`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Case: 1:22-cv-02409 Document #: 1-2 Filed: 05/06/22 Page 1 of 26 PageID #:10
`
`Hearina Date: N`Ehj6~Ast(pdaWlarqyed by the Illinois Su reme Court and is re uired to be acce ted in all Illinois Circuit Courts.
`
`For Court Use Gnty
`rBNOIS,
`Locati n: «Cou§%"~
`Judge Calendar, 1
`CIRCUIT COURT
`
`SUMMONS
`
`FILED
`3/25/2022 4:35 PM
`IRIS Y. MARTINEZ
`CIRCUIT CLERK
`COOK COUNTY, IL
`2022CH02683
`Calendar, 1
`17250212
`
`Cook
`
`n COUNTY
`
`MAETEAN JOHNSON
`Plaintiff / Petitioner (First, midd/e, last name)
`
`~
`=
`~
`:V
`:V
`
`g
`n
`;i
`~
`~
`n
`y
`
`"
`?
`~
`w
`J
`LL
`
`Instructions
`Enter above the county
`name where the case
`was filed.
`
`Enter your name as
`Plaintiff/Petitioner.
`Enter the names of all
`people you are suing as
`Defendants/
`Respondents.
`
`Enter the Case Number
`given by the Circuit
`Clerk.
`
`IlVIPORTANT(cid:9)
`INFORMATION:
`
`V.
`RALPHS GROCERY COMPANY .,
`d/b/a FOOD 4 LESS MIDWEST, and THE KROGER CO.
`Defendant / Respondent (First, middle, last name)
`
`2022CH02683
`Case Number
`
`q Alias Summons (Check this box if this is not the 91
`Summons issued for this Defendant.)
`
`There may be court fees to start or respond to a case. If you are unable to pay your court fees, you can apply
`for a fee waiver. You can fmd the fee waiver application at: illinoiscourts.gov/documents-and-
`fonns/approved-fonns .
`
`E-filing is now mandatory with limited exemptions. To e-file, you must first create an account with an e-
`filing service provider. Visit efile.illinoiscourts.gov/service-providers.htm to leam more and to select a
`service provider. If you need additional help or have trouble e-filing, visit illinoiscourts. og v/fa /cfgethelp.ast)
`or talk with your local circuit clerk's office. If you cannot e-file, you may be able to get an exemption that
`allows you to file in-person or by mail. Ask your circuit clerk for more information or visit
`illinoisle alg aid.org.
`
`Call or text Illinois Court Help at 833-411-1121 for information about how to go to court including how to
`fill out and file forms. You can also get free legal information and legal referrals at illinoislesalaid.orQ.
`
`Plaintiff/Petitioner:
`
`Do not use this form in an eviction, small claims, detinue, divorce, or replevin case. Use the Eviction
`Summons, Small Claims Summons, or Summons Petition for Dissolution of Marriage / Civil Union available
`at illinoiscourts.gov/documents-and-forms/approved-forms. If your case is a detinue or replevin, visit
`illinoisle,galaid.org for help.
`
`If you are suing more than 1 Defendant/Respondent, fill out a Summons form for each
`Defendant/Respondent.
`
`In la, enter the name
`and address of a
`Defendant/
`Respondent. If you are
`serving a Registered
`Agent, include the
`Registered Agent's
`name and address here.
`
`In lb, enter a second
`address for Defendant/
`Respondent, if you
`have one.
`
`In lc, check how you
`are sending your
`documents to
`Defendant/
`Respondent.
`
`1. Defendant/Respondent's address and service information:
`a. Defendant/Respondent's prima address/information for a,ervice: Ralphs Grocery Company
`Name (First, Middle, Last): d/b/ FOOD 4 LESS MIDWEST, and THE KROGER CO.,
`Registered Agent's name, if any: ILLINOIS CORPORATI N SERVICE COMPANY
`Street Address, Unit #: 801 ADLAI STEVENSON DRIVE
`City, State, ZIP: SPRINGFIELD , IL 62703
`Email:
`Telephone:
`If you have more than one address where Defendant/Respondent might be found,
`list that here:
`Name (First Midd/e, Last):
`Street Address, Unit #:
`City, State, ZIP:
`Email:
`Telephone:
`c. Method of service on Defendant/Respondent:
`q 3 Sheriff
`q Sheriff outside Illinois:
`
`b.
