Case: 1:19-cv-00382 Document #: 117 Filed: 06/16/20 Page 1 of 18 PageID #:694
`
`IN THE UNITED STATES DISTRICT COURT
`FOR THE NORTHERN DISTRICT OF ILLINOIS
`EASTERN DIVISION
`
`
`
`LATRINA COTHRON, Individually
`and on behalf of similarly situated
`individuals,
`
`
`
`
`
`)
`)
`)
`)
`)
`)
`)
`)
`)
`)
`)
`
`
`MEMORANDUM OPINION AND ORDER
`
`Plaintiff,
`
`v.
`
`Defendant.
`
`WHITE CASTLE SYSTEM, INC.
`D/B/A WHITE CASTLE,
`
`No. 19 CV 00382
`
`Judge John J. Tharp, Jr.
`
`The present case is one of many recent suits concerning Illinois’ Biometric Information
`
`Privacy Act (BIPA). Plaintiff Latrina Cothron brings suit against her employer, White Castle
`
`System, Inc. (“White Castle”), alleging violations of BIPA Section 15(a), Section 15(b), and
`
`Section 15(d). White Castle has moved to dismiss Ms. Cothron’s claims under Rule 12(b)(6).
`
`Because the Court finds that Ms. Cothron lacks standing to pursue her Section 15(a) claim, that
`
`claim is dismissed without prejudice. Ms. Cothron has, however, adequately alleged violations of
`
`Section 15(b) and Section 15(d) and White Castle’s motion to dismiss those claims is therefore
`
`denied.
`
`
`
`
`
`
`
`
`
`

`

`Case: 1:19-cv-00382 Document #: 117 Filed: 06/16/20 Page 2 of 18 PageID #:695
`
`BACKGROUND1
`
`Latrina Cothron began working for White Castle in 2004 and is still employed by the
`
`restaurant-chain as a manager. Sec. Am. Compl. ¶ 39, ECF No. 44. Roughly three years after Ms.
`
`Cothron was hired, White Castle introduced a fingerprint-based computer system that required
`
`Cothron, as a condition of continued employment, to scan and register her fingerprint in order “to
`
`access the computer as a manager and access her paystubs as an hourly employee.” Id. ¶ 40.
`
`According to Ms. Cothron, White Castle’s system involved transferring the fingerprints to two
`
`third-party vendors—Cross Match and Digital Persona—as well as storing the fingerprints at other
`
`separately owned and operated data-storage facilities. Id. ¶¶ 28-31. Perhaps unsurprisingly—given
`
`that the Illinois Biometric Information Privacy Act (“BIPA”) did not exist yet—White Castle did
`
`not receive a written release from Ms. Cothron to collect her fingerprints or to transfer them to
`
`third parties before implementing the system. Id. ¶ 41. White Castle also did not provide Ms.
`
`Cothron with information regarding the purpose of collection or the length of storage and did not
`
`make its data retention policy publicly available. Id.
`
`When the Illinois legislature passed BIPA in mid-2008, the legal landscape changed but
`
`White Castle’s practices did not—at least not for roughly ten years. Id. ¶¶ 27-28. White Castle
`
`continued to use its fingerprint system in the years following BIPA’s passage and continued to
`
`disseminate that data to the same third parties. Id. ¶¶ 28-31. It was not until October 2018 that
`
`
`
`1 As with all motions to dismiss, the Court must accept all well-pleaded facts in the second
`amended complaint as true and draw all permissible inferences in favor of the plaintiffs. Agnew v.
`NCAA, 683 F.3d 328, 334 (7th Cir. 2012). The Court must also consider “documents attached to
`the complaint, documents that are critical to the complaint and referred to in it, and information
`that is subject to proper judicial notice,” along with facts set forth in Plaintiffs’ briefing insofar as
`those facts “are consistent with the pleadings.” Phillips v. Prudential Ins. Co. of Am., 714 F.3d
`1017, 1020 (7th Cir. 2013) (internal quotation marks omitted).
`2
`
`
`
`

