Class Action Defense

By Gerald L. Maatman, Jr., Justin R. Donoho, and Ryan Garippo

Duane Morris Takeaways:  On October 15, 2024, in Salazar v. NBA, 2024 WL 4487971 (2d Cir. Oct. 15, 2024), a unanimous panel of the U.S. Court of Appeals for the Second Circuit reversed the dismissal of a privacy class action against the National Basketball Association (“NBA”) and held that a web user who casually watched videos on the NBA’s website after signing up for a free email newsletter plausibly alleged that he was a “subscriber of goods and services” under the Video Privacy Protection Act (“VPPA”).  The Second Circuit was unpersuaded by the NBA’s arguments that the VPPA applies only to subscribers of audiovisual content.  Instead, it found, as a matter of first impression, that an email newsletter qualifies as “goods or services” under the VPPA, reversed the dismissal order, and remanded for the district court to address the NBA’s other arguments, including whether the plaintiff failed to plausibly allege his lack of consent and the NBA’s knowing disclosure.

Background

This case is one of a hundred or so VPPA class actions that plaintiffs have filed nationwide alleging that Meta Pixel, Google Analytics, and other similar software embedded in defendants’ websites secretly captured plaintiffs’ online video watching histories and sent it to Meta, Google, and other online advertising agencies.  This software, often called website advertising technologies or “adtech” is a common feature on millions of corporate, governmental, and other websites in operation today.  Plaintiffs’ typical theory in these cases is that they were “subscriber[s] of goods or services from a video tape service provider” under the VPPA, 18 U.S.C. § 2710, such that the defendants therefore violated that statute by knowingly disclosing their video watching histories without their consent via the use of adtech.

The VPPA was enacted in 1988, after a newspaper published a profile on Supreme Court nominee Judge Robert Bork’s video rental history that identified 146 films he and his family had rented from a video store.  Id. at *9.  Although Congress later amended the VPPA in 2012, “to clarify that a video tape service provider may obtain a consumer’s informed, written consent on an ongoing basis and that consent may be obtained through the Internet … much of the 1988 VPPA’s text remains unchanged.”  Id. at **9-10.  Thus, in VPPA cases, courts are often left to “grapple with how the language of this statute applies in today’s increasingly online world.”  Id. at *1.

In Salazar, the plaintiff brought suit against the NBA.  According to the plaintiff, he signed up for an online email newsletter offered by the NBA and, thereafter, visited the NBA’s website, where he watched videos.  Id.   The plaintiff further alleged that, after he watched those videos, his video-watching history was sent to Meta without his permission via the NBA’s undisclosed use of the Meta Pixel on its website.  Id.  Based on these allegations, the plaintiff alleged a violation of the VPPA.  The NBA moved to dismiss under Rule 12(b)(6), arguing that the plaintiff failed to plausibly allege a violation of the VPPA because, among other things, (1) the plaintiff did not sign up for any “audiovisual ‘good or service,’” id. (emphasis in original); (2) the NBA did not knowingly disclose the video-watching history to Meta, as Plaintiff was the one who did that via his own browser and Facebook settings, id. at *4; and (3) the plaintiff consented to disclosure to Meta by consenting to the NBA’s privacy policy.  Id. at *4 n.4.  The district court accepted the NBA’s first argument and dismissed on that basis, without reaching the other two arguments.  The Plaintiff appealed.

The Second Circuit’s Decision

The Second Circuit agreed with the plaintiff and reversed. It rejected the district court’s conclusion that the VPPA applies to subscribers only of audiovisual services.

First, the Second Circuit found that the VPPA’s language saying it applies to “any renter, purchaser, or subscriber of goods or services from a video tape service provider,” id. § 2710(a)(1), “makes no mention of audiovisual materials” in reference to the “goods or services.”  Id. at *11.  This omission was meaningful, according to the court, because Congress knew how to include the word “audiovisual” in other portions of the VPPA, namely, its definition of a “video tape service provider” as including a business engaged in renting, selling, or delivering prerecorded video cassette tapes “or similar audio visual materials.”  Id. (quoting 18 U.S.C. § 2710(a)(4)).  As the Second Circuit explained, “Congress’s decision to use different words in different definitions strongly signals its intent to convey different meanings.”  Id.

Moreover, the Second Circuit held that under the NBA’s interpretation of “goods and services” as audiovisual materials, “Congress’s express restriction in the definition of ‘personally identifiable information’ to information about ‘video materials or services’ would be superfluous.”  Id.

Further, the Second Circuit found that although the First and Eleventh Circuits are split on whether a person who merely downloads an app to view content counts as a “subscriber,” that circuit split was not implicated here because the plaintiff alleged that he signed up for the newsletter and, in doing so, provided his email address, IP address, and cookies associated with his device.  Id. at *15.  These allegations were sufficient, the Second Circuit held, to allege he was a “subscriber.”  As the Second Circuit explained, the NBA’s relationship with the plaintiff was “distinct from its relationship with casual NBA.com video-watchers who had not signed up for the newsletter.”  Id. at *15 (emphasis added).

