Duane Morris Privacy Class Action Review – 2024

In Jones, et al. v. Microsoft Corp., 2023 U.S. Dist. LEXIS 3342 (N.D. Ill. Jan. 9, 2023), the plaintiff filed a class action alleging that the defendant ’ s computing and storage platform violated the BIPA. The defendant hosted a cloud computing and storage platform called Azure, which allows users to store and access data over the internet. The plaintiff was employed at a hotel and was required to register and scan her fingerprint for timekeeping purposes by the hotel, which hired Paychex, a biometric timekeeping provider, to collect and store the biometric data on the defendant ’ s Azure platform. The plaintiff asserted that the defendant failed to obtain her consent or provide her with a release to collect, store, use, or disseminate her biometric data and failing to publish any policies regarding data retention or destruction. The defendant filed a motion to dismiss the § 15(b) and § 15(d) claims pursuant to Rule 12(b)(6). The court granted the motion. The court found that the defendant was not directly involved in collecting or obtaining the data and thus the complaint failed to establish a claim pursuant to § 15(b). The court also granted the motion as to the plaintiff ’ s § 15(d) claim, as her allegations only mirrored the BIPA ’ s language and lacked any specific factual support for the claim. For these reasons, the court granted the defendant ’ s motion to dismiss. In White, et al. v. HungerRush, 2023 U.S. Dist. LEXIS 74956 (C.D. Ill. Mar. 28, 2023), the plaintiff, a restaurant employee, filed a class action alleging the use of the restaurant ’ s point-of-sale system which required fingerprint scans violated the BIPA. The plaintiff sued the defendant in connection with its sale of the point-of sale system by: (i) failing to develop a written policy made available to the public establishing a retention policy and guidelines for destroying biometric data; and (ii) collecting her biometric data without providing her with the requisite notice and obtaining her written consent. The defendant moved to dismiss on the basis that the court lacked personal jurisdiction. In support of its jurisdictional argument, the defendant submitted an affidavit signed by its Chief Administrative Officer and General Counsel, which explained that: (i) it is a Texas-based company; (ii) it does not manufacture finger-scan devices or software; (iii) the plaintiff ’ s employer purchased a point-of-sale system from it and separately purchased a finger-scan device from a third-party; (iv) the finger-scan device operates independently from its software; and (v) finger-scan data is not transmitted to its point-of-sale software – instead, the finger-scan device sends only an approval signal to its software. Based on these facts, the defendant argued that its limited contact with Illinois ( i.e. , selling a point-of-sale system to the plaintiff ’ s Illinois-based employer) was insufficient to establish personal jurisdiction. Based on these arguments, the court granted the defendant ’ s motion to dismiss under Rule 12(b)(2). First, the court noted that “[w]here, as here, the defendant submits ‘ evidence opposing the district court ’ s exercise of personal jurisdiction, the plaintiff must similarly submit affirmative evidence supporting the court ’ s exercise of jurisdiction. ’ ” Id. at *7. The court explained that because the plaintiff failed to submit any evidence refuting the company ’ s evidence, i.e. the sworn affidavit, the affidavit was considered “unrebutted.” Id. Second, the court found that the defendant ’ s unrebutted evidence demonstrated that it did not have sufficient minimum contacts with Illinois for this case and it was not reasonably foreseeable that the plaintiff ’ s claims related to the defendant ’ s contacts with Illinois. Significantly, the court determined that the plaintiff failed to submit any evidence refuting the affidavit ’ s sworn statements that the plaintiff ’ s Illinois-based employer initiated the transaction with the defendant, that any contracts the defendant made with Illinois restaurants were made in Texas with Illinois restaurants reaching out to it, that the defendant ’ s system had no cloud functions, or that the defendant does not and has never manufactured a fingerprint scanner. The court held that because plaintiff failed to offer evidence or adequate explanations refuting the defendant ’ s sworn statements, she failed to meet her burden in establishing personal jurisdiction. In Lewis, et al. v. Maverick Transportation LLC , 2023 U.S. Dist. LEXIS 109967 (S.D. Ill. June 26, 2023), the plaintiff was a truck driver whose former employer, Maverick Transportation LLC, had contracted with defendant Lytx, Inc., to have Lytx install its “SF-300 DriveCam” technology into Maverick’s trucks. Id . at *2. The plaintiff claimed that DriveCam records video of the inside of trucks to monitor drivers, and that the technology had been installed and used in the truck he drove. According to the plaintiff, DriveCam collects biometric data by scanning the face geometry of drivers and analyzing the data using algorithms that identify the driver's actions. Lytx moved to dismiss on the basis that the plaintiff failed to plead that its technology collected biometric data subject to regulation under the BIPA because he did not allege that the

Made with FlippingBook - professional solution for displaying marketing and sales documents online