Quarles v. Pret A Manger (USA) Limited

UNITED STATES DISTRICT COURT

FOR THE NORTHERN DISTRICT OF ILLINOIS

EASTERN DIVISION

KAYLA QUARLES,

Plaintiff,

No. 20 CV 7179 v.

Judge Manish S. Shah

PRET A MANGER (USA) LIMITED,

Defendant.

MEMORANDUM OPINION AND ORDER

Pret A Manger required Kayla Quarles to use a fingerprint scanner to clock in and out. Quarles filed this lawsuit, alleging that Pret violated Illinois’ Biometric Information Privacy Act by collecting and storing her biometric information without issuing proper notices, obtaining written consent, or disclosing its retention and destruction policies. Like many other defendants facing BIPA class action lawsuits, Pret moved to stay this case, first because of a pending appeal in the Illinois Appellate Court about the statute of limitations (which I denied) and now because of a pending case before the Illinois Supreme Court about preemption and another pending case before the Seventh Circuit about accrual. Pret also filed a motion to dismiss, arguing that Quarles’s claims are preempted, time-barred, and fail to state a claim. Based on my prediction of how the Illinois Supreme Court would rule on the preemption and statute of limitations issues, and because Quarles plausibly alleges claims under BIPA, Pret’s motions to stay and dismiss are denied.

I. Legal Standard

To survive a motion to dismiss for failure to state a claim, a complaint must contain a short and plain statement that plausibly suggests the violation of a legal right. Fed. R. Civ. P. 8(a)(2), 12(b)(6); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 556– (2007); Ashcroft v. Iqbal, 556 U.S. 662, 677–78 (2009). I accept the plaintiff’s factual allegations as true and draw all reasonable inferences in her favor. Iqbal at 678–79. I do not accept allegations that are unsupported, conclusory, or legal conclusions. Id. At the pleading stage, a claim will not be dismissed based on an affirmative defense unless the plaintiff pleads herself out of court, which means that the allegations in the plaintiff’s complaint affirmatively establish all the elements of the defendant’s affirmative defense. Chicago Bldg. Design, P.C. v. Mongolian House, Inc., 770 F.3d 610, 613–14 (7th Cir. 2014) (“complaints need not anticipate and attempt to plead around defenses”) (citation omitted).

Federal courts have the inherent power to stay proceedings to prevent the court or litigants from wasting time, effort, or resources. Landis v. North American Co., 299 U.S. 248, 254 (1936). When deciding whether to stay a case, “courts consider the merits of the moving party’s case, whether the moving party will suffer irreparable harm without a stay, whether a stay will injure other parties interested in the proceeding, and the public interest.” Venckiene v. United States, 929 F.3d 843, 853 (7th Cir. 2019) (citing Nken v. Holder, 556 U.S. 418, 428 (2009) and Hilton v. Braunskill, 481 U.S. 770, 776 (1987)). “The standard calls for equitable balancing.” Id.

II. Facts

Kayla Quarles worked for Pret A Manger from approximately April 2018 to January 2019. [1-1] ¶¶ 10, 24, 27, 29.1 For timekeeping and security purposes, the company required Quarles to clock in and out using a fingerprint scanner. [1-1] ¶¶ 9– 10, 28–29, 31. The machine compared her fingerprint scans to the ones the company had on file, which Quarles had provided during the onboarding process. [1-1] ¶¶ 24, 30. Pret did not inform Quarles in writing about the company’s biometric collection and storage practices or of their purpose and duration. [1-1] ¶¶ 24–25, 28–29. Quarles never consented to Pret’s use of her fingerprints and never provided the company with a written release to collect, store, or use her unique biometric information. [1-1] ¶¶ 32–33. During and after Quarles’s employment, Pret did not have (or provide) a publicly available retention schedule or destruction policy for biometric identifiers and information and failed to adhere to a retention schedule and delete biometric information. [1-1] ¶¶ 26, 36, 45–46, 50–51. Quarles alleges she “has no reason to believe” that Pret destroyed her biometric information after her employment ended and that there is a significant risk that Pret gave her biometric information to a third- party if Pret used an outside payroll vendor. [1-1] ¶¶ 37–38, 50–51. Quarles filed this lawsuit in Illinois Circuit Court in November 2020, alleging multiple violations of Illinois’ Biometric Information Privacy Act. [1-1].