`

`Case: 1:19-cv-00382 Document #: 117 Filed: 06/16/20 Page 3 of 18 PageID #:696
`
`White Castle provided Ms. Cothron with a consent form. Id. ¶ 45. Similarly, White Castle did not
`
`post a publicly available retention schedule and guidelines for destroying fingerprint data until
`
`near the end of 2018. Id. ¶ 48; see also Resp. Mot. Dismiss 7, ECF No. 60.
`
`DISCUSSION
`
`BIPA “imposes numerous restrictions on how private entities collect, retain, disclose and
`
`destroy biometric identifiers”—a category that includes fingerprints. Rosenbach v. Six Flags
`
`Entm’t Corp., 432 Ill. Dec. 654, 656, 129 N.E.3d 1197, 1199 (Ill. 2019); see also 740 ILCS 14/10
`
`(“‘Biometric identifier’ means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face
`
`geometry.”). Ms. Cothron has alleged that White Castle violated the restrictions contained in
`
`Section 15(a), Section 15(b), and Section 15(d) of BIPA. Section 15(a) requires that a private entity
`
`“in possession of” biometric data (1) develop a written, publicly available policy that includes a
`
`retention schedule and destruction guidelines and (2) permanently destroy data upon the
`
`satisfaction of the “initial purpose for collecting or obtaining” it or “within 3 years” of the entity’s
`
`last interaction with the person, whichever comes first. 740 ILCS 14/15(a). Section 15(b) provides
`
`that, prior to collecting biometric data, entities must first (1) inform the person in writing that the
`
`information is being collected or stored; (2) state the “specific purpose and length of term for
`
`which” the data “is being collected, stored, and used”; and (3) receive a written release from the
`
`person. 740 ILCS 14/15(b). Finally, Section 15(d) states that entities in possession of biometric
`
`data may only disclose or “otherwise disseminate” a person’s data upon obtaining the person’s
`
`consent or in limited other circumstances inapplicable here. 740 ILCS 14/15(d). BIPA creates a
`
`private right of action for “[a]ny person aggrieved by a violation.” 740 ILCS 14/20.
`
`
`
`
`
`
`
`3
`
`

`

`Case: 1:19-cv-00382 Document #: 117 Filed: 06/16/20 Page 4 of 18 PageID #:697
`
`I. Standing
`
`Even when the parties do not raise the issue of subject-matter jurisdiction, the Court must
`
`“satisfy [itself] that jurisdiction is secure.” See Carroll v. Stryker Corp., 658 F.3d 675, 680 (7th
`
`Cir. 2011). In light of the Seventh Circuit’s recent holding in Bryant v. Compass Group USA, Inc.,
`
`the jurisdictional prerequisite in question is Article III standing. 958 F.3d 617 (7th Cir. 2020). For
`
`Cothron to have Article III standing to advance each of her BIPA claims, three requirements must
`
`be satisfied as to each: “(1) she must have suffered an actual or imminent, concrete and
`
`particularized injury-in-fact; (2) there must be a causal connection between her injury and the
`
`conduct complained of; and (3) there must be a likelihood that this injury will be redressed by a
`
`favorable decision.” Id. at 620-21 (citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61 (1992)).
`
`“Only the first of those criteria is at issue here: any injury [Cothron] suffered was caused directly
`
`by [White Castle’s] failure to comply with BIPA, and the prospect of statutory damages shows
`
`that such an injury is redressable.” Id. at 621. To be particularized, the injury “must affect the
`
`plaintiff in a personal and individual way.” Lujan, 504 U.S. at 561 n.1. To be concrete, the injury
`
`“must actually exist but need not be tangible.” Bryant, 958 F.3d at 621. A legislature may “elevate
`
`to the status of legally cognizable injuries concrete, de facto injuries that were previously
`
`inadequate in law.” Spokeo, Inc. v. Robins, ––– U.S. ––––, 136 S. Ct. 1540, 1549, 194 L.Ed.2d
`
`635 (2016). But this legislative power is not without limits: even if contrary to statute, “a bare
`
`procedural violation, divorced from any concrete harm” will not “satisfy the injury-in-fact
`
`requirement.” Id. “Instead, the plaintiff must show that the statutory violation presented an
`
`‘appreciable risk of harm’ to the underlying concrete interest that [the legislature] sought to protect
`
`by enacting the statute.” Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 887 (7th Cir. 2017).
`
`
`
`4
`
`