In short, the Second Circuit concluded that a web user who casually watched videos on the NBA’s website after signing up for a free email newsletter plausibly alleged that he was a “subscriber of goods and services” under the VPPA.  The Second Circuit therefore reversed and remanded for the district court to address the NBA’s remaining arguments in the first instance.  Id. at *4 n.4, 16.

Implications For Companies

The Second Circuit’s opinion serves as a cautionary tale for companies using adtech on webpages containing video content.  As the ruling shows, VPPA litigation risk for such companies is not limited to users who sign up to receive the video content.  In addition, companies using adtech on webpages containing video content face the risk of VPPA class actions by allowing users to sign up for other, non-audiovisual goods or services.  Further, companies using adtech also face the risk of VPPA class actions merely by making an app available to view the video content, at least in some circuits, as the Second Circuit noted. 

As adtech and online videos continue to proliferate, organizations should consider in light of Salazar whether to modify their website terms of use, data privacy policies, and all other notices to the organizations’ website visitors and customers to describe the organization’s use of adtech in additional detail.  Doing so could deter or help defend a future class action lawsuit similar to the many that are being filed today, alleging omission of such additional details, and raising high-dollar claims for statutory damages brought under not only the VPPA ($2,500 per alleged class member), as in this case, but also federal and state wiretap acts and consumer fraud acts, as in other cases we blogged about here, here, and here.

By Gerald L. Maatman, Jr., Tiffany E. Alberti, and Bernadette Coyle

Duane Morris Takeaways: On October 10, 2024, the Tenth Circuit declined to overturn a district court order that remanded a Colorado wage & hour class action back to state court after it found that Wendy’s International (“Wendy’s”) failed to file its removal request within the 30-day removal provision of the Class Action Fairness Act (“CAFA”) after Plaintiffs provided a demand that triggered the CAFA factors. The ruling in Little v. Wendy’s International, LLC, Case No. 24-1232, 2024 WL 4455858 (10th Cir. Oct. 10, 2024), is a lesson for corporate defendants on fundamental time deadlines for removals of class actions under the CAFA.

Case Background

The CAFA expands federal subject-matter jurisdiction over class action lawsuits in the United States by providing a way for defendants to remove these cases from state courts to federal courts. To bring remove a case to federal court through the CAFA, there must be: (1) minimal diversity; (2) 100 or more putative class members; and (3) more than $5 million in controversy. 28 U.S.C § 1332(d)(2). A defendant must generally remove the case either within 30 days of receipt of the initial complaint showing that the CAFA’s jurisdictional requirements are met or within 30 days of receipt of “a copy of an amended pleading, motion, order or other paper from which it may first be ascertained that the case is one which is or has become removable.” Id. at § 1446(b)(3) (emphasis added).

In October 2020, Jeffrey Little (“Plaintiff”) filed a putative class against Wendy’s in Colorado state court, accusing the fast food chain of violating the Colorado Wage Claim Act, Colo. Rev. Stat. §§ 8-4-101–125, and the Colorado Minimum Wage Act, Colo. Rev. Stat. §§ 8-6-101–120, by failing to ensure workers took meal and rest breaks.

In January 2023, as the state court considered certifying a class of Wendy’s workers in Colorado, Plaintiff’s counsel sent two demand letters to Wendy’s. The first letter stated in part, “Pursuant to C.R.S. § 8-4-109, demand is made for payment of wages in the amount of $5,930,118.70.” 2024 WL 4455858, at *1. The second letter, sent one and a half weeks later, stated in part, “Pursuant to C.R.S. § 8-4-109, Jeffrey Little, and designated representative attorneys Alexander Hood and Brian D. Gonzales, hereby demand payment of wages in the amount of $5,100,000.00.” Id.

The state court granted the Plaintiff’s class certification motion on October 31, 2023. Relying on the removal provisions of the CAFA, under §§ 1332(d), 1453(b), 1446, Wendy’s removed the action to federal court in November 2023, arguing that the 30-day deadline was not triggered by the Plaintiff’s original and amended state court complaints because the complaints did not address the size of the proposed class and the amount of damages. Wendy’s also contended that the demand letters did not trigger the 30-day deadline because there was no explanation for the amount sought and the demand letters did not claim to be settlement offers. The district court disagreed and granted Little’s motion to remand the action to state court after finding that Wendy’s removal motion was untimely.

Wendy’s appealed the remand order to the Tenth Circuit.