Pret removed the case to federal court, [1], and filed a motion to dismiss, [12], and a motion to stay proceedings based on a case pending before the Illinois Appellate Court that will address whether a one- or five-year statute of limitations applies to BIPA claims. [9]. I denied the motion to stay. [10]. Pret filed an amended motion to dismiss, [22], along with a second motion to stay, [20], this time based on a case pending before the Illinois Supreme Court that will address whether the exclusive remedy provision of the Illinois Workers Compensation Act bars BIPA claims, and a case pending before the Seventh Circuit that will address whether a BIPA violation accrues when the first violation occurs or each time a violation occurs.

III. Analysis

Biometrics “are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.” 740 ILCS § 14/5(c).2 Due to the growing use of biometrics in business and security, the Illinois legislature enacted BIPA to regulate the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information. 740 ILCS § 14/5(a), (g). Under BIPA, a private entity that obtains a person’s biometric identifier or information has to inform the subject in writing that her biometrics are being collected or stored and disclose the specific purpose and length of term of the collection, storage, and usage; the private entity must also receive a written release

Quarles claims that Pret never informed her about its biometric practices or obtained her written consent in violation of Section 15(b) and unlawfully retained her biometric information in violation of Section 15(a). [1-1] ¶¶ 44–52, 53–62. Pret moves to dismiss based on two affirmative defenses (preemption and the statute of limitations) and Quarles’s failure to state a claim. In the alternative, Pret seeks to stay the case until the Illinois Supreme Court resolves the issue of preemption and the Seventh Circuit rules on the issue of accrual.

A. Preemption

Pret asserts that the Illinois Workers’ Compensation Act preempts BIPA, an argument I rejected in another case. See Wordlaw v. Enterprise Leasing Company of Chicago, LLC, No. 20-CV-03200, 2020 WL 7490414, at *2 (N.D.Ill. 2020). Under the Illinois Supreme Court’s longstanding test, the IWCA is the exclusive remedy for employees to recover against employers for work-related injuries, unless the injury 1) was not accidental; 2) did not arise from her employment; 3) was not received during the course of employment; or 4) was not compensable under the statute.

Collier v. Wagner Castings Co., 81 Ill.2d 229, 237 (1980). Pret’s focus on the IWCA’s exclusivity provisions elides the Illinois Supreme Court’s exceptions, which apply to Quarles. The BIPA violations she alleges were no accident. See Garland v. Morgan Stanley & Co., Inc., 2013 IL App (1st) 112121, ¶ 29 (“to show that an injury is not accidental, the employee must establish that [her employer] acted deliberately and with specific intent to injure the employee”). Pret intentionally collected Quarles’s fingerprints using a biometric timekeeping system, well after the 2008 enactment of BIPA. [1-1] ¶¶ 9–10, 24, 28–31. These allegations are sufficient to establish specific intent. See Wordlaw, 2020 WL 7490414, at *2; Burlinski v. Top Golf USA Inc., No. 19-CV-06700, 2020 WL 5253150, at *5 (N.D.Ill. 2020). Whether an injury is compensable under the IWCA is not solely determined by whether the injury arose out of the plaintiff’s employment, as Pret suggests. Rather, compensability depends on whether the injury is “the type of injury [that] categorically fits within the purview of the [IWCA].” Folta v. Ferro Engineering, 2015 IL 118070, ¶ 23. BIPA injuries are not the kind of intangible injuries compensable under the IWCA. See Wordlaw, 2020 WL 7490414, at *3 (citing McDonald v. Symphony Bronzeville Park LLC, 2020 IL App (1st) 192398, ¶¶ 27–28 and Cothron v. White Castle System, Inc., 467 F.Supp.3d 604, 615–16 (N.D. Ill. 2020)); see also Treadwell v. Power Solutions International, Inc., 427 F.Supp.3d 984, 992–93 (N.D.Ill. 2019). Moreover, “courts have unanimously rejected” the idea that IWCA preempts BIPA claims. See Wordlaw, 2020 WL 7490414, at *3 (quoting Cothron, 467 F.Supp.3d at 615–16 (collecting federal and state cases)). This conclusion allows both statutes to be construed in harmony. Pret’s interpretation (which limits BIPA to a source of injunctive relief for employees suing employers) would render BIPA’s statutory damages inoperative for a subset of plaintiffs (employees suing employers). Quarles has not pled herself out of court on preemption grounds. See Baylay v. Etihad Airways P.J.S.C., 881 F.3d 1032, 1039 (7th Cir. 2018) (preemption under the IWCA is an affirmative defense).3