`
`0 Special process server
`
`County & State
`q Licensed private detective
`
`
`
`In 2, enter the amount
`of money owed to you.
`
`In 3, enter your
`
`—complete address,--
`telephone number, and
`email address, if you
`have one.
`
`Enter the Case Number given by the Cin:uit Clerk: 2022CH02683
`
`2.
`
`Information about the lawsuit:
`Amount claimed: $
`
`— 3.- —Gontact infonnation forthe-Plaintiff/Petitioner:
`— — — --
`Name (First, Middle, Last): Stephan Zouras LLP - Haley R. Jenkins
`Street Address, Unit #: 100 N. Riverside Plaza Suite 2150
`City, State, ZIP: Chicago, IL 60606
`Telephone: (312) 233-1550
`
`Email: hjenkins@stephanzouras.com
`
`—
`
`--
`
`GETTING COURT DOCUMENTS BY EMAIL: You should use an email account that you do not share with anyone else and that you check
`every day. If you do not check your email every day, you may miss important infonnation, notice of court dates, or documents from other parties.
`
`Important
`You have been sued. Read all of the documents attached to this Summons.
`information for the To participate in the case, you must follow the instructions listed below. If you do not, the court may decide
`person getting this {he case without hearing from you and you could lose the case. Appearance and Answer/Response forms can
`form
`be found at: illinoiscourts.gov/documents-and-forms/aMLoved-forms/.
`
`Instructions for person receiving this Summons (Defendant):
`4.
`q 3 a. To respond to this Summons, you must file Appearance and Answer/Response
`forms with the court within 30 days after you have been served (not counting the day
`of service) by e-filing or at:
`Address: 50 W. Washington Street
`City, State, ZIP: Chicago, IL 60602
`
`b. Attend court:
`On:
`
`Date
`In-person at:
`
`at
`
`Time
`
`q a.m. q p.m. in
`
`Courtroom
`
`Check 4a or 4b. If
`Defendant/Respondent
`only needs to file an
`Appearance and
`Answer/Response
`within 30 days, check
`box 4a. Otherwise, if
`the clerk gives you a
`court date, check box
`4b.
`
`In 4a, fill out the
`address of the court
`building where the
`Defendant may file or
`e-file their
`Appearance and
`Answer/Response.
`In 4b, fill out:
`• The court date and
`time the clerk gave
`you.
`• The courtroom and
`address of the court
`building.
`• The call-in or video
`information for
`remote appearances
`(if applicable).
`• The clerk's phone
`number and website.
`AIl of this information
`is available from the
`Circuit Clerk.
`
`STOP!
`The Circuit Clerk will
`fill in this section.
`
`STOP!
`The officer or process
`server will fill in the
`Date of Service.
`
`City
`
`Courfhouse Address
`OR
`Remotely (You may be able to attend this court date by phone or video conference.
`This is called a"Remote Appearance"):
`By telephone:
`
`State
`
`ZIP
`
`Call-in number for telephone remote appearance
`By video conference:
`
`Video conference website
`
`Video conference log-in information (meeting ID, password, etc.)
`
`Call the Circuit Clerk at:
`
`or visit their website
`
`at:
`
`Website
`
`Circuit Clerk's phone number
`to find out more about how to do this.
`
`Witness this ®ate:
`
`Clerk of the Court:
`
`3/25/2022 4:35 PM IRIS Y. MARTINEZ
`
`'
`
`c~`ar
`
`.~
`k rvuKs'~~~
`
`This Summons must be served within 30 days of the witness date.
`
`Date of Service:
`
`(Date to be entered by an offcer or process server on the copy of this Summons left
`with the Defendant or otherperson.)
`
`q
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`This form Is approved by the Illinois Supreme Court and Is required to be accepted In all Illinois Circuit Courts.
`
`STATE OF ILLINOIS,
`CIRCUIT COURT
`
`Cook
`
`_ S_ COUNTY __ _
`
`PROOF OF SERVICE OF
`SUMMONS AND
`COMPLAINT/PET-ITION— -
`
`For Court Use Only
`
`cn
`co
`co N
`_ U
`N
`O N
`~
`a
`u,
`co
`v~
`N
`N
`O N
`~
`N
`CO
`ui
`¢ 0
`0 w
`
`J
`LL
`
`Instructions
`Enter above the
`county name where
`the case was filed.
