We have consolidated two appeals that pose a common question: whether persons who contend that air carriers have violated state law by using biometric identification in the workplace must present these contentions to an adjustment board under the Railway Labor Act (RLA), 45 U.S.C. §§ 151 - 88, which applies to air carriers as well as railroads. 45 U.S.C. § 181 . The answer is yes if the contentions amount to a "minor dispute"-that is, a dispute about the interpretation or application of a collective bargaining agreement. 45 U.S.C. §§ 151a, 184 ; Hawaiian Airlines, Inc. v. Norris , 512 U.S. 246 , 252-53, 114 S.Ct. 2239 , 129 L.Ed.2d 203 (1994). Plaintiffs insist that a judge should resolve their contentions, while defendants contend that resolution belongs to an adjustment board.

The claims in each suit arise under the Biometric Information Privacy Act (BIPA), 740 ILCS 14/5 to 14/25, which Illinois adopted in 2008. This law applies to all biometric identifiers, which the statute defines to include fingerprints. 740 ILCS 14/10. Before obtaining any fingerprint, a "private entity" must inform the subject or "the subject's legally authorized representative" in writing about several things, such as the purpose of collecting the data and how long they will be kept, and obtain the consent of the subject or authorized representative. 740 ILCS 14/15(b). The private entity also must establish and make available to the public a protocol for retaining and handling biometric data, which must be destroyed "when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's *901 last interaction with the private entity, whichever occurs first." 740 ILCS 14/15(a). Sales of biometric information are forbidden, 740 ILCS 14/15(c), and transfers are limited, 740 ILCS 14/15(d). Private entities must protect biometric information from disclosure. 740 ILCS 14/15(e).

Both Southwest Airlines and United Airlines maintain timekeeping systems that require workers to clock in and out with their fingerprints. Plaintiffs contend that the air carriers implemented these systems without their consent, failed to publish protocols, and use third-party vendors to implement the systems, which plaintiffs call a forbidden disclosure. Southwest and United contend that the plaintiffs' unions have consented-either expressly or through the collective bargaining agreements' management-rights clauses-and that any required notice has been provided to the unions. The air carriers insist that, to the extent these matters are disputed, an adjustment board rather than a judge must resolve the difference-and that if state law gives workers rights beyond those provided by federal law and collective bargaining agreements, it is preempted by the Railway Labor Act.

The suits were assigned to different district judges.

Judge Aspen found that the plaintiffs have standing under Article III but dismissed the suit against Southwest Airlines for improper venue. Fed. R. Civ. P. 12(b)(3). 2018 U.S. Dist. LEXIS 143369 (N.D. Ill. Aug. 23, 2018). He made clear, however, that the suit did not belong in state court or some other federal district court; he held, rather, that it belongs to an adjustment board under the Railway Labor Act and that any attempt by Illinois to give workers rights to bypass their union (Transportation Workers Union Local 555) and deal directly with an air carrier is preempted by federal law. Thus dismissal has nothing to do with venue. See 28 U.S.C. § 1391 .

Dismissal should have been labeled either as a judgment on the pleadings, Fed. R. Civ. P. 12(c), or a dismissal for lack of subject-matter jurisdiction, as this circuit's decisions suggest. See, e.g., Carlson v. CSX Transportation, Inc ., 758 F.3d 819 , 824-25 (7th Cir. 2014) ; Brotherhood of Maintenance of Way Employees v. Norfolk Southern Ry ., 745 F.3d 808 (7th Cir. 2014) ; Brown v. Illinois Central R.R ., 254 F.3d 654 (7th Cir. 2001). But see, e.g., Oakey v. U.S. Airways Pilots Disability Plan , 723 F.3d 227 (D.C. Cir. 2013) (need to resolve a dispute under the Railway Labor Act's procedures does not imply lack of subject-matter jurisdiction); Emswiler v. CSX Transportation, Inc ., 691 F.3d 782 (6th Cir. 2012) (same). None of this circuit's decisions considers the effect of the Supreme Court's modern understanding of the difference between "jurisdiction" and other kinds of rules. See Fort Bend County v. Davis , --- U.S. ----, 139 S.Ct. 1843 , 204 L.Ed.2d 116 (2019) (discussing the difference); Carlson , 758 F.3d at 831 (recognizing that this court has yet to consider how the distinction applies to the Railway Labor Act). It is unnecessary to do so here, for either a substantive or a jurisdictional label ends the litigation between these parties and forecloses its continuation in any other judicial forum.