The Tenth Circuit’s Ruling

On appeal, Wendy’s made three arguments. First, Wendy’s argued that the figures in the demand letters merely stated an amount without adequately explaining the basis for the amount sought, and thus did not trigger the 30-day removal period under § 1446 of the CAFA. Second, Wendy’s claimed that the demand did not reflect a reasonable estimate of the claims because they did not purport to be settlement offers. Finally, Wendy’s contended that the district court’s remand order incorrectly went beyond the four corners of the Plaintiff’s initial complaints and the demand letters in determining that Wendy’s was late in filing its removal request.

On the issue regarding whether the demand letters provided Wendy’s with adequate notice of the amount of monetary damages sought, the Tenth Circuit explained that in invoking C.R.S. § 8-4-109, which is intended to supply notice to a potential defendant of an employee’s intention to seek unpaid wages, the demand letters went beyond an ambiguous statement by making “specific demands that had statutory significance.” Id. at *6. It noted that while other circuits (specifically the Eighth Circuit) have required more than unproven statements to trigger the 30-day deadline, the Tenth Circuit had previously ruled that a Colorado state court civil cover sheet (that indicates a box stating the amount in controversy) provided adequate notice to the defendant. Thus, the Tenth Circuit held that each of the demand letters was sufficient to put Wendy’s on notice that the amount in controversy exceeded $5 million, thereby triggering the third CAFA factor, and ultimately determining Wendy’s filing of the removal untimely.

On the issue regarding whether the district erred in relying on “other paper” received through discovery to adequately put Wendy’s on notice of the $5 million in controversy, the Tenth Circuit held that the district court was allowed to rely on limited discovery that revealed extent of Wendy’s workforce and operations in Colorado that would support the amount in controversy. It explained that, “[t]he evidence developed in discovery helped to show that the demand letters at least appeared to reflect a reasonable estimate of the plaintiff’s claim, even if they did not provide a precise mathematical calculation underlying the estimate.” Id. For this reason, the Tenth Circuit concluded that the district court did not err in its evaluation of “other paper” for the purposes of the CAFA.

Implications For Corporations

The Tenth Circuit’s ruling underscores the importance of a global consideration of all documents exchanged throughout litigation that can effectively determine the best strategy for corporations facing potential class action lawsuits. Because the CAFA is a powerful tool to combat against state court class actions, where federal courts are less attractive forums for plaintiffs, it is crucial for employers to prioritize initial complaints, demand letters, and other papers (such as discovery documents) to recognize whether they are put on notice of the CAFA factors ensuring they meet the 30-day deadline for removal to federal court.

By Gerald L. Maatman, Jr., Gregory Tsonis, and Christian J. Palacios

Duane Morris Takeaways:  On October 3, 2024, the Seventh Circuit upheld the decertification of a class of satellite technicians in a wage and hour suit against DirectSat USA LLC (“DirectSat”) on the grounds that a class action was not the best method of resolving the lawsuit.  The ruling in Jacks v. Directsat USA, LLC, Case No. 23-3166, 2024 U.S. App. LEXIS 25099 (7th Cir. Oct. 3, 2024), is significant, as it represents the first time the Seventh Circuit has taken a definitive position on resolving “issues class actions” under Rule 23(c)(4), a topic that is currently the subject of a circuit split.  Although the Seventh Circuit ultimately agreed with the majority approach adopted by the Second, Third, Fourth, Sixth and Ninth Circuits – that permits certification as long as common questions predominate in resolving the individual issues to be certified – it also clarified that district courts should look at the relationship any certified issues have to the dispute as a whole.

Background

DirectSat (owned by UniTek USA, LLC) installs and services residential satellite dishes throughout the state of Illinois.  The company employs satellite technicians to install and maintain the satellites, and it  compensates them on a per-installation basis (though the technicians record their time worked in order to ensure they are paid the legal minimum).  Id. at *2.  On February 9, 2010, three plaintiffs filed a class action against DirectSat, UnitTek, and certain company executives, alleging violations of the Illinois Minimum Wage Law (“IMWL”), the Fair Labor Standards Act (“FLSA”), and Illinois common law, claiming they were not paid for the time spent doing tasks such as maintaining their vehicles, mapping directions for service calls, and loading equipment prior to leaving for a job site.  Id.

In June 2012, Judge Gottschall of the U.S. District Court for the Northern District of Illinois certified a class of full-time Illinois DirectSat satellite technicians who worked at the company from July 12, 2008 through February 9, 2010. This initial class was certified pursuant to Federal Rule 23(b)(3) for plaintiffs’ IMWL claims.  Eight months after the district court certified the Rule 23(b)(3) class, the Seventh Circuit affirmed a separate district court’s decertification of a similar case captioned Espenscheid v. DirectSat USA, 705 F.3d 770 (7th Cir. 2013).  Following the decision in Espenscheild, Judge Gottschall vacated the previous certification order and certified a second Rule 23(c)(4) “issue class,” to resolve fifteen questions related to DirectSat’s liability that plaintiffs argued could be decided on a class-wide basis, such as the definition of the satellite technicians’ work day. Id. at*6.