`

`Case: 1:19-cv-00382 Document #: 117 Filed: 06/16/20 Page 5 of 18 PageID #:698
`
`As relevant here, many statutes create a right to receive information and therefore give rise
`
`to “informational injuries” potentially cognizable under Article III. Bryant, 958 F.3d at 624. The
`
`Seventh Circuit has distinguished between concrete informational injuries—where the alleged
`
`violation deprives a person of substantive information that could plausibly alter future decision-
`
`making, see Robertson v. Allied Solutions, LLC, 902 F.3d 690 (7th Cir. 2018)—and bare
`
`procedural ones—where the alleged violation goes only to the form of the information provided,
`
`Groshek 865 F.3d 884, or where the information would not impact future decision-making,
`
`Casillas v. Madison Avenue Associates, 926 F.3d 329 (7th Cir. 2019). See also Bryant, 956 F.3d
`
`at 625-26 (discussing these cases and drawing this distinction).
`
`In Bryant, the Seventh Circuit found that the alleged violations of Section 15(b) satisfied
`
`the injury-in-fact requirement, but the alleged violations of Section 15(a) were insufficiently
`
`particularized. See id. at 626. In that case, the biometric data collector was a workplace cafeteria
`
`vending machine that “did not accept cash; instead, a user had to establish an account using her
`
`fingerprint.” Id. at 619. In assessing the Section 15(b) claim, the court reasoned that “the informed-
`
`consent regime laid out in section 15(b) is the heart of BIPA” and that “its purpose is to ensure
`
`that consumers understand, before providing their biometric data, how that information will be
`
`used, who will have access to it, and for how long it will be retained.” Id. at 626. A failure to
`
`adhere to that regime inflicted a concrete injury because the relevant information was “substantive
`
`and personal” and, “[e]quipped with the missing information,” a person might opt to forgo use of
`
`the relevant information-collecting device. Id. By contrast, the claim under Section 15(a) was “a
`
`separate matter” because Section 15(a) is not part of the informed-consent regime: “the duty to
`
`disclose under section 15(a) is owed to the public generally, not to particular persons whose
`
`biometric information the entity collects.” Id. As a result, even if the missing information were
`5
`
`
`
`

`

`Case: 1:19-cv-00382 Document #: 117 Filed: 06/16/20 Page 6 of 18 PageID #:699
`
`substantive and could have informed future action, Bryant had not alleged a “particularized harm
`
`that resulted from [ ] violation of section 15(a).” Id.2
`
`The facts of the present case differ from those at issue in Bryant, but the bottom-line
`
`standing analysis does not. The assessment of Ms. Cothron’s standing to pursue her Section 15(b)
`
`claim follows most directly from Bryant. Ms. Cothron’s alleged Section 15(b) injury is concrete
`
`and particularized for the reasons summarized above: White Castle failed to provide her with
`
`substantive, personal information about the collection, storage, and use of her fingerprint data and,
`
`armed with this information, Ms. Cothron may well have chosen to forgo the automated system.
`
`The Section 15(a) analysis, on the other hand, requires traversing some new ground. As in Bryant,
`
`the failure to make available a written retention and destruction policy was a harm to the public,
`
`not a harm particular to Ms. Cothron.3 Unlike Bryant, Ms. Cothron also alleges a violation of
`
`Section 15(a)’s second requirement—that an entity in possession of biometric data delete that data
`
`as soon as the purpose of collection is satisfied or within three years after the last interaction with
`
`
`
`2 The Ninth Circuit held that violations of Section 15(a) were sufficiently concrete to satisfy
`the injury-in-fact requirement and found Article III standing on that basis. See Patel v. Facebook,
`Inc., 932 F.3d 1264, 1274 (9th Cir. 2019), cert. denied, 140 S. Ct. 937 (2020) (“Accordingly, we
`conclude that the plaintiffs have alleged a concrete injury-in-fact sufficient to confer Article III
`standing.”) In reaching that conclusion, however, the court explicitly did not consider whether the
`injury was insufficiently particularized. Id. n.5 (“Facebook does not argue that the plaintiffs'
`alleged injury-in-fact is insufficiently particularized.”).
`3 Admittedly, Ms. Cothron was, more than other members of the public, in a position to
`make use of the missing Section 15(a) information. See Figueroa v. Kronos Inc., No. 19 C 1306,
`2020 WL 1848206, at *4 (N.D. Ill. Apr. 13, 2020) (“Had Kronos timely published its retention
`schedule and guidelines, Plaintiffs might have become aware sooner that Kronos was collecting
`their biometric data and sending it to outside data hosts, and thus could have taken quicker action
`to ensure that their data was being properly handled.”). This was the case in Bryant as well,
`however, and any particularized need for the Section 15(a) information is properly traced to the
`concomitant Section 15(b) violation: a Section 15(b) disclosure would have provided Ms. Cothron
`with the information she needed and rendered the Section 15(a) information duplicative.
`6
`
`
`
`