Alternatively, Pret seeks a stay because the Illinois Supreme Court is set to resolve the question of preemption when it reviews McDonald, the Illinois appellate court decision cited above. See McDonald v. Symphony Bronzeville Park, LLC, No. 126511 (Ill.). The decision will be binding on this court. However, “[w]here the Illinois Supreme Court has not ruled on an issue, decisions of the Illinois Appellate Courts control, unless there are persuasive indications that the Illinois Supreme Court would decide the issue differently.” Nationwide Agribusiness Ins. Co. v. Dugan, 810 F.3d 446, 450 (7th Cir. 2015); see also ADT Security Services, Inc. v. Lisle-Woodridge Fire Protection Dist., 672 F.3d 492, 498 (7th Cir. 2012) (in the absence of guidance from the state’s highest court, a federal court must predict how the Illinois Supreme Court would rule on the issue). Here, one Illinois Appellate Court held that the exclusivity provision of IWCA doesn’t bar a BIPA claim, McDonald, 2020 IL App (1st) 192398, ¶ 27, and the decision to take the case for review is not a compelling sign that it will be reversed. But if the Illinois Supreme Court does overturn the decision, Pret will suffer some harm by being subjected to this litigation. Predictions can be wrong, but I predict that the Illinois Supreme Court will follow its established test for accidental and compensable injuries and not carve up BIPA into a partially

B. Statute of Limitations

BIPA does not contain a limitations period. Like many BIPA defendants, Pret argues that Quarles’s claims are time-barred by a one- or two-year statute of limitations, while Quarles, like many BIPA plaintiffs, argues that the five-year catchall statute of limitations applies.4 Under Illinois law, the applicable statute of limitations depends on the nature of the injury, not the form of the action. Armstrong v. Guigler, 174 Ill.2d 281, 286 (1996). The inquiry examines the legal duty allegedly breached. Id. at 289. Limitations periods must also be construed in accordance with their objectives and purposes. Barragan v. Casco Design Corp., 216 Ill.2d 435, 449 (2005). When two statutes of limitations arguably apply, the one more specifically related to the cause of action takes precedence. Hernon v. E.W. Corrigan Const. Co., 149 Ill.2d 190, 196 (1992). In the absence of binding precedent, I must predict how

A one-year statute of limitations applies to claims based on the “publication of matter violating the right of privacy.” 735 ILCS § 5/13-201. BIPA does concern an individual’s right “to privacy in and control over their biometric identifiers and information.” Rosenbach v. Six Flags Entertainment Corporation, 2019 IL 123186, ¶ 33. Section 15(d) protects individuals from the improper disclosure or dissemination of their biometric information. 740 ILCS § 14/15(d). However, construing the statute as a whole, BIPA protects individuals from a variety of injuries, not just injuries based on the publication of private information. See Rosenbach, 2019 IL 123186, ¶ 33 (BIPA imposes legal duties regarding the collection, retention, disclosure, and destruction of a person’s biometric information).