The case was then re-assigned to another district judge, Judge Pacold, in August 2019, who proceeded to decertify the Rule 23(c)(4) class months before the case was scheduled to go to trial, on the basis that DirectSat’s liability could not be resolved on a class-wide basis, and the fifteen certified issues would not resolve the lawsuit, given, amongst other things, the variance of the claims at issue. Id. at *9.  Although the original named plaintiffs settled their claims individually, they reserved their right to appeal the decertification decision, which they did.  On October 3, 2024, the Seventh Circuit affirmed the district court’s decertification, though on slightly different grounds.

The Seventh Circuit’s Ruling

The Seventh Circuit panel (comprised of Judges Easterbrook, Kirsch, and Lee) affirmed the decertification of the Rule 23(c)(4) issues class action.  Writing for the court, Judge Lee first rejected plaintiff’s arguments that Judge Pacold should have deferred to Judge Gottschall’s ruling certifying the fifteen issues for trial under Rule 23(c)(4), given Rule 23’s broad authority to revoke or alter class certification prior to a final judgement.  Id. at *15.  The Seventh Circuit also rejected plaintiffs’ argument that Judge Pacold improperly considered merits questions at the class certification stage, observing that merits inquiries were appropriate in determining if Rule 23’s certification prerequisites could be satisfied.  Id.

The Seventh Circuit then turned to the issue of whether plaintiffs’ class action was properly decertified, and concluded that it the district court did not err in doing so.  The Seventh Circuit observed there was a circuit split regarding the interaction between Rule 23(b)(3) and Rule 23(c)(4).  The Fifth Circuit currently limits Rule 23(c)(4) classes to instances where the plaintiff’s cause of action, taken as a whole, satisfies Rule 23(b)(3)’s predominance requirement.  By contrast, the Second, Third, Fourth, Sixth and Ninth Circuits permit Rule 23(c)(4) certification so long as common questions predominate in resolving the individual issues to be certified.  Id. at *19. 

Ultimately, the Seventh Circuit agreed with the majority approach, but also concluded that a class should not be certified under Rule 23(c)(4) unless the certification would be superior to any other methods of adjudicating the controversy.  Id.  Thus, in addition to demonstrating that common questions predominate as to each issue to be certified, the party seeking certification under Rule 23(c)(4) also must show the proposed issues would be the most practical and efficient way to resolve the litigation.  Id. at *23.  Using this approach, the Seventh Circuit took issue with the district court’s ruling, because it examined whether common questions predominated the entire cause of action, rather than looking to see whether common questions predominated as to each of the certified issues.  Id.  Despite this, the Seventh Circuit agreed with the district court’s determination that proceeding to trial on the certified issues would not be “superior to other available methods for fairly and efficiently adjudicating the controversy” as required by Rule 23(b)(3).  Id.

Implications

Given that the Seventh Circuit’s direction regarding how a district court should analyze a Rule 23(b)(4) issues class action, plaintiffs will now have the additional burden of demonstrating that the certified issues would be superior to other methods of adjudication.  This ruling could provide employers with additional tools to defend against issues class actions, and impose a higher bar on plaintiffs seeking to take advantage of the issue class mechanism. 

By Gerald L. Maatman, Jr., Zach McCormack, and Ryan T. Garippo

Duane Morris Takeaways:  On September 24, 2024, in EEOC v. Total Systems Services, LLC, No. 23-CV-01311 (N.D. Ga. Sept. 24, 2024), Judge William Ray II of the U.S District Court for the Northern District of Georgia adopted a report and recommendation from a magistrate judge granting in part and denying in part Total Systems Services, LLC’s (“TSS”) motion for summary judgment on claims of disability discrimination.  In an increasingly digital world, this opinion in an EEOC enforcement lawsuit exemplifies some of the risks that employers face when allowing a portion of their workforce to work remotely.

Case Background

Plaintiff Joyce Poulson (“Poulson”) worked as a customer service representative for TSS from 2016-2020.  As a customer service representative, Poulson was assigned to take telephone calls from the clients of three different banks related to travel benefits associated with their credit cards.  Prior to the COVID-19 pandemic, TSS did not allow its employees to work remotely.  In the wake of the pandemic, however, TSS began transitioning as many employees as possible to remote work.  Poulson was not selected to be one of the employees to transition to remote work based, in part, on the fact that SunTrust Bank (i.e., one of TSS’ clients for whom she took calls) would not allow it.

