A federal judge refused to deliver Papa John’s from a class action accusing the pizza chain of improperly scanning workers’ fingerprints, making it the latest restaurant chain to face potentially staggering payouts under a hotly debated biometrics privacy law.
Preston Kyles sued Hoosier Papa, the Indiana-based company where he worked, and franchisor Papa John’s International, alleging violations of the Illinois Biometric Information Privacy Act. According to Kyles, Papa John’s deployed FOCUS, a proprietary point-of-sales system that collected and stored worker fingerprints nationwide and at its Illinois stores, including the store where Kyles worked in downstate Ottawa in 2017 and 2018. Kyles alleged he never gave consent for the use and disclosure of his personal data nor was he told anything about data retention or deletion.
In his lawsuit, Kyles claimed Papa John's violated Illinois' Biometric Information Privacy Act by not first getting his consent or providing notices before requiring him and other Illinois workers to scan their fingerprints.
Kyles alleged Papa John’s required franchisees, such as Hoosier Papa, to use the FOCUS fingerprint scanner “whenever possible” as a time clock to track workers' hours and to allow employees to access the sales system and input delivery routing. The complaint further alleged Papa John’s retains remote access to FOCUS at individual restaurants so it can monitor system usage and complete daily data downloads.
In addition to suing on his own behalf, Kyles proposed two classes, both dating from Dec. 3, 2016, to the present: One including anyone who worked at a Hoosier Papa location and a second for anyone who used a FOCUS fingerprint scanner in Illinois.
In arguing for dismissal, Papa John’s claimed Kyles’ claims are too old to proceed because he filed his suit more than two years after he stopped working at the Ottawa location. While Blakey acknowledged there had been uncertainty about statutory limitations for BIPA claims, he pointed to a Feb. 2 Illinois Supreme Court opinion, Tims v. Black Horse Carriers, establishing a five-year window.
The corporation also said it never employed Kyles and never possessed or actively collected his fingerprints. Other arguments include that the Illinois Workers’ Compensation Act pre-empts Kyles’ BIPA claims and that he shouldn’t be able to seek heightened BIPA damages without adequately pleading recklessness or intent.
The latter argument follows a different February Illinois Supreme Court decision, in which the court specifically found that BIPA should be interpreted to allow plaintiffs to demand damages of $1,000-$5,000 for each and every scan of a person’s fingerprints or other biometric identifiers, not just the first one. That ruling could prove especially costly for Papa John's and other employers, as they likely could face claims from hundreds or thousands of plaintiffs, like Kyles, who alleged they were required to scan fingerprints several times during each shift.
Multiplied across the company's entire workforce, over five years, damages could quickly run into the billions of dollars.
Fast food restaurant chain White Castle, for instance, estimated they could face nearly $17 billion in damages, should a similar BIPA class action lawsuit against them proceed to trial.
Blakey agreed with Papa John’s that the legal concept of “possession” — in the context of biometric data — requires proof of “control” over such information. But the judge did not take its position that control must be “exclusive.”
He noted Kyles alleged Papa John’s not only “developed” FOCUS, he also alleged it “operated” each franchisee’s system, requiring them to use it whenever possible and would “download and collect information from franchisees’ point-of-sale systems, including Hoosier Papa’s, daily around 2 a.m. and 4 a.m.” then produced reports identifying which “franchisees and workers do not use the FOCUS system’s fingerprint scanner, and instead use passwords for authentication.”
Papa John’s argued the contested data was controlled locally. They pointed to a state court decision in the case of Barnett v. Apple, a BIPA lawsuit in which Cook County Judge Neil Cohen, and later an Illinois First District Appellate Court panel, agreed Apple couldn’t be sued based on face scans and fingerprints stored on phones, laptops and tablets.
“If anything, Barnett supports” Kyles’ claims, Blakey wrote, because he alleged “many of the facts that the Barnett court found missing with respect to whether Apple ‘possessed’ a device user’s biometric data.” The judge noted Apple customers could opt to use other methods to access their devices, besides a fingerprint or face scan, while Kyles said his employer compelled him to use the fingerprint scanner.
Blakey further rejected an attempt by Papa John’s to present itself as similar to third-party vendors that have successfully dismissed BIPA litigation. Blakey said the complaint adequately alleges it not only sells but actively operates FOCUS. He similarly said the requirement for franchisees to utilize FOCUS undercuts Papa John’s argument it never actively captured sensitive data.
“Papa John’s offers no basis” to read into the BIPA law an insistence its notice and consent requirements apply only to employers, Blakey wrote, and said the Illinois Supreme Court has held the state worker compensation law doesn’t prevent employees from pursuing statutory BIPA damages.
Finally, Blakey said Kyles’ “complaint plausibly alleges that Papa John’s acted intentionally or recklessly” because BIPA had been in place for eight years when he started working at the Ottawa store; the law had been the subject of significant media attention; and similar litigation had already been settled in favor of workers. Those facts, Blakey said, “at least plausibly suggest that Papa John’s acted recklessly if not intentionally.”
Kyles has been represented in the case by attorneys Thomas R. Kayes, of The Civil Rights Group firm, of Chicago, and J. Dominick Larry, of Nick Larry Law, of Chicago.
Papa John's is represented by attorneys Melissa A. Siebert, Erin Bolan Hines and Elisabeth A. Hutchinson, of the firm of Shook, Hardy & Bacon, of Chicago and Denver.