`

`Case: 1:19-cv-00382 Document #: 117 Filed: 06/16/20 Page 7 of 18 PageID #:700
`
`the relevant person. Although the provision of a publicly available retention and destruction policy
`
`is a collective right, the second requirement arguably creates an individual right to have personal
`
`data deleted. Nonetheless, the Court need not address this novel issue because Ms. Cothron has
`
`pleaded facts indicating that no violation occurred. According to Ms. Cothron, she continues to
`
`work as a manager at White Castle and the purpose of the collection—facilitating management
`
`and access to paystubs—remains in effect. See id. ¶¶ 39-40. Neither of Section 15(a)’s conditions
`
`requiring destruction of biometric data is met and therefore Ms. Cothron has not alleged a violation
`
`of, or suffered an injury under, that provision of BIPA.
`
`The last standing question concerns Ms. Cothron’s Section 15(d) claim. Although Bryant
`
`did not address claims under Section 15(d), the analysis provided therein, and summarized above,
`
`suggests that Ms. Cothron’s alleged injuries satisfy Article III’s injury-in-fact requirement. Except
`
`for limited circumstances—such as when disclosure is mandated by state or federal law—Section
`
`15(d) requires entities to obtain a person’s consent when disclosing or disseminating an
`
`individual’s biometric data. Framed this way, Section 15(d) forms a piece of the “informed-consent
`
`regime” at the heart of BIPA. Just as with her Section 15(b) claim, the informational injury suffered
`
`by Ms. Cothron was concrete: the relevant information—that White Castle planned to disseminate
`
`Ms. Cothron’s data to third parties—is personal and substantive and would have provided Ms.
`
`Cothron an opportunity to object to the way her data was being handled or to opt out of the system
`
`entirely. See Crabtree v. Experian Info. Sols., Inc., 948 F.3d 872, 878 (7th Cir. 2020) (A “statutory
`
`violation that le[ads] to the deprivation of an opportunity, even if futile as a practical matter, can
`
`be enough to establish a concrete injury.”); see also Figueroa v. Kronos Inc., No. 19 C 1306, 2020
`
`WL 1848206, at *4 (N.D. Ill. Apr. 13, 2020) (“With both [Section 15(b) and Section 15(d)] claims,
`
`Plaintiffs were denied an opportunity to withhold their consent to the collection or dissemination
`7
`
`
`
`

`

`Case: 1:19-cv-00382 Document #: 117 Filed: 06/16/20 Page 8 of 18 PageID #:701
`
`of their data. . . . Under Crabtree, the denial of that opportunity is sufficiently concrete to confer
`
`standing.”).
`
`In sum, Ms. Cothron has Article III standing to pursue her claims under Section 15(b) and
`
`Section 15(d) but lacks standing to pursue her Section 15(a) claim. The Section 15(a) claim is
`
`dismissed without prejudice—the Court has “no authority and no occasion to address her state-
`
`court standing to bring this claim.” Bryant, 958 F.3d at 626.
`
`II. White Castle’s Motion to Dismiss
`
`To survive a motion to dismiss under Rule 12(b)(6) for failure to state a claim upon which
`
`relief can be granted, a complaint must “contain sufficient factual matter, accepted as true, to ‘state
`
`a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting
`
`Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is facially plausible if the plaintiff
`
`has pled “factual content that allows the court to draw the reasonable inference that the defendant
`
`is liable for the misconduct alleged.” Id. A plaintiff does not need “detailed factual allegations,”
`
`but must plead more than “labels and conclusions” and “a formulaic recitation of the elements of
`
`a cause of action.” Twombly, 550 U.S. at 555. Determining whether a complaint plausibly states a
`
`claim for relief is a “context-specific task that requires the reviewing court to draw on its judicial
`
`experience and common sense.” Iqbal, 556 U.S. at 679. White Castle provides three grounds for
`
`dismissing all of Ms. Cothron’s claims—that she waived her rights, that she failed to plead White
`
`Castle’s mental state, and that the claims are preempted by the Illinois Workers’ Compensation
`
`Act—as well as additional grounds targeting only the Section 15(d) claim.4 The Court first
`
`
`
`4 White Castle’s motion includes a separate header and paragraph dedicated to the Section
`15(b) claim but it essentially re-states the waiver argument.
`8
`
`
`
`

