A federal judge said federal court isn't the place for the bulk of a class action lawsuit against CVS claiming the pharmacy chain violated Illinois' biometrics privacy law by scanning the faces of people who were seeking passport photos, even though the scans were necessary to ensure their photos met federal passport rules.
The judge said the plaintiffs don't allege they were actually harmed by the scans, only that CVS allegedly violated the language of the state law. And that, he said, means most of the class action's claims belong in Cook County's more permissive courtrooms, and not in federal court.
U.S. District Judge Robert Gettleman issued an opinion Dec. 2 dismissing certain claims against CVSand remanding the remainder to Cook County Circuit Court, setting the next stage for the class action complaint from named plaintiffs Denise Daichendt and Ada “June” Odell, each identified as residents of Cook County. Attorney Gary Klinger, of the firm of Milberg Coleman Byrson Phillips Grossman, of Chicago, filed the complaint May 20.
According to the complaint, Daichendt and Odell went to CVS pharmacies in Chicago and Niles, respectively, for special passport photos to be taken with the Kodak Biometric ID Photo System. The Kodak systems purportedly are designed to make sure people's photos satisfy federal passport requirements.
But the women assert CVS failed to provide the correct form of notice as required under the Illinois Biometric Information Privacy Act before allowing them to use the Kodak system. The plaintiffs further assert CVS failed to obtain written consent from customers before scanning their faces during passport photo sessions.
In arguing for dismissal, CVS said the complaint doesn’t adequately allege the pharmacy chain gained any “control” over biometric data and made only conclusory allegations regarding the verification certificate printed with customers’ photos. Before addressing those positions, Gettleman said he was remanding to state court two other contentions: whether the complaint sufficiently alleged possession of biometric data and failure to comply with certain BIPA regulations and if CVS profited from such information.
Although the parties didn’t raise standing as an issue, Gettleman said he was obligated to evaluate if he had jurisdiction over those claims and decided that was not the case because the plaintiffs’ didn’t allege a specific legal injury that was recognizable under federal law.
“The court does not consider either party’s arguments on the merits because it concludes that plaintiffs allege a bare procedural violation of” a specific BIPA section, Gettleman wrote, “and bare procedural claims are insufficiently concrete to establish standing in federal court.”
Gettleman further said a 2020 U.S. Seventh Circuit Court of Appeals opinion, Fox v. Dakkota Integrated Systems, established that failure to create a biometric data retention and destruction policy is a “bare procedural violation,” but failure to comply with such a policy could establish standing.
Here, he explained, the defendants only alleged CVS didn’t maintain such a policy, which is an argument suited for Illinois state court, where the Illinois Supreme Court has ruled plaintiffs don't need to prove they were actually harmed before pressing potentially massive class actions under the Illinois BIPA law.
He likewise said the complaint doesn’t contain allegations CVS profited from the data of the named plaintiffs or the putative class, saying only it generally advertised the Kodak system to profit from passport photos. Whether the complaint adequately alleged CVS “shared or transferred access to biometric data in return for something of value is irrelevant” to a federal court, he said.
Turning to the issue of whether CVS controlled biometric data, Gettleman said the plaintiffs’ missed a key aspect required to make their allegations stick. CVS argued the complaint doesn’t show the company used data from passport photos to determine customers’ identities and said BIPA protections aren’t trigged merely by scanning customers' faces.
Gettleman said although he “is inclined to conclude” information from a facial scan can trigger BIPA, he agreed with CVS regarding the complaint’s shortcomings, to the extent of the company’s capability, if not specifically its conduct.
“Plaintiffs must allege that defendant’s collection of their biometric data made defendant capable of determining their identities,” Gettleman wrote. “Plaintiffs do not plead that defendant, in fact, ‘used’ their biometric data to determine their identities. They also do not plead that defendant could do so. Plaintiffs do not allege that they provided defendant with any information, such as their names or physical or email addresses, that could connect the voluntary scans of face geometry with their identities. Thus, plaintiffs have failed to plead the most foundational aspect of a BIPA claim.”
In addition to attorney Klinger, the plaintiffs are represented by attorneys Andrei V. Rado, Blake Hunter Yagman, Matthew Lee, Erin Ruben and Jonathan B. Cohen, all of the Milberg Coleman firm, with offices in Garden City, New York; Raleigh, North Carolina; and Knoxville, Tennessee.
CVS is represented by attorney Matthew C. Wolfe and others with the firm of Shook, Hardy & Bacon, of Chicago.