Duane Morris Privacy Class Action Review – 2024

3. BIPA Privacy Rulings That Favor Plaintiffs In Dzananovic, et al. v. Bumble, Inc., 2023 U.S. Dist. LEXIS 116806 (N.D. Ill. July 7, 2023), the plaintiff filed a class action alleging that the defendants, Bumble, Inc., Buzz Holdings L.P., and Bumble Trading LLC, violated the BIPA. The plaintiff asserted that the defendant used facial recognition technology to collect biometric information while using the photo verification feature on an online dating application without informing users that they were collecting, storing, and retaining their biometric information. The defendants filed a motion to dismiss for lack of personal jurisdiction pursuant to Rule 12(b)(2), and the court denied the motion. The court explained that for it to exercise specific personal jurisdiction: (i) the “defendants must have purposefully directed their activities at the forum state or purposefully availed themselves of the privilege of conducting business in the forum;” (ii) “the alleged injury must arise out of or relate to the defendants’ forum-related activities;” and (iii) “any exercise of personal jurisdiction must comport with traditional notions of fair play and substantial justice.” Id. at *6. The court first found that the defendants purposely directed their activities at Illinois by marketing to users in Illinois and collecting revenue from paying users in Illinois. The court also stated that the plaintiff ’ s claim was related to the defendants’ forum activities, specifically their marketing and promotion of the dating app, including the photo verification feature, which was a marketing feature designed to attract users. The court reasoned that there was substantial connection between the marketing activity and the collection of biometric data such that the plaintiff ’ s BIPA claim related to the defendants’ forum activities. Finally, the court reasoned that exercising jurisdiction over the defendants, as multi-million dollar entities, was not unreasonable or unfair and Illinois had an interest in providing a forum for residents to seek redress for violations of the BIPA. The court thus concluded that exercising personal jurisdiction over the defendants would align with traditional notions of fair play and substantial justice. Accordingly, the court ruled that personal jurisdiction existed due to the defendants’ purposeful direction of activities at Illinois, the relatedness of the claim to forum activities, and fairness in exercising jurisdiction. In Kyles, et al. v. Hoosier Papa LLC, 2023 U.S. Dist. LEXIS 54996 (N.D. Ill. Mar. 30, 2023), the plaintiff filed a class action alleging that the defendants, Hoosier Papa LLC, and its franchisor, Papa John ’ s International, violated the BIPA by improperly collecting and storing employees’ fingerprints using a proprietary point-of-sale system. Papa John ’ s filed a motion to dismiss pursuant to Rule 12(b)(6), and the court denied the motion. The plaintiff alleged that employees had to use the defendants’ fingerprint scanner for various tasks, and the system compared the fingerprint to stored templates. Papa John ’ s had remote access to these systems, allowing data collection and monitoring of fingerprint-scanner usage. The plaintiff contended that the defendants failed to obtain employees’ consent and failed to provide information about data usage or retention policies. Papa John ’ s argued that the plaintiff failed to plausibly allege possession of biometric data under § 15(a) and active collection under § 15(b) of BIPA. The court found the plaintiff adequately alleged that Papa John ’ s had control over the biometric data, and sufficiently alleged active collection, as it claimed Papa John ’ s required the use of the fingerprint scanner and engaged in data collection and reporting. The court rejected Papa John ’ s argument that the plaintiff only alleged access to information, not the specific biometric data. Papa John ’ s also moved to dismiss the plaintiff ’ s request for heightened statutory damages, arguing that the complaint did not plead recklessness or intent. The court rejected the argument. It found that the plaintiff plausibly asserted that Papa John ’ s acted recklessly or intentionally. For these reasons, the court denied Papa John ’ s motion to dismiss. The plaintiff in Tapia-Rendon, et al. v. United Tape & Finishing Co. , 2023 U.S. Dist. LEXIS 142773 (N.D. Ill. Aug. 15, 2023), alleged that defendant EasyWorkforce Solutions, LLC (EWF), a seller of biometric time clocks, collected her fingerprints while she worked for defendant United Tape & Finishing Co., Inc. without informing her of the data collection and without indicating the purpose of the collection or how long her data would be retained, as required under the BIPA. In its decision, the court certified two classes and rejected EWF’s argument that the possibility of very large damages awards available under the BIPA were a barrier to class certification. EWF noted that the BIPA allows for plaintiffs to collect damages of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation and that the plaintiff claimed that class members scanned in and out of work more than 2.4 million times – a situation that could

Made with FlippingBook - professional solution for displaying marketing and sales documents online