`

`Case: 1:19-cv-00382 Document #: 117 Filed: 06/16/20 Page 9 of 18 PageID #:702
`
`addresses White Castle’s more general arguments before proceeding to the Section 15(d)
`
`argument.
`
`A. Waiver and Equitable Estoppel
`
`First, White Castle argues that Ms. Cothron waived her rights under BIPA and is therefore
`
`equitably estopped from asserting them in this action. As support for this argument, White Castle
`
`provides two “consent forms” that Ms. Cothron purportedly signed—one from 2004 and another
`
`from 2018. As a threshold matter, only one of these documents is admissible on the pleadings—
`
`the 2004 form is not referenced in or central to Ms. Cothron’s complaint and is not subject to
`
`judicial notice. See Phillips v. Prudential Ins. Co. of Am., 714 F.3d 1017, 1020 (7th Cir. 2013).
`
`The question then is whether this second form—which Cothron acknowledges signing in 2018,
`
`Sec. Am. Compl ¶ 45—suffices to establish waiver or equitable estoppel. Both waiver and estoppel
`
`are affirmative defenses, Fed. R. Civ. P. 8(c), and affirmative defenses are generally not proper
`
`grounds for granting a Rule 12(b)(6) motion. See Brownmark Films, LLC v. Comedy Partners, 682
`
`F.3d 687, 690 (7th Cir. 2012) (“[C]ourts should usually refrain from granting Rule 12(b)(6)
`
`motions on affirmative defenses.”). The reason being that “these defenses typically turn on facts
`
`not before the court at [this] stage in the proceedings.” Id. And the general rule holds here for that
`
`reason. A valid waiver of statutory rights must be “knowing, voluntary, and intentional.” See In re
`
`Estate of Ferguson, 313 Ill. App. 3d 931, 937, 730 N.E.2d 1205, 1210 (Ill. App. Ct. 2000). Nothing
`
`in Ms. Cothron’s complaint or in the 2018 form indicates that Ms. Cothron knew she was waiving
`
`her right to bring suit against White Castle for past violations of BIPA. The 2018 form indicates
`
`that Ms. Cothron consented to the use of her fingerprint in conformance with BIPA, but absent
`
`additional evidence of intent, consenting to current or future use does not amount to a waiver of
`
`the right to sue for past violations. Ex. B, ECF No. 48-2. The facts under review cannot support a
`9
`
`
`
`