In 2020, Poulson was diagnosed as a “pre-diabetic” by her doctor.  This condition did not limit her job functions and was adequately controlled by medication.  However, when one of Poulson’s other co-workers tested positive for COVID-19, Poulson’s doctor advised that she should self-quarantine (a period of time that was ultimately covered by the Family Medical Leave Act (“FMLA”)). After the period of self-quarantine, Poulson requested to continue with remote work based on her doctor’s recommendation that she was at “high-risk of suffering severe effects.”  Id. at 7.

TSS explained to Poulson that it would consider her for a remote position when the next round of remote positions became available.  TSS also asked Poulson to demonstrate that she had adequate internet speed available at home to demonstrate that she could do her job remotely.  When Poulson’s internet speed proved too slow and no remote positions opened, Poulson resigned her employment accusing TSS of exhibiting a “blatant disregard” for her health.  Id. at 9.

Poulson then took a new job where she would still have to work in person at least 50% of the time.  Moreover, in her employment application for that job, Poulson indicated that she did not have a disability.  But regardless, shortly thereafter the Equal Employment Opportunity Commission (“EEOC”) filed a lawsuit on Poulson’s behalf claiming disability discrimination under the Americans with Disabilities Act (“ADA”), constructive discharge, and FMLA retaliation.

The Court’s Opinion

Judge William Ray II of the U.S. District Court for the Northern District of Georgia adopted a report and recommendation of a magistrate judge partially granting TSS’ motion for summary judgment.  

First, the Court found there was a genuine dispute of material fact as to whether TSS unlawfully denied Poulson’s request for a reasonable accommodation under the ADA.  To this point, TSS argued that its general accommodations in light of the COVID-19 pandemic were reasonable.  But the Court held that this theory missed the mark.  The Court reasoned that there is a “difference between a general policy that applies to all employees and an appropriate and reasonable accommodation that could overcome the precise limitations resulting from an employee’s disability.”  Id. at 20.  In the absence of a specific effort to accommodate Poulson’s disability, summary judgment could not be granted.

Second, as to the constructive discharge claim, the Court granted summary judgment.  It explained that TSS “was not responsible for the severe and pervasive effects of the COVID-19 pandemic.”  Id. at 27.  Consequently, there was nothing about its decisions with regard to remote work that would support an inference that the decision was made with the intent to force Poulson to resign.

Third, the Court concluded that the decision not to allow remote work was not sufficient to also support a claim for FMLA retaliation.  The EEOC’s theory was that the adverse action required to maintain such a claim was the denial of Poulson’s reasonable accommodation.  However, the Court explained that “there is no real distinction between ‘excluding’ [Poulson] from her requested accommodation and ‘failing to accommodate’ her request.”  Id. at 30.  In essence, this claim was more properly brought under an ADA discrimination theory.

With these rulings adopted, the Court allowed the ADA discrimination claim to be decided by a jury but dismiss the rest of the EEOC’s claims.

Implications For Employers

The prevalence of remote work has expanded in recent years and so too as the associated liability with such work.  However, the general option to work remotely does not relieve companies of their obligations under the ADA.  Corporate counsel must keep in mind that their companies are still required to engage in the interactive process, for each individual employee, in order to determine whether the requested accommodation is reasonable regardless of a company’s general remote work policies.  Otherwise, the EEOC can prove to be a formidable and aggressive litigant — who is often ready to test the sufficiency of a corporation’s policies.

By Gerald L. Maatman, Jr., Bernadette Coyle, and Ryan T. Garippo

Duane Morris Takeaways:  On September 30, 2024, in Henderson, et al. v. Reventics LLC, et al., No. 23-CV-00586 (D. Colo. Sept. 30, 2024), Magistrate Judge Michael Hegarty of the U.S. District Court for the District of Colorado granted Reventics, LLC and OMH Healthedge Holdings, Inc.’s (collectively Omega”) motion to dismiss based on lack of Article III standing in a data breach class action.  This decision represents another arrow in the quiver of corporate defendants looking to protect themselves against data breach claims involving speculative harms.

Case Background

Omega is a company that provides data analytics and software solutions to healthcare organizations.  In December 2022, Omega learned that cyber criminals exfiltrated its network and obtained the “names, dates of birth, Social Security numbers, and clinical data” of 250,000 of its clients’ patients.  Id. at 3.  Two months later, after its investigation of the cybercrime was completed, Omega sent out notices regarding the incident to the potentially affected individuals.

Within the next few weeks, Omega was sued seven times, by fifteen different plaintiffs (the “Plaintiffs”), each alleging that the cyber security incident constituted a breach of their personally identifiable information (“PII”) and protected health information (“PHI”).  These Plaintiffs all alleged that they suffered injuries in the form of:

“(1) public disclosure of private information, including Social Security numbers and medical information; (2) increased spam communications; (3) diminution of the value their PHI/PII; (4) emotional distress; (5) actual fraud; and (6) future impending injury.”