The suit against United Airlines was filed in state court and removed to federal court on two theories: federal-question jurisdiction under the Railway Labor Act plus removal jurisdiction under 28 U.S.C. § 1453 , part of the Class Action Fairness Act (CAFA). Judge Kendall concluded that the subject is in the bailiwick of plaintiffs' union (International Association of Machinists and Aerospace Workers) and an adjustment board; this aspect of her decision reaches the same conclusion as Judge *902 Aspen. But Judge Kendall added that the complaint did not present a case or controversy, because the class asserted only a bare procedural right. This led her to dismiss for lack of jurisdiction. 2018 U.S. Dist. LEXIS 127959 (N.D. Ill. July 31, 2018).

The class, which wants to litigate in state court, protested, observing that if there is no federal jurisdiction then the suit must be remanded. 28 U.S.C. § 1447 (c). Judge Kendall agreed. United also complained about the initial decision. Observing that the jurisdictional question had not been raised or briefed by the parties, United maintained that plaintiffs have standing because they allege (or at least imply) that biometric data had been transmitted outside United and may have reached inappropriate hands. Judge Kendall refused to revisit that subject, however, and entered an order returning the case to state court. 2019 U.S. Dist. LEXIS 43484 (N.D. Ill. Mar. 18, 2019).

The remand of a suit removed under the Class Action Fairness Act is appealable with judicial permission, 28 U.S.C. § 1453 (c)(1), and United asked us to accept its appeal. The statute makes appellate authority turn on removal under the Class Action Fairness Act, not on whether the appeal presents an issue about the interpretation of that statute. This, plus the disparate outcomes of the two suits, led us to accept the appeal even on the assumption that the only issues concern the interaction between Illinois law and the Railway Labor Act. (That assumption may be incorrect. We'll return to the question how the Class Action Fairness Act applies to the removal of the suit against United.)

Subject-matter jurisdiction is the first issue in any case, and as far as we can see the two suits are identical in this respect. Judge Aspen found that fingerprinted workers have standing, but Judge Kendall thought that a violation of the state statute does not cause concrete injury to anyone, so that the workers lack standing. See, e.g., Spokeo, Inc. v. Robins , --- U.S. ----, 136 S. Ct. 1540 , 194 L.Ed.2d 635 (2016) ; Groshek v. Time Warner Cable, Inc ., 865 F.3d 884 (7th Cir. 2017) ; Casillas v. Madison Avenue Associates, Inc ., No. 17-3162, 926 F.3d 329 , 2019 WL 2353211 (7th Cir. June 4, 2019). We disagree with Judge Kendall's conclusion, for two principal reasons.

First, the stakes in both suits include whether the air carriers can use fingerprint identification. If the unions have not consented, or if the carriers have not provided unions with required information, a court or adjustment board may order a change in how workers clock in and out. The prospect of a material change in workers' terms and conditions of employment gives these suits a concrete dimension that Spokeo , Groshek , and Casillas lacked. Either the discontinuation of the practice, or the need for the air carriers to agree to higher wages to induce unions to consent, presents more than a bare procedural dispute. See Robertson v. Allied Solutions, LLC , 902 F.3d 690 , 697 (7th Cir. 2018) ("Article III's strictures are met not only when a plaintiff complains of being deprived of some benefit, but also when a plaintiff complains that she was deprived of a chance to obtain a benefit.").

Second, plaintiffs assert that the air carriers are not following the statutory data-retention limit and may have used outside parties to administer their timekeeping systems. The longer data are retained, and the more people have access, the greater the risk of disclosure (including by dissatisfied employees who misuse their access or by criminals who hack into a computer system). This was Judge Aspen's rationale for finding standing. 2018 U.S. Dist. LEXIS 143369 at *5-10. Some employees devote time and money to safeguards against *903 identity theft. That's why we held in Remijas v. Neiman Marcus Group, LLC , 794 F.3d 688 (7th Cir. 2015), that a suit contending that hackers obtained personal details presents a case or controversy, even though the plaintiffs did not contend that their credit ratings had suffered. See also, e.g., Lewert v. P.F. Chang's China Bistro, Inc. , 819 F.3d 963 (7th Cir. 2016) ; Dieffenbach v. Barnes & Noble, Inc. , 887 F.3d 826 (7th Cir. 2018). Because these complaints do not allege that biometric data are in the hands of malefactors, their position is weaker than that of the plaintiffs in Remijas and its successors. We need not decide whether the risk of disclosure itself suffices for standing-or whether it would be necessary to take discovery into the question whether biometric data have been released-because the first ground of standing is independently sufficient.