`

`Case: 1:19-cv-00382 Document #: 117 Filed: 06/16/20 Page 10 of 18 PageID #:703
`
`defense of waiver. Similarly, Ms. Cothron has not pleaded facts capable of supporting equitable
`
`estoppel. Under Illinois law, a party is equitably estopped “from asserting rights that might
`
`otherwise have existed against the other party who, in good faith, relied upon such conduct and
`
`has been thereby led to change his or her position for the worse.” See Geddes v. Mill Creek Country
`
`Club, Inc., 196 Ill. 2d 302, 313, 751 N.E.2d 1150, 1157 (Ill. 2001). White Castle could not have
`
`relied on Ms. Cothron’s 2018 consent form in implementing its 2007 fingerprint-based computer
`
`system or in failing to update its policies after the 2008 passage of BIPA. As a result, these grounds
`
`for dismissing Ms. Cothron’s complaint are unavailing.
`
`B. State of Mind
`
`White Castle’s second argument—that Ms. Cothron failed to plead that White Castle acted
`
`with the mental state required for statutory damages—is a common one in BIPA cases. As relevant
`
`here, Section 20 of BIPA sets out the recovery available to parties aggrieved by a violation of the
`
`statute: “for each violation” a party may receive: (1) “liquidated damages of $1,000 or actual
`
`damages, whichever is greater,” for negligent violations; (2) “liquidated damages of $5,000 or
`
`actual damages, whichever is greater,” for reckless or intentional violations; (3) “reasonable
`
`attorneys’ fees and costs, including expert witness fees and other litigation expenses;” and (4)
`
`“other relief, including an injunction, as the State or federal court may deem appropriate.” 740
`
`ILCS 14/20. Courts assessing arguments like White Castle’s have split into three camps. First,
`
`some courts have held that mental states need not be alleged for the purpose of making out a claim
`
`under BIPA—mental states go only to the damages recoverable for a given claim and may be
`
`proven later. See Woodard v. Dylan’s Candybar LLC, No. 19-CH-05158, slip op. at 7 (Ill. Cir.
`
`Nov. 20, 2019), ECF No. 95 (“The Illinois Supreme Court has made it clear that a plaintiff need
`
`not plead facts or elements showing negligence, or recklessness or intentional acts in violation of
`10
`
`
`
`

`

`Case: 1:19-cv-00382 Document #: 117 Filed: 06/16/20 Page 11 of 18 PageID #:704
`
`BIPA to be entitled to seek . . . liquidated damages.”). Other courts have held that mental states
`
`are required elements of a claim and a failure to plead the mental state required for a given level
`
`of statutory damages requires the dismissal of that portion of the complaint. See Namuwonge v.
`
`Kronos, Inc., 418 F. Supp. 3d 279, 286 (N.D. Ill. 2019) (finding that allegations were sufficient to
`
`plausibly infer negligent conduct but were insufficient to infer reckless or intentional conduct and
`
`holding that the “claim for damages based on intentional and reckless conduct is dismissed”). At
`
`least one court has attempted to strike a compromise position: pleading negligence is sufficient to
`
`forestall dismissal of all requests for liquidated damages because “BIPA provides that recklessness
`
`offers a basis for greater liquidated damages, not for a separate claim.” Figueroa, 2020 WL
`
`1848206, at *8.
`
`In this Court’s view, the reasoning behind the Figueroa court’s compromise position—that
`
`separate remedies under Section 20 can attach to the same claim—leads, in the end, to the position
`
`articulated by the Woodard court. Ms. Cothron has requested various forms of relief for each
`
`alleged violation, not only statutory damages but also declaratory relief and injunctive relief. For
`
`each violation, these requests for relief stem from the same claim. A “claim is the aggregate of
`
`operative facts which give rise to a right enforceable in the courts. One claim supported by multiple
`
`theories does not somehow become multiple claims.” Sojka v. Bovis Lend Lease, Inc., 686 F.3d
`
`394, 399 (7th Cir. 2012) (internal citations omitted). “A motion to dismiss under Rule 12(b)(6)
`
`doesn’t permit piecemeal dismissals of parts of claims; the question at this stage is simply whether
`
`the complaint includes factual allegations that state a plausible claim for relief.” BBL, Inc. v. City
`
`of Angola, 809 F.3d 317, 325 (7th Cir. 2015). Here, if the complaint plausibly pleads violations of
`
`Section 15(b) and Section 15(d)—which the Court finds that it does—then, even absent specific
`
`allegations about White Castle’s mental state with respect to each of those claims, it has stated a
`11
`
`
`
`