`Enter your name as
`Plaintiff/Petitioner.
`Enter the names of all
`people you are suing
`as Defendants/
`Respondents.
`
`Enter the Case
`Number given by the
`Circuit Clerk.
`
`MAETEAN JOHNSON
`Plaintiff / Petitioner (First, midd/e, last name)
`
`V.
`
`d/b/a FOOD 4 LESS MIDWEST, and THE KROGER CO.
`Defendant / Respondent (First, middle, last name)
`
`q Alias Summons (Check this box if this is not the 1sr
`Summons issued for this Defendant.)
`
`2022CH02683
`Case Number
`
`**Stop. Do not complete the form. The sheriff or special process server will fill in the form: `*
`
`My name is(cid:9)
`
`and I state
`
`First, Middle, Last
`I served the Summons and Complaint/Petition on the Defendant/Respondent
`as follows:
`
`First, Middle, Last
`
`Personally on the Defendant/Respondent:
`q Female
`q Non-Binary
`q Approx. Age:
`Male
`On this date:
`at this time:
`Address, Unit#:
`City, State, ZIP:
`
`Race:
`q a.m. q p.m.
`
`On someone else at the Defendant/Respondent's home who is at least 13 years old and is a family
`member or lives there:
`On this date:
`Address, Unit#:
`City, State, ZIP:
`And left it with:
`
`q a.m. q p.m.
`
`at this time:
`
`First, Middle, Last
`q Female
`q Non-Binary
`Male
`q
`Race:
`Approx. Age:
`and by sending a copy to this defendant in a postage-paid, sealed envelope to the
`above address on
`, 20
`On the Corporation's agent,
`
`First; Middle, Last
`
`Female
`
`q
`
`Male
`On this date:
`Address:
`City, State, ZIP:
`
`q
`
`Approx. Age:
`Non-Binary
`at this time:
`
`q
`
`Race:
`q a.m. q p.m.
`
`q
`q
`q
`q
`
`
`Enter the Case Number given by the Circuit Clerk:2022CH02683
`I was not able to serve the Summons and Complaint/Petition on Defendant/Respondent:
`
`First, Middle, Last
`
`—-—
`
`I -made -the-following attempts to- serve the Summons and Complaint/Petition on the Defendant/Respondent:
`
`On this date:
`Address:
`City, State, ZIP:
`Other information about service attempt:
`
`at this time:
`
`q a.m. q p.m.
`
`2.
`
`On this date:
`Address:
`City, State, ZIP:
`Other information about service attempt:
`
`at this time:
`
`q a.m. q p.m.
`
`3. On this date:
`Address:
`City, State, ZIP:
`Other information about service attempt:
`
`at this time:
`
`q a.m. q p.m.
`
`DO NOT complete
`this section. The
`sheriff or private
`process server will
`complete it
`
`If you are a special process server, sheriff outside Illinois, or licensed private detective,
`your signature certifies that everything on the Proof of Service of Summons is true and
`correct to the best of your knowledge. You understand that making a false statement on
`this fonn could be perjury.
`
`Under the Code of
`Civil Procedure, 735
`ILCS 5/1-109,
`making a statement
`on this form that you
`lmow to be false is
`perjury, a Class 3
`Felony.
`
`By:
`
`Signature by:
`
`q Sheriff
`Sheriff outside Illinois:
`
`FEES
`Service and Return:
`Miles
`Total
`
`$
`$
`$ 0.00
`
`County and State
`Special process server
`Licensed private
`detective
`
`Print Name
`
`If Summons is served by licensed private detective or private detective agency:
`License Number:
`
`q
`q
`q
`q
`
`
`Hearing Date: 7/25/2022 10:00 AM
`Location: Richard J Daley Center
`Judge: Wilson, Thaddeus L
`
`---
`
`---IN THE CIRCIJIT COURT OF COOK COiJNTY, ILLINOIS
`COUNTY DEPARTMENT, CHANCERY DIYISION
`
`FILED
`3/25/2022 2:22 PM
`IRIS Y. MARTINEZ
`CIRCUIT CLERK
`COOK COUNTY, IL
`2022CH02683
`Calendar, 1
`17245929
`
`MAETEAN JOHNSON, individually, and
`on behalf of all others similarly situated,
`
`Plaintiff,
`
`V.