We begin with the suit against Southwest, for in that suit the plaintiffs are content to litigate in federal court. We postpone the question whether the suit against United was properly removed.

A dispute about the interpretation or administration of a collective bargaining agreement must be resolved by an adjustment board under the Railway Labor Act. There is no doubt that Southwest has a collective bargaining agreement with the union that represents the three plaintiffs. Southwest asserts that the union assented to the use of fingerprints, either expressly on being notified before the practice was instituted or through a management-rights clause. And there can be no doubt that how workers clock in and out is a proper subject of negotiation between unions and employers-is, indeed, a mandatory subject of bargaining. 45 U.S.C. § 152 First. (That phrase usually is associated with negotiations under the National Labor Relations Act, but the Supreme Court has held that the principle applies under the Railway Labor Act too, with provisos that do not affect this case. See Pittsburgh & Lake Erie R.R. v. Railway Labor Executives' Association , 491 U.S. 490 , 508 n.17, 109 S.Ct. 2584 , 105 L.Ed.2d 415 (1989) ; Norfolk & Western Ry. v. American Train Dispatchers' Association , 499 U.S. 117 , 122, 111 S.Ct. 1156 , 113 L.Ed.2d 95 (1991). See also Brotherhood of Locomotive Engineers v. Union Pacific R.R. , 879 F.3d 754 , 756 (7th Cir. 2017).)

As a matter of federal law, unions in the air transportation business are the workers' exclusive bargaining agents. 45 U.S.C. § 152 Second; International Association of Machinists v. Street , 367 U.S. 740 , 760, 81 S.Ct. 1784 , 6 L.Ed.2d 1141 (1961). A state cannot remove a topic from the union's purview and require direct bargaining between individual workers and management. And Illinois did not try. Its statute provides that a worker or an authorized agent may receive necessary notices and consent to the collection of biometric information. 740 ILCS 14/15(b). We reject plaintiffs' contention that a union is not a "legally authorized representative" for this purpose. Neither the statutory text nor any decision by a state court suggests that Illinois wants to exclude a collective-bargaining representative from the category of authorized agents.

Whether Southwest's or United's unions did consent to the collection and use of biometric data, or perhaps grant authority through a management-rights clause, is a question for an adjustment board. Similarly, the retention and destruction schedules for biometric data, and whether air carriers may use third parties to implement timekeeping and identification systems, are topics for bargaining between unions and management. States cannot bypass the mechanisms of the Railway Labor Act and authorize direct negotiation or litigation between workers and management. (Whether there would be a role for *904 litigation if a union violated its duty of fair representation is a subject we need not confront; plaintiffs have not named a union as a defendant or contended that a union has violated its duty of fair representation.) That biometric information concerns workers' privacy does not distinguish it from many other subjects, such as drug testing, that are routinely covered by collective bargaining and on which unions give consent on behalf of the whole bargaining unit.

When a subject independent of collective bargaining arises, and concerns different treatment of different workers, litigation may proceed outside the scope of the Railway Labor Act. The Supreme Court held in Lingle v. Norge Division of Magic Chef, Inc ., 486 U.S. 399 , 108 S.Ct. 1877 , 100 L.Ed.2d 410 (1988) (discussing the Labor Management Relations Act), that a retaliatory-discharge claim may be pursued under state law. Such a claim can be resolved without interpreting a collective bargaining agreement; it is person-specific and does not concern the terms and conditions of employment. See also Hughes v. United Air Lines, Inc ., 634 F.3d 391 (7th Cir. 2011) ( Lingle 's approach applies to the Railway Labor Act as well). But our plaintiffs assert a right in common with all other employees, dealing with a mandatory subject of collective bargaining. It is not possible even in principle to litigate a dispute about how an air carrier acquires and uses fingerprint information for its whole workforce without asking whether the union has consented on the employees' collective behalf. That's why this dispute must go to an adjustment board. Lingle , Hawaiian Airlines , and Hughes all recognize that, if a dispute necessarily entails the interpretation or administration of a collective bargaining agreement, there's no room for individual employees to sue under state law-in other words, state law is preempted to the extent that a state has tried to overrule the union's choices on behalf of the workers.