Id. at 9 (quotations omitted).  Tellingly, despite the existence of 15 separate Plaintiffs, none of these individuals could plausibly allege that they lost any money as a result of the cyber security incident.  Consequently, once all these class actions where consolidated into one proceeding, Omega moved to dismiss on the grounds that Plaintiffs lacked Article III standing to sue.

The Court’s Opinion

Magistrate Judge Hegarty granted Omega’s motion to dismiss.  In so doing, he systematically rejected each of Plaintiffs’ theories of standing.  Article III standing requires a plaintiff to plead the existence of an injury in fact, that is traceable to the defendant’s conduct, and that can be redressed by judicial relief.  Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016).  The Court reasoned that Plaintiffs failed to meet several of these requirements.

First, the Court rejected Plaintiffs’ theory that the public disclosure of their so-called “private information” constitutes a compensable injury in fact.  Plaintiffs argued that public disclosure of their alleged PII and PHI would cause them to voluntarily spend money on future credit monitoring services.  However, the Court found that “Plaintiffs cannot manufacture standing by choosing to make expenditures based on hypothetical future harm that is not certainly impending.”  Henderson, et al., No. 23-CV-00586, at 10-11 (quotations omitted).  In the absence of imminent risk of harm, the Court concluded proactive credit monitoring cannot constitute an injury.

Second, the Court found that Plaintiffs’ allegations of increased spam communications were also not an injury in fact.  But even if they were, the Court held that Plaintiffs could not plausibly allege that they received those spam communications because of Omega’s conduct.  Put differently, “there [were] no specific allegations regarding the timing of these communications from which the Court could infer a causal connection between the breach and the spam” and the theory, therefore, also failed on traceability grounds.  Id. at 12. 

Third, the Court considered and dispensed with the idea that Plaintiffs’ personal information “has independent monetary value” sufficient to support a claim for diminution of value as to that information.  Id. at 13.  Even still, the Court ruled that because Plaintiffs lacked the means to sell their own personal information at a lower price, this theory failed as well.

Fourth, as to Plaintiffs’ claims of emotional distress, the Court succinctly found that “[e]motional distress does not constitute a cognizable injury-in-fact in data privacy litigation”  Id. at 14 (quotations omitted).  This holding is aligned with other district courts around the country and should not have come as a surprise.

Fifth, the Court dismissed Plaintiffs’ claim of “actual” fraud on a different part of the standing analysis — namely its lack of traceability to Omega’s conduct.  The Court reasoned that the mere existence of isolated incidents of “fraud” alerts on the Plaintiffs’ bank accounts were not the same as actual proof that the so-called harm was caused by Omega. 

Sixth, the Court held that allegations of a “future injury based on stolen personal information” only can be considered a plausible injury in fact where accompanied by allegations of current direct harm.  Id. at 17.  If no such current harm exists, then Plaintiffs were merely speculating that harm may or may not occur in the future.

With all of these theories considered (and rejected), the Court dismissed the class action as a whole and entered judgment on behalf of Omega.

Implications For Companies

As corporate counsel is often well aware, the staggering liability associated with class actions frequently hinges on the merits of a cause of action or on whether the named plaintiff can achieve class certification.  However, in the data breach context, an attack to the named plaintiffs’ Article III standing is often a swift and efficient way to dispense of such claims. 

Corporate counsel should continue to take stock of opinions like this one under the event that their companies’ cybersecurity protocols are put to the test.

Duane Morris Takeaway: This week’s episode of the Class Action Weekly Wire features Duane Morris partner Jerry Maatman, special counsel Justin Donoho, and associate Tyler Zmick with their discussion of a BIPA ruling issued in the Northern District of Illinois analyzing the arguments of consumer privacy claims involving virtual “try-on” technology.

Check out today’s episode and subscribe to our show from your preferred podcast platform: Spotify, Amazon Music, Apple Podcasts, Samsung Podcasts, Podcast Index, Tune In, Listen Notes, iHeartRadio, Deezer, and YouTube.

Episode Transcript

Jerry Maatman: Thank you, loyal blog readers for joining us on this week’s installment of our podcast series, entitled The Class Action Weekly Wire. Today I am joined by my colleagues, Justin and Tyler, and we’re going to talk about all things BIPA. Justin and Tyler, welcome to the show.

Justin Donoho: Thanks, Jerry, happy to be here.

Tyler Zmick: Thank you for having me, Jerry.

Jerry: Today we’re discussing a lawsuit brought under the Illinois Biometric Information Privacy Act involving cosmetics manufacturer L’Oréal, and a ruling that emanated from the U.S. District Court for the Northern District of Illinois. Justin, could you give our readers and listeners an overview of the allegations at issue in this lawsuit?