`
`RALPHS GROCERY COMPANY d/b/a
`FOOD 4 LESS MIDWEST, and THE
`KROGER CO.,
`
`Defendants.
`
`)
`)
`)
`)
`)
`)
`)
`)
`)
`)
`)
`)
`
`2022CH02683
`Case No.
`
`CLASS ACTION COMPLAINT
`
`Plaintiff Maetean Johnson ("Plaintiff'), individually and on behalf of all others similarly
`
`situated (the "Class"), by and through her attorneys, brings the following Class Action Complaint
`
`("Complaint") pursuant to the Illinois Code of Civil Procedure, 735 ILCS §§ 5/2-801 and 2-802,
`
`against Defendants Ralphs Grocery Company d/b/a Food 4 Less Midwest ("Food 4 Less") and
`
`The Kroger Co. ("Kroger") (collectively, "Defendants"), their subsidiaries and affiliates, to redress
`
`and curtail each Defendants' unlawful collection, use, storage, and disclosure of Plaintiffls
`
`sensitive and proprietary biometric data. Plaintiff alleges as follows upon personal laiowledge as
`
`to herself, her own acts and experiences and, as to all other matters, upon information and belief,
`
`including investigation conducted by her attorneys.
`
`NATURE OF THE ACTION
`
`1.
`
`Defendant Food 4 Less is a grocery store chain in the "Kroger Family of
`
`Companies" and is a subsidiary of Kroger.l
`
`1 See https://www.food4less.com/i/luoger-famity-of-companies.
`
`
`
`r
`
`I
`
`2.
`
`Defendant Kroger operates supermarkets, grocery retail stores, and multi-
`
`department stores throughout the United States.
`
`3.
`
`When Food 4 Less brings on a new worker, including Plaintiff, they are enrolled in
`
`a biometric timeclock and timekeeping database(s) ("timekeeping system") using a scan of their
`
`fmgerprint. Food 4 Less uses the timekeeping system to monitor the hours worked by workers at
`
`its facilities.
`
`4.
`
`Upon information and belief, data collected in the timekeeping system by Food 4
`
`Less are disclosed to at least one third-party for payroll purposes.
`
`5.
`
`Upon information and belief, data collected in the timekeeping system by Food 4
`
`Less are disclosed to Kroger.
`
`6.
`
`While many employers use conventional methods for tracking time worked (such
`
`as ID badges or punch clocks), Defendants require workers to have their fingerprints scanned by
`
`a biometric timekeeping device.
`
`7.
`
`Biometrics are not relegated to esoteric corners of commerce. Many businesses —
`
`such as Defendants'— and financial institutions have incorporated biometric applications into their
`
`workplace in the form of biometric timeclocks or authenticators, and into consumer products,
`
`including such ubiquitous consumer products as checking accounts and cell phones.
`
`8.
`
`Unlike ID badges or time cards — which can be changed or replaced if stolen or
`
`compromised — a fingerprint is a unique, permanent biometric identifier associated with each
`
`worker. This exposes Defendants' workers to serious and irreversible privacy risks. For example,
`
`if a database containing fingerprints or other sensitive, proprietary biometric data is hacked,
`
`breached, or otherwise exposed — like in the Equifax, Facebook/Cambridge Analytica, and
`
`Suprema data breaches — employees have no means by which to prevent identity the$,
`
`~
`
`
`
`unauthorized tracking, or other unlawful or improper use of this highly personal and private
`
`information.
`
`9.
`
`In 2015, a data breach at the United States Office of Personnel Management
`
`exposed the personal identification information, including biometric data, of over 21.5 million
`
`federal employees, contractors, and job applicants.Z
`
`10.
`
`An illegal market already exists for biometric data. Hackers and identity thieves
`
`have targeted Aadhaar, the largest biometric database in the world, which contains the personal
`
`and biometric data — including fingerprints, iris scans, and facial geometries — of over a billion
`
`Indian citizens.3
`
`11.
`
`In January 2018, an Indian newspaper reported that the information housed in
`
`Aadhaar was available for purchase for less than $8 and in as little as 10 minutes.4
`
`12.
`
`In August 2019 it was widely reported that Suprema, a security company
`
`responsible for a web-based biometrics lock system that uses fmgerprints and facial geometry
`
`scans in 1.5 million locations around the world, maintained biometric data and other personal
`
`information on a publicly accessible, unencrypted database.5
`
` See U.S. Off. of Personnel Mgmt., Cybersecurity
`Z
`www.opm.gov/cybersecurity/cybersecurity-incidents.