Plaintiffs stress that Southwest began using workers' fingerprints in 2006, two years before Illinois enacted its law. This shows that the union cannot have consented to Southwest's practices, plaintiffs conclude. That's not necessarily so. Southwest and the union may have discussed and resolved this matter in 2005, or 2006, or 2008, or in the decade since. Perhaps in 2006 Southwest supplied all of the information, and the union gave all of the consents, that the state later required. Perhaps the statute led to a new round of bargaining. What Southwest told the union, whether it furnished that information in writing, when these things happened, and what the union said or did in response, are matters not in this record. They are properly not in this record, as they are topics for resolution by an adjustment board rather than a judge. Perhaps a board will conclude that the union did not consent or did not receive essential information before consenting, just as plaintiffs assert. But the board must make that decision and supply any appropriate remedy.

What we have said about the suit against Southwest applies equally to the suit against United-and the conclusion that it is impossible to litigate under the state statute without examining what the union knew and agreed to also means that United was entitled to remove the suit to federal court under the federal-question jurisdiction. 28 U.S.C. §§ 1331 , 1441. Although the class attempted to frame a complaint relying entirely on state law, the complaint concerns collective bargaining regulated by federal law. That brings into play a doctrine misleadingly called "complete preemption," but perhaps better labeled as a rule that when federal law completely occupies a field any claim within that scope rests on federal law, no *905 matter how a plaintiff tries to frame the complaint. See Franchise Tax Board v. Construction Laborers Vacation Trust , 463 U.S. 1 , 23-24, 103 S.Ct. 2841 , 77 L.Ed.2d 420 (1983) ; Lehmann v. Brown , 230 F.3d 916 , 919-20 (7th Cir. 2000) ; Hughes , 634 F.3d at 393 .

If we are wrong about how the Railway Labor Act affects collective bargaining over fingerprinting in the workplace, then the doctrine of complete preemption would not authorize removal of the suit against United. So, just in case, we add that the Class Action Fairness Act probably authorized the removal-probably, but not certainly.

A "class action" as defined in 28 U.S.C. § 1332 (d)(1) may be removed from state to federal court. 28 U.S.C. § 1453 (b). Section 1332(d) creates federal jurisdiction if a class suit has an amount in controversy exceeding $5 million and at least one member of the class has a citizenship different from that of the defendants. Given the size of the class (more than 4,000 workers in Illinois alone use fingerprints to clock in and out) and the penalties provided by state law, the controversy exceeds $5 million. 740 ILCS 14/20. United is a Delaware corporation with its principal place of business in Illinois, so if even one person who works for United in Illinois, uses fingerprints to clock in and out, and is a citizen of any state other than Delaware or Illinois, the requirement of minimal diversity is met. It seems likely to us that at least one person domiciled in southern Wisconsin or northwest Indiana works for United at O'Hare Airport, which is in commuting distance from both states. But, for reasons that United has not explained, its notice of removal does not assert this. Surely United knows where its workers live, and it may even know their domicile (which is not always the state of residence), but it did not put that information in its notice of removal, which is therefore deficient.

The class representative tells us that he wants the class limited to citizens of Illinois. It is far from clear that this is appropriate. The state law applies to private entities that collect biometric data in Illinois; the statute does not purport to exclude people who work in Illinois, provide biometric data in Illinois, but are domiciled in other states. Nor is it clear that the class was so limited on the date of removal-and post-removal amendments to a complaint or other papers do not eliminate jurisdiction proper at the time of removal. See Rockwell International Corp. v. United States , 549 U.S. 457 , 473-74 & n.6, 127 S.Ct. 1397 , 167 L.Ed.2d 190 (2007). Still, the shortcoming in United's allegations of citizenship remains as a potential obstacle.

After these problems were pointed out at oral argument, United filed a jurisdictional supplement, invoking 28 U.S.C. § 1653 . In addition to wrongly supposing that the suit challenges its employment practices nationwide-which is not possible, as the state statute is limited to Illinois-the supplemental filing continues to refer to the "residence" rather than the "citizenship" of United's Illinois workforce.

Given our conclusion that the federal-question jurisdiction supports removal, we need not remand for the district court to explore the question whether, on the date the case was removed, one class member was a citizen of Wisconsin or Indiana, or conceivably some third state other than Illinois or Delaware-say, a citizen of California temporarily detailed to work at O'Hare.

In Miller v. Southwest Airlines , No. 18-3476, the judgment of the district court is affirmed. In Johnson v. United Airlines , No. 19-1785, the judgment is vacated, and the case is remanded with instructions to *906 refer the parties' dispute to an adjustment board.