Justin: Yes, Jerry, so this is another challenge under BIPA to virtual try-on software. We’ve seen a number of these filed against cosmetic companies. The way the software works is you’re viewing the cosmetic product on the web page, a pop up then appears, allowing you to use your web or phone cameras to upload a photo to check how the product will work on your face. And then, according to plaintiffs, the virtual try-on software then allegedly captures what the plaintiffs contend is a “scan of facial geometry” in the consumer’s photos – or you know, what that means under BIPA is a scan of sufficient geometry of the face, to be unique to the individual, and to be capable of identifying a person.

Jerry: These sorts of try-on BIPA cases are being litigated more frequently. If we talked about BIPA litigation five years ago, it typically would involve a timekeeping system and workers who checked in and checked out of work through biometric identifiers. Here, however, we’re talking about customers interacting with software. Tyler, you have quite a bit of experience in the BIPA field and space – what did you find significant in the way in which the defendant in this litigation tried to argue its motion to dismiss?

Tyler: Sure. Well, I think there were three main arguments that L’Oréal raised in its motion to dismiss. The first was that it wasn’t really a substantive argument, it was procedural, and the argument was that by using the virtual try-on tool, the plaintiff agreed to the company’s terms of use, which contain an enforceable arbitration provision. And so the argument was that this plaintiff cannot bring a class action, but must bring an individual claim in arbitration. The court rejected that argument, finding that the plaintiff did not get conspicuous enough notice. As for the substantive arguments under BIPA, L’Oréal argued that according to its privacy policy, which was presented to plaintiff, the plaintiff consented to the categories of personal information being collected from users, including plaintiff, who use the virtual try-on tool, and the language said that “if you use one of our virtual try-on features, we may collect and store your images.” And so obviously the court found that language deficient because it did not specifically address biometric information or scans of facial geometry obtained from an image. And finally, as with many defendants moving to dismiss BIPA claims, L’Oréal argued that plaintiff failed to state a claim because the complaint failed to establish the company was in possession of any biometric data, and that their technology only operates locally on users’ devices.

Jerry: I know that facts drive case decisions, but it seems that BIPA cases have gone both ways on this issue or the array of issues you just articulated in the Northern District of Illinois. How did the court rule in this particular situation?

Justin: Yes, Jerry. Interestingly, you say both ways. So yes, at least at the at the motion to dismiss stage, anyway, the courts do seem to be going both ways on these virtual try-on cosmetic cases on the key issue of whether what is being captured is sufficient facial geometry to be a unique biometric identifier. There have been a number of other cases, too, like this that also do not involve facial recognition like interview software, a pornography filter that happens to filter photos that contain a face, passport photo software, COVID screening – basically, if your company has a technology involving a face in any way and some arguable connection to Illinois, then the plaintiffs’ bar is suing, or it may have you in its crosshairs. So in this case, though there was no written decision. But it does appear, though, that this court did not rule on this key issue of whether the software captured a biometric identifier because the parties didn’t argue it in their briefs in this particular case. We’ll have to wait to see how that issue comes out if the parties ever get to the expert discovery and summary judgment stage, where likely this will become the parties main focus. So Tyler mentioned the three kind of main arguments that the defendants made in this case in their motion on. I’ll just do the first one – the main focus was the arbitration clause. By denying the motion to dismiss the court basically ruled that even though this was clickwrap instead of browsewrap, the arbitration clause in this particular instance, was not conspicuous enough for the plaintiffs to be bound, or, in other words, clicking to accept things that plaintiffs may have done was on other things, and too far removed from the terms of the arbitration agreement.

Tyler: And one more point – L’Oréal did not develop this argument – specifically the argument that the technology did not collect unique scans of face geometry – but it was addressed in passing in the briefing on the motion dismiss, and the judge basically rejected that argument, at least at the motion to dismiss stage. And the court ruled that plaintiff sufficiently alleged that the way the try-on tool works is by processing the user’s image and capturing facial geometry to identify their features, and thus the reasonable inferences of the company collected biometric data that is necessary for the tool to work. And so I think, even if the technology does not ultimately work in a way that it can uniquely identify specific individuals, that is an uphill battle to present that argument early at the pleading stage, and summary judgment may be more appropriate for that type of argument.

Jerry: Well, certainly the ruling and the case is incredibly interesting, and it underscores the innovative thinking of the plaintiffs’ bar and attacks on all sorts of customer interfacing software that has anything to do with collection of alleged biometric information. It also underscores how important consent features are in terms of a company interacting with its customers because consent – obviously the bedrock principle under BIPA – to try and get the consent to allow a collection I f there’s any question that biometrics are involved. Well, thank you for your thought leadership, Justin and Tyler, and for lending your expertise to describe this ruling. Thank you, listeners, for joining us on this week’s episode of the Class Action Weekly Wire.

Justin: Thanks, Jerry.