`
`Incidents
`
`(2018), available at
`
`3 See Vidhi Doshi, A Security Breach in India Has Left a Billion People at Risk of Identity Theft, The
`Washington Post (Jan. 4, 2018), available at https://www.washingtonpost.com/news/worldviews/wp/
`2018/O 1 /04/a-security-breach-in-india-has-left-a-billion-people-at-risk-of-identity-
`theft/?utm term=.b3c70259fl38.
`
`4 Rachna Khaira, Rs 500, 10 Minutes, and You Have Access to Billion Aadhaar Details, The Tribune (Jan.
`4, 2018), available at http://www.tribuneindia.com/news/nation/rs-500-10-minutes-and-you-have-access-
`to-billion-aadhaar-details/523361.htm1.
`
`5 Major Breach Found in Biometrics System Used by Banks, UK police and Defence Firms, The Guardian
`(Aug. 14, 2019), available at https://www.theguardian.com/technology/2019/aug/14/major-breach-found-
`in-biometrics-system-used-by-banks-uk-police-and-defence-firms.
`
`I
`
`
`
`13.
`
`In the United States, law enforcement, including the Federal Bureau of
`
`Investigation and Immigration and Customs Enforcement, have attempted to turn states'
`
`Deparhnent of Motor Vehicles databases into biometric data goldmines, using facial recognition
`
`technology to scan the faces of thousands of citizens, all without their notice or consent.6
`
`14.
`
`This practice has been criticized by lawmakers. Some states, including Illinois,
`
`have refused to comply with law enforcement's invasive requests.'
`
`15.
`
`Recognizing the need to protect its citizens from situations like these, Illinois
`
`enacted the Biometric Information Privacy Act ("BIPA"), 740 ILCS § 14/1, et seq., specifically to
`
`regulate companies that collect, store and use Illinois citizens' biometrics, such as fingerprints.
`
`16.
`
`Notwithstanding the clear and unequivocal requirements of the law, each
`
`Defendant disregards Plaintiff's and other similarly-situated workers' statutorily protected privacy
`
`rights and unlawfully collects, stores, otherwise obtains, disseminates, and uses Plaintiff s and
`
`other similarly-situated individuals' biometric identifiers and biometric information (collectively
`
`referred to herein as "biometric data") in violation of BIPA. Specifically, each Defendant violated
`
`and continues to violate BIPA because it did not and continues not to:
`
`a.
`
`b.
`
`Properly inform Plaintiff and others similarly situated in writing of the
`specific purpose and length of time for which their fmgerprints were being
`collected, stored, and used, as required by BIPA;
`
`Develop and adhere to a publicly-available retention schedule and
`guidelines for permanently destroying Plaintiff s and other similarly-
`situated individuals' fingerprints, as required by BIPA;
`
`6 Drew Harwell, FBI, ICE Find State Driver's License Photos Are a Gold Mine for Facial-Recognition
`Searches, The Washington Post (July 7, 2019), available at https://www.washingtonpost.com/
`technology/2019/07/07/fbi-ice-find-state-drivers-license-photos-are-gold-mine-facial-recognition-
`searches/?noredirect=on&utm term=.da9atb2472a9.
`
`' State Denying Facfal Recognition Requests, Jacksonville Joumal-Courier (July 9, 2019), available at
`https://www.myj oumalcourier.com/news/article/State-denying-facial-recognition-requests-14081967.php.
`
`d
`
`
`
`C.
`
`d.
`
`Obtain a written release from Plaintiff and others similarly situated to
`collect, store, or otherwise use their fingerprints, as required by BIPA; and
`
`Obtain consent from Plaintiff and others similarly situated to disclose,
`redisclose, or otherwise disseminate their fingerprints to a third party, as
`required by BIPA.
`
`17.
`
`Accordingly, Plaintiff, on behalf of herself as well as the putative Class, seeks an
`
`Order: (1) declaring that each Defendant's conduct violates BIPA; (2) requiring each Defendant
`
`to cease the unlawful activities discussed herein; and (3) awarding statutory damages to Plaintiff
`
`and the proposed Class.
`
`PARTIES
`
`18.
