A federal judge won’t let Subway seal off a class action alleging employee fingerprint scanning at franchised locations violated an Illinois biometrics privacy law, even though the sandwich shop chain isn’t the workers’ employer.
Mariel Ronquillo sued Doctor’s Associates, the American franchisor for Subway, and HP Inc., which owned the point-of-sale system at the Chicago Subway restaurant where Ronquillo worked. Employees use fingerprint scans to clock in and out and to unlock cash registers. Doctor’s Associates licenses the software on the HP hardware.
Ronquillo alleged the system violated the Illinois Biometric Information Privacy Act because she didn’t provide written consent to have her data scanned, nor did she have access to a notice about data retention and disclosure.
Carl Malmstrom
| Wolf Haldenstein
The companies filed separate motions to dismiss the complaint. U.S. District Judge Sara Ellis denied both motions in an opinion filed April 4.
According to Ellis, Doctor’s requires all Subway franchises to use its system known as Restaurant Technology as a Service. It includes a proprietary point-of-sale system, SubwayPOS. HP integrates the biometric fingerprint scanner into its hardware. Franchisees — which are the direct employer of the workers in the putative class — make monthly lease payments for the equipment from HP.
“Courts have recognized that possession of biometric data alone does not subject an entity” to BIPA’s requirements, Ellis wrote, so plaintiffs can only avoid dismissal by alleging a defendant took “active steps to collect, capture, or otherwise obtain the plaintiff’s biometric information.”
Ronquillo’s complaint meets that requirement, Ellis continued, because it specifically alleges Doctor’s “exclusively controls” the SubwayPOS system and that HP stores fingerprint reference templates on its hardware. Both companies countered by saying the only entity liable for an alleged BIPA violation is the franchise owner of Ronquillo’s store in the 6000 block of North Sheridan Road.
“But in doing so,” Ellis wrote, “they attempt to rewrite the complaint to avoid its actual allegations, which allow for the reasonable inference that (Doctor’s) and HP played more than a passive role in the process.”
The companies offered an alternative defense, that the challenged BIPA section doesn’t apply to third-party technology vendors. However, Ellis said they failed to point to anything in the law that said its provisions can only apply to employers. Although it does have a clause explaining written consent can be provided in “a release executed by an employee as a condition of employment,” that phrase is only an example and doesn’t negate or otherwise limit the broader scope.
Ellis further rejected the companies’ position that imposing the written consent requirement on a vendor would “create absurd results,” suggesting vendors could have complied with BIPA by requiring the franchise operator to obtain written consent from employees as a condition of its terms for leasing the equipment. Even if BIPA’s requirement for written release applied only to an employer, she added, that’s only one part of the law so the employment context wouldn’t excuse Doctor’s or HP from informing a worker “it was collecting her biometrics, explaining why it was using her information and for how long.”
HP argued Ronquillo shouldn’t be able to sue it under an Illinois law. While Ellis acknowledged HP doesn’t have Illinois residence, she said the allegations are that Ronquillo “scanned her fingerprints at a Subway restaurant in Illinois, which leased HP’s hardware, and that this hardware, located on site in Illinois, stored her fingerprints. These allegations suffice to suggest that the alleged BIPA violations took place ‘primarily and substantially in Illinois.’ ”
Finally, Ellis said it was too early to rule on the Doctor’s and HP request to strike Ronquillo’s push for enhanced statutory damages. BIPA allows recovery of $1,000 for each negligent infraction and $5,000 if the violations are intentional or reckless. Ellis said a plaintiff doesn’t need to demonstrate those enhancements until recovery is at issue, at this stage the only concern is allegations of whether the companies violated BIPA at all.
Ronquillo is represented in the action by attorneys Carl V. Malmstrom, of the firm of Wolf Haldenstein Adler Freeman & Herz, of Chicago; and Frank S. Hedin and Arun G. Ravindran, of Hedin Hall, of Miami.
Doctor's Associates is represented by attorneys Raj N. Shah, Amy M. Rubenstein, Eric M. Roberts and Yan Grinblat, of DLA Piper, of Chicago.
HP is represented by attorneys Gregory P. Abrams, Joan A. Akalaonu and Taylor L. Haran, of Faegre Drinker Biddle & Reath, of Chicago.