Tyler: Thank you everyone for tuning in.

By Ryan T. Garippo, Alex W. Karasik, and Gerald L. Maatman, Jr.

Duane Morris Takeaways:  On September 29, 2024, in Howe, et al. v. Speedway, LLC, No. 19-CV-01374, 2024 U.S. Dist. LEXIS 176263 (N.D. Ill. Sept. 29, 2024), Judge Edmond Chang of the U.S. District Court for the Northern District of Illinois denied Speedway’s two motions for summary judgment and granted Plaintiff’s motion for class certification, meaning this Illinois Biometric Information Privacy Act (the “BIPA”) class action will proceed to trial. 

This decision is significant for employers because it represents another example of a court limiting the sparse defenses available to corporate defendants in BIPA cases.

Case Background

Plaintiff worked as a manager trainee and then as a manager for Speedway, LLC (“Speedway”).   Like many employers, Speedway used finger-scan timeclocks for its employees to clock in and out of work “to avoid the problem of ‘buddy punching’ (clocking in and out for someone else).”  Id.  at *1.  These timeclocks scanned the ridges of an employee’s fingerprint and then created an alphanumeric code.  The parties disagreed as to whether this alphanumeric code could be reverse engineered to reconstruct the scan that it was based on to finger-scans. 

In 2017, Plaintiff filed a lawsuit in the Circuit Court of Cook County (Illinois) alleging violations of the BIPA, which prohibits the possession, collection, and/or disclosure of an individual’s biometric information without notice and consent.  Over the course of the last seven years, Speedway put up a vigorous defense to these claims.  It removed the case to federal court.  Howe, et al. v. Speedway, No. 17-CV-07303, 2018 WL 2445541, at *1 (N.D. Ill. May 31, 2018).  Plaintiff then filed and won a motion to remand, claiming that he himself had not suffered an injury-in-fact.  Id. at *1-7.  But then after the case proceeded for nearly two years in state court, Speedway removed the case again after the Illinois Supreme Court changed its approach to the Article III analysis.  Howe, 2024 WL 4346631, at *3, n. 5.  Speedway also filed two motions for summary judgment, a motion to exclude Plaintiff’s expert witness, and a response in opposition to class certification.  Id. at *3.

The Court’s Opinion

The Court denied Speedway’s motions for summary judgment and motion to exclude Plaintiff’s expert witness, while granting Plaintiff’s motion for class certification.

First, the Court rejected Speedway’s argument, as “a matter of first impression,” that the term “fingerprint” does not include partial prints or partial finger scans.  Id. at *7.  The Court held that the term “fingerprint” means “the ridges of the finger (or a portion of the distinctive pattern of lines on a finger), as long as that portion of the finger’s ridges or pattern is sufficient to be unique to a particular individual and is capable of being used to identify a particular person.”  Id.  As a result, the Court concluded that “[t]here is no reason that particular fingerprint, or scan of a ‘portion of the ridges of a finger’ cannot qualify as a biometric identifier” and by extension that the alphanumeric code was “biometric information under [the] BIPA.”  Id. at *8.

Second, the Court rejected Speedway’s argument that it failed to act negligently, let alone recklessly, sufficient to establish statutory damages under the BIPA.  The Court found “[o]n liability, BIPA is indeed a strict liability statute and requires no proof of particular mental state to establish a violation of the statutes notice and consent or data-retention policy requirements.”  Id. at *10.  Although such states of mind are required to obtain statutory damages, the Court concluded that there was a question of fact as to Speedway’s state of mind because it was undisputed that Speedway did not have BIPA-specific notice forms up to nine years after the BIPA’s enactment.  However, it will be up to a jury to decide whether this conduct was negligent or reckless.

Third, the Court rejected Speedway’s argument that the damages alleged were disproportionate to the harm suffered and would violate the due process clause of the U.S. Constitution.  The Court reasoned that $1,000 per-negligent violation, and $5,000 per-reckless violation, were not inherently unconstitutional damages figures.  Thus, they did not run afoul of the due process clause.  The Court was also unpersuaded by Speedway’s concern that certification of a class action implicates such significant damages.  The Court reasoned that “[s]omeone whose maximum penalty reaches the mesosphere only because the number of violations reaches the stratosphere can’t complain about the consequences of its own extensive misconduct.”  Id. at *17 (quotations omitted).

Fourth, the Court also dispensed with Speedway’s myriad of other affirmative defenses and arguments.  For a variety of reasons, the Court held that each of these defenses failed.  Further, the Court took care to note that “Speedway may still litigate whether there are any factual questions to decide” at trial.  Id. at *10.  But the Court was “skeptical” that such disputed facts exist.  Id.  With all of Speedway’s motions and defenses rejected, the Court granted Plaintiff’s motion for class certification of the “7,246 