`
`Plaintiff Maetean Johnson is a natural person and a resident of the State of Illinois.
`
`19.
`
`Defendant Ralphs Grocery Company d/b/a Food 4 Less is an Ohio corporation that
`
`is registered with the Illinois Secretary of State and conducts business in the State of Illinois.
`
`20.
`
`Defendant The Kroger Company is an Ohio corporation that is registered with the
`
`Illinois Secretary of State and conducts business in the State of Illinois.
`
`JURISDICTION AND VENUE
`
`21.
`
`This Court has jurisdiction over Defendants pursuant to 735 ILCS § 5/2-209
`
`because Defendants conduct business in this State, conducts business transactions in Cook County,
`
`and committed the statutory violations alleged herein in the state of Illinois.
`
`22.
`
`Venue is proper in Cook County because Defendants committed the statutory
`
`violations alleged herein in Cook County, Illinois.
`
`FACTUAL BACKGROUND
`
`I.
`
`The Biometric Information Privacy Act.
`
`23.
`
`In the early 2000s, major national corporations started using Chicago and other
`
`locations in Illinois to test "new applications of biometric-facilitated fmancial transactions,
`
`5
`
`
`
`including fmger-scan technologies at grocery stores, gas stations, and school cafeterias." 740 ILCS
`
`§ 14/5(c). Given its relative infancy, an overwhelming portion of the public became weary of this
`
`then-growing yet unregulated technology. See 740 ILCS § 14/5.
`
`24.
`
`In late 2007, a biometrics company called Pay by Touch, which provided major
`
`retailers throughout the State of Illinois with fingerprint scanners to facilitate consumer
`
`transactions, filed for bankruptcy. That bankruptcy was alarming to the Illinois Legislature because
`
`suddenly there was a serious risk that millions of fingerprint records — which, like other unique
`
`biometric identifiers, can be linked to people's sensitive fmancial and personal data — could now
`
`be sold, distributed, or otherwise shared through the bankruptcy proceedings without adequate
`
`protections for Illinois citizens. The bankruptcy also highlighted the fact that most consumers who
`
`used the company's fingerprint scanners were completely unaware that the scanners were not
`
`actually transmitting fmgerprint data to the retailer who deployed the scanner, but rather to the
`
`now-banlffupt company, and that their unique biometric identifiers could now be sold to unknown
`
`third parties.
`
`25.
`
`Recognizing the "very serious need [for] protections for the citizens of Illinois
`
`when it [came to their] biometric information," Illinois enacted BIPA in 2008. See Illinois House
`
`Transcript, 2008 Reg. Sess. No. 276; 740 ILCS § 14/5.
`
`26.
`
`Additionally, to ensure compliance, BIPA provides that, for each violation, the
`
`prevailing party may recover $1,000 or actual damages, whichever is greater, for negligent
`
`violations and $5,000, or actual damages, whichever is greater, for intentional or reckless
`
`violations. 740 ILCS § 14/20.
`
`27.
`
`BIPA is an informed consent statute that achieves its goal by making it unlawful
`
`for a company to, among other things, collect, capture, purchase, receive through trade, or
`
`r-A
`
`
`
`otherwise obtain a person's or a customer's biometric identifiers or biometric information, unless
`
`it first:
`
`a.
`
`b.
`
`C.
`
`Informs the subject in writing that a biometric identifier or biometric
`information is being collected, stored and used;
`
`Informs the subject in writing of the specific purpose and length of term for
`which a biometric identifier or biometric information is being collected,
`stored, and used; and
`
`Receives a written release executed by the subj ect of the biometric identifier
`or biometric information.
`
`See 740 ILCS § 14/15(b).
`
`28.
`
`BIPA specifically applies to individuals who work in the State of Illinois. BIPA
`
`defines a"written release" specifically "in the context of employment [as] a release executed by
`
`an employee as a condition of employment." 740 ILCS § 14/10.
`
`29.
`
`Biometric identifiers include retina and iris scans, voiceprints, scans of hand and
`
`face geometry, and — most importantly here — fmgerprints. See 740 ILCS § 14/10. Biometric
`
`information is separately defined to include any information based on an individual's biometric
`
`identifier that is used to identify an individual. Id.
`
`30.