`

`Case: 1:19-cv-00382 Document #: 117 Filed: 06/16/20 Page 12 of 18 PageID #:705
`
`claim entitling Ms. Cothron to litigation expenses and injunctive relief under Section 20, whether
`
`or not she proves an entitlement to damages based on negligent, reckless, or intentional conduct.
`
`740 ILCS 14/20(3)-(4). In short, allegations of scienter or no, Ms. Cothron’s complaint states a
`
`plausible claim for relief under sections 15(b) and 15(d); Rule 12(b)(6) does not require her to
`
`plead the facts that will determine the amount of actual damages she may be entitled to recover.5
`
`C. Illinois Workers’ Compensation Act
`
`White Castle also maintains that Ms. Cothron’s BIPA claims are preempted by the Illinois
`
`Workers’ Compensation Act (IWCA).6 Like the above, this is a frequent argument in BIPA cases.
`
`Unlike the above, courts have unanimously rejected it—and for good reason. The IWCA provides
`
`the exclusive remedy for many injuries sustained by employees in the course of their employment.
`
`820 ILCS 305/5(a); Meerbrey v. Marshall Field & Co., 139 Ill. 2d 455, 462, 564 N.E.2d 1222,
`
`1225 (Ill. 1990). IWCA preemption does not apply, however, where the plaintiff establishes that:
`
`“(1) that the injury was not accidental; (2) that the injury did not arise from . . . her employment;
`
`(3) that the injury was not received during the course of employment; or (4) that the injury was not
`
`compensable under the [IWCA].” Id. at 463. Here, Ms. Cothron focuses on the fourth exception,
`
`compensability, and the Court does the same.
`
`
`
`5 “Summary judgment is different. The Federal Rules of Civil Procedure explicitly allow
`for ‘[p]artial [s]ummary [j]udgment’ and require parties to ‘identif[y] each claim or defense—or
`the part of each claim or defense—on which summary judgment is sought.’” BBL, Inc. v. City of
`Angola, 809 F.3d at 325 (quoting Fed. R. Civ. P. 56(a)).
`6 Although preemption is an affirmative defense, Baylay v. Etihad Airways P.J.S.C., 881
`F.3d 1032, 1039 (7th Cir. 2018), Ms. Cothron has pleaded facts sufficient to warrant resolution of
`the issue at this stage.
`
`12
`
`
`
`

`

`Case: 1:19-cv-00382 Document #: 117 Filed: 06/16/20 Page 13 of 18 PageID #:706
`
`White Castle argues that injuries, like Ms. Cothron’s, that are “suffered in the line of duty”
`
`during “the course of employment” are compensable under the IWCA and therefore preempted.
`
`See Reply Br. 16, ECF No. 75 (quoting Folta v. Ferro Eng’g, 43 N.E.3d 108, 114 (Ill. 2015)). But
`
`in Folta the Supreme Court of Illinois noted the incompleteness of the “line of duty” test and
`
`articulated a further constraint pertaining to the character of the injury: “whether an injury is
`
`compensable is related to whether the type of injury categorically fits within the purview of the
`
`Act.” Folta, 43 N.E.3d at 114-15. Although the IWCA can cover psychological injuries, not just
`
`physical ones, courts have generally required that the psychological injury stem from “a sudden,
`
`severe emotional shock traceable to a definite time, place and cause.” Pathfinder Co. v. Indus.
`
`Comm’n, 62 Ill. 2d 556, 563, 343 N.E.2d 913, 917 (Ill. 1976). See also Jones v. UPS Ground
`
`Freight, Inc., No. 15 C 7991, 2016 WL 826403, at *3 (N.D. Ill. Mar. 3, 2016) (finding no IWCA
`
`preemption where plaintiff alleged “emotional distress and humiliation stemming from his
`
`malicious prosecution” but his injuries were not “linked to any physical trauma or traceable to any
`
`sudden, severe emotional shock”). In reaching its decision in Pathfinder, the Supreme Court of
`
`Illinois suggested a more general “test for whether an employee suffered a compensable injury”—
`
`“‘whether there was a harmful change in the human organism—not just its bones and muscles,
`
`but its brain and nerves as well.’” Treadwell v. Power Sols. Int’l, Inc., 2019 WL 6838940 (N.D.
`
`Ill. Dec. 16, 2019) (emphasis in original) (quoting Pathfinder, 343 N.E.2d at 918). Under this test,
`
`multiple courts in this district have found that the IWCA does not preempt BIPA injuries—even if
`
`those injuries happen in the workplace. See id. (“Under this test, Treadwell’s injuries would not
`
`be compensable.”); Peatry v. Bimbo Barkeries USA, Inc., 2020 WL 919202 at *6 (N.D. Ill. Feb.
`
`26, 2020) (adopting the reasoning from Treadwell). See also Mintun v. Kenco Logistics Servs.
`
`LLC, No. 19-2348, 2020 WL 1700328, at *2 (C.D. Ill. Apr. 7, 2020) (adopting Treadwell’s
`13
`
`
`
`

