R. 31, Pl.'s Surreply at 4 n.2.

         That is not to say that an unauthorized disclosure to a non-party payroll vendor could never be sufficient to satisfy the concrete-harm requirement. Indeed, an unauthorized disclosure might very well present “an appreciable risk of harm” to a person's right to privacy in some instances. For instance, if U.S. Cold Storage disclosed McGinnis's biometric information to a payroll vendor that did not have any data-security controls in place, then disclosure to that party might put McGinnis's biometric information at a heightened risk of breach. But U.S. Cold Storage has not offered any reason to think that that might be the ...


Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.