`
`BIPA establishes standards for how companies must handle Illinois citizens'
`
`biometric identifiers and biometric information. See, e.g., 740 ILCS § 14/15(c)-(d). For example,
`
`BIPA prohibits private entities from disclosing a person's or customer's biometric identifier or
`
`biometric information without first obtaining consent for such disclosure. See 740 ILCS §
`
`14/15(d)(1).
`
`31.
`
`BIPA also prohibits selling, leasing, trading, or otherwise profiting from a person's
`
`biometric identifiers or biometric information (740 ILCS § 14/15(c)) and requires companies to
`
`develop and comply with a written policy — made available to the public — establishing a retention
`
`7
`
`
`
`schedule and guidelines for permanently destroying biometric identifiers and biometric
`
`information when the initial purpose for collecting such identifiers or information has been
`
`satisfied or within three years of the individual's last interaction with the company, whichever
`
`occurs first. 740 ILCS § 14/15(a).
`
`32.
`
`The Illinois legislature enacted BIPA due to the increasing use of biometric data in
`
`financial and security settings, the general public's hesitation to use biometric information, and —
`
`most significantly — the unknown ramifications of biometric technology. Biometrics are
`
`biologically unique to the individual and, once compromised, an individual is at a heightened risk
`
`for identity theft and left without any recourse.
`
`33.
`
`BIPA provides individuals with a private right of action, protecting their right to
`
`privacy regarding their biometrics as well as protecting their rights to know the precise nature for
`
`which their biometrics are used and how they are being stored and ultimately destroyed. Unlike
`
`other statutes that only create a right of action if there is a qualifying data breach, BIPA strictly
`
`regulates the manner in which entities may collect, store, use, and disseminate biometrics and
`
`creates a private right of action for lack of statutory compliance.
`
`34.
`
`Plaintiff, like the Illinois legislature, recognizes how imperative it is to keep
`
`biometric identifiers and information secure. Biometric data, unlike other personal identifiers such
`
`as a social security number, cannot be changed or replaced if hacked or stolen.
`
`U.
`
`Defendants Violate the Biometric Information Privacy Act.
`
`35.
`
`By the time BIPA passed through the Illinois legislature in mid-2008, most
`
`companies who had experimented with using individuals' biometric data stopped doing so.
`
`36.
`
`However, each Defendant failed to take note of the shift in Illinois law governing
`
`the collection, use, storage, and dissemination of biometric data. As a result, each Defendant
`
`R
`
`
`
`continued to collect, otherwise obtain, store, use, and disseminate individuals' biometric data in
`
`violation of BIPA.
`
`37.
`
`Specifically, when individuals work at Food 4 Less facilities, they are required to
`
`have their fmgerprints scanned to enroll them in their employee database(s).
`
`38.
`
`Kroger family stores, including Food 4 Less, use and have used software that
`
`requires workers to use fmgerprints as a means of authentication. Per Defendants' policies,
`
`workers, including Plaintiff, are required to use their fingerprints to clock-in and clock-out at the
`
`beginning and end of each shift and for meal breaks.
`
`39.
`
`Each Defendant failed and continues to fail (1) to inform Food 4 Less workers that
`
`it discloses or disclosed their fingerprint data to at least one third-party payroll vendor and/or
`
`biometric timekeeping vendor, and likely others; (2) to inform Food 4 Less workers that it discloses
`
`their fmgerprint data to other, currently unknown, third parties, which host the biometric data in
`
`their data centers; (3) to inform Food 4 Less workers of the purposes and duration for which it
`
`collects their sensitive biometric data; and (4) to obtain written releases from workers before
`
`collecting their fingerprints.
`
`40.
`
`Each Defendant failed to develop or adhere to a written, publicly-available policy
`
`identifying their respective retention schedules and guidelines for permanently destroying
`
`workers' biometric data when the initial purpose for collecting or obtaining workers' biometrics
`
`is no longer relevant, as required by BIPA.
`
`41.
`
`The Pay by Touch bankruptcy that catalyzed the passage of BIPA, as well as the
`
`recent data breaches, highlights why such conduct — where individuals are aware that they are
`
`providing a fingerprint, but not aware of to whom or for what purposes they are doing so — is
`
`dangerous. That bankruptcy spurred Illinois citizens and legislators into realizing that it is crucial
`
`9
`
`
`
`for individuals to understand when providing biometric identifiers, such as a fingerprint, who
`
`exactly is collecting their biometric data, where it will be transmitted, for what purposes, and for
`
`how long. Defendants disregard these obligations and their workers' statutory rights and instead
`
`unlawfully collect, store, use and disseminate their workers' biometric identifiers and information,
`
`without first receiving the individual's informed written consent required by BIPA.