While the one-year statute of limitations may apply to a subset of BIPA claims—like the ones in Section 15(d)—it does not apply to the ones here. Quarles alleges that Pret collected and stored her biometric information without notifying Quarles about the company’s policies or obtaining her written consent. [1-1] ¶¶ 24– 25, 28–29, 32–33. This amounts to an “informational injury” under Section 15(b). See Bryant v. Compass Group USA, Inc., 958 F.3d 617, 623, 626 (7th Cir. 2020) (“the informed-consent regime laid out in section 15(b) is the heart of BIPA. The text of the statute demonstrates that its purpose is to ensure that consumers understand, before providing their biometric data, how that information will be used, who will have access to it, and for how long it will be retained.”). Thus, the legal duty Quarles alleges Pret breached does not involve the publication of her private information.5 Furthermore, Quarles does not plausibly allege that her biometric information was ever shared, published, or disclosed in any way—she admits that her case does not involve a disclosure claim. [23] at 9. Because the nature of Pret’s liability is a breach of BIPA’s informational requirements, and not the publication of private information, Illinois’s one-year statute of limitations does not apply.6 Next Pret argues that Quarles’s alleged BIPA injuries are analogous to mental anguish injuries and therefore subject to Illinois’s two-year statute of limitations for personal injury actions. 735 ILCS § 5/13-202; see Feltmeier v. Feltmeier, 207 Ill.2d 263, 278 (2003) (personal injuries include emotional distress). But this characterization is too simplistic. While some BIPA claimants may suffer mental harm, the intangible, non-physical injuries under BIPA go beyond emotional distress—they encompass economic harm, privacy harm, and informational harm.

See Bryant, 958 F.3d at 624–26 (describing BIPA injuries as the inability to obtain information or make informed choices, the risk of identity theft, and financial harm); see also Rosenbach, 2019 IL 123186, ¶¶ 33–35. Here, by claiming that Pret violated BIPA’s informed-consent regime, the harm Quarles alleges concerns her inability to Consequently, for purposes of the analysis, it does not matter how broadly or narrowly the word “publication” is interpreted under Illinois law.

Neither the one- nor two-year statute of limitations specifically relate to Quarles’s cause of action. Illinois provides a default limitations period of five years for “all civil actions not otherwise provided for.” 735 ILCS § 5/13-205. This catchall- limitations period applies to causes of action that have “distinctive characteristics”

C. Merits

Quarles states a claim under BIPA. She plausibly alleges the details of an informed-consent violation under Section 15(b): she provided her fingerprints during the onboarding process; she placed her fingers on a scanner, which compared the scan to a stored digital copy of her fingerprints; she never received written information about Pret’s collection, storage, and use practices; and she never executed a written release. [1-1] ¶¶ 27–34. Quarles’s allegation that Pret did not provide her with a retention schedule or destruction guidelines does not allege a violation of Section 15(a), because the statute does not require individual disclosure, but Quarles nevertheless plausibly alleges a violation under that section when she alleges that Pret “did not have written, publicly available policies identifying its retention schedules or guidelines for permanently destroying biometric identifiers and/or biometric information.” [1-1] ¶ 26. She also alleges that Pret “failed to comply with” the retention schedule and destruction guidelines. [1-1] ¶ 46. Consequently, Pret’s motion to dismiss for failure to state a claim under 12(b)(6) fails. I note, however, that Quarles’s allegations of individualized harm are razor thin. Compare Bryant, 958 F.3d at 626 (violation of requirement to have publicly available retention policy is not a particularized injury), with Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146, 1154 (7th Cir. 2020) (failure to comply with data-retention schedule is a concrete and particularized harm). Some of Quarles’s allegations of personal harm amount to an uncertain guess. See [1-1] ¶¶ 37, 51 (“Plaintiff has no reason to believe” her information was destroyed). Similarly, Quarles fails to allege her biometric information was shared. See [1-1] ¶ 38 (“to the extent Defendant uses an outside vendor to process its payroll, there is a significant risk …”). But Quarles squeaks by with her allegation that Pret failed to comply with BIPA-mandated retention schedules and destruction guidelines, along with the reasonable inference that a timekeeping system depends on some retention of biometric information.

IV. Conclusion

Pret’s motion to stay, [20], and motion to dismiss, [22], are denied. Pret’s answer to the complaint is due May 17, 2021. The parties shall file a joint status report with a proposal for a discovery schedule by May 24, 2021.

ENTER:

Manish 8. Shah

United States District Judge Date: April 26, 2021