`

`Case: 1:19-cv-00382 Document #: 117 Filed: 06/16/20 Page 14 of 18 PageID #:707
`
`reasoning and declining to stay proceedings because “it is unlikely that a state appellate court
`
`would rule that the IWCA preempts BIPA”). Similarly, numerous trial courts in Illinois have found
`
`that privacy injuries are distinct from those preempted by the IWCA. See, e.g., Woodard, No. 19-
`
`CH-05158, slip op. at 8, ECF No. 95; Mims v. Freedman Seating Co., No. 18-CH-09806, slip op.
`
`at 6-7 (Ill. Cir. Aug. 22, 2019), ECF No. 83 (“[A] violation of privacy is not the type of injury
`
`covered under the IWCA, which only covers physical or psychological injuries. . . . And although
`
`there may be psychological injury as a result of a breach of privacy, that does not mean those
`
`harms are one and the same.”). Consistent with the many courts to previously consider the issue,
`
`this Court concludes that Ms. Cothron’s injuries stemming from alleged BIPA violations are not
`
`preempted by the IWCA.
`
`D. Section 15(d)
`
`White Castle provides three arguments as to why Ms. Cothron has not pleaded a Section
`
`15(d) violation. First, White Castle contends that Section 15(d) requires consent, but that it does
`
`not require “advance consent.” Colloquially, however, consent implies permission given in
`
`advance and that understanding would seem to apply here given the difficulty of “un-disclosing”
`
`biometric information—a dynamic that motivated BIPA’s enactment. See 740 ILCS 14/5(g)
`
`(“Biometrics, however, are biologically unique to the individual; therefore, once compromised,
`
`the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw
`
`from biometric-facilitated transactions.”). Even if consent could be obtained after the fact, there is
`
`no basis to infer, at this juncture, that it ever was—not even the 2018 form sought consent to
`
`transfer biometric information to third parties. See Ex. B, ECF No. 48-2. As a result, no matter the
`
`time at which consent is statutorily required, Ms. Cothron has pleaded a violation.
`
`
`
`14
`
`

`

`Case: 1:19-cv-00382 Document #: 117 Filed: 06/16/20 Page 15 of 18 PageID #:708
`
`Second, White Castle argues that the complaint describes only “actions (transmission for
`
`storage) authorized by BIPA.” Mot. Dismiss 13-14, ECF No. 48. According to White Castle,
`
`certain transmissions—those where data is transferred to another entity using reasonable care
`
`rather than disclosed to the public at large—are permitted by Section 15(e) and therefore do not
`
`violate Section 15(d). As relevant here, Section 15(e) provides that private entities must “store,
`
`transmit, and protect from disclosure all biometric identifiers and biometric information using the
`
`reasonable standard of care.” 740 ILCS 14/15(e). This text must authorize non-disclosing
`
`transmissions, White Castle maintains, if Section 15(e) is to be internally consistent. See Mot.
`
`Dismiss 13-14, ECF No. 48. (“If every transmission were also a disclosure, moreover, entities
`
`could never ‘transmit’ biometric data while also ‘protect[ing it] from disclosure.’”). But this
`
`mistakes the role of Section 15(e) in the statutory scheme. Section 15(e) does not “affirmatively
`
`authorize” any action, rather it sets out the requisite standard of care when taking actions
`
`authorized or required by other sections of BIPA. See Figueroa, 2020 WL 1848206, at *7 (“Section
`
`15(e) does not affirmatively authorize the dissemination of biometric data outside the four
`
`circumstances set forth in subsections (d)(1)-(4); rather, Section 15(e) only sets forth the means by
`
`which an entity must transmit biometric data when such transmission is otherwise allowed.”).
`
`According to Section 15(d), an entity may “disclose” or “otherwise disseminate” biometric
`
`information in limited circumstances—the rest of the time, however, it must protect the
`
`information from disclosure. Section 15(e) simply requires that when an entity in possession of
`
`biometric data takes either of the actions provided for under Section 15(d), it exhibits reasonable
`
`care. As noted above, White Castle did not receive Ms. Cothron’s consent to transmit the data, and
`
`none of the other Section 15(d) exceptions apply; therefore, White Castle’s dissemination of
`