`
`42.
`
`Each Defendant lacks retention schedules and guidelines for permanently
`
`destroying Plaintiff's and other similarly-situated individuals' biometric data and have not and will
`
`not destroy Plaintiff's and other similarly-situated individuals' biometric data when the initial
`
`purpose for collecting or obtaining such data has been satisfied or within three years of the
`
`individual's last interaction with the companies.
`
`43.
`
`Neither Defendant told Plaintiff and others similarly situated workers what might
`
`happen to their biometric data if and when Defendants merge with another company, or worse, if
`
`and when Defendants' businesses fold, or when the other third parties that have received workers'
`
`biometric data businesses fold.
`
`44.
`
`Since Defendants neither publish a BIPA-mandated data retention policy nor
`
`disclose the purposes for their collection and use of biometric data, Food 4 Less workers have no
`
`idea at the time of collection whether Defendants sell, disclose, redisclose, or otherwise
`
`disseminate their biometric data. Moreover, Plaintiff and others similarly situated are not told at
`
`the time of collection to whom Defendants disclose their biometric data, or what might happen to
`
`their biometric data in the event of a merger or a bankruptcy.
`
`45.
`
`These violations raise a material risk that Plaintiff s and other similarly-situated
`
`individuals' biometric data will be unlawfully accessed by third parties.
`
`
`
`~ N
`O
`_ U
`N N
`O N
`g
`n.
`N
`N
`N
`N
`N
`O
`N ~
`N
`~
`W
`H
`0
`q
`W
`J
`lL
`
`46.
`
`By and through the actions detailed above, each Defendant disregarded Plaintiffls
`
`and other similarly-situated individuals' legal rights in violation of BIPA.
`
`III.
`
`Plaintiff Maetean Johnson's Experience
`
`47.
`
`Plaintiff Maetean Johnson worked as a cashier from June 5, 2016, to August 9,
`
`2020, at Food 4 Less located at 1000 E. Sibley Blvd, Dolton, Illinois.
`
`48.
`
`Plaintiff was required to scan her fingerprint so Defendants could use it as an
`
`authentication method to track her time worked, including breaks.
`
`49.
`
`50.
`
`Defendants stored Plaintiff's fingerprint data in their timekeeping system.
`
`Plaintiff was required to scan her fmgerprint each time she began and ended her
`
`workday, as well as each time she clocked in and out for breaks.
`
`51.
`
`Neither Defendant informed Plaintiff in writing or otherwise of the purpose(s) and
`
`length of time for which her fingerprint data was being collected; obtained a written release from
`
`Plaintiff to collect, store, or use her fingerprint data; developed and adhered to a publicly available
`
`retention schedule and guidelines for permanently destroying Plaintiff's fingerprint data; or
`
`obtained Plaintiff s consent before disclosing or disseminating her biometric data to third parties.
`
`52.
`
`Plaintiff has never been informed of the specific limited purposes or length of time
`
`for which each Defendant collects, otherwise obtains, stores, uses, and/or disseminates her
`
`biometric data.
`
`53.
`
`Plaintiff has never seen, been able to access, or been informed of any biometric data
`
`retention policy developed by either Defendant, nor has she ever seen, been able to access, or been
`
`informed of whether either Defendant would ever permanently delete her biometric data.
`
`54.
`
`Plaintiff has never been provided with nor ever signed a written release allowing
`
`any Defendant to collect, otherwise obtain, store, use, or disseminate her biometric data.
`
`[a
`
`
`
`55.
`
`Plaintiff has continuously and repeatedly been exposed to the risks and harmful
`
`conditions created by Defendants' multiple violations of BIPA alleged herein.
`
`56.
`
`No amount of time or money can compensate Plaintiff if her biometric data has
`
`been compromised by the lax procedures through which each Defendant captured, otherwise
`
`obtained, stored, used, and disseminated her and other similarly-situated individuals' biometrics.
`
`Moreover, Plaintiff would not have provided her biometric data to Defendants if she had known
`
`that Defendants would retain such information for an indefinite period of time without her consent.
`
`57.
`
`A showing of actual damages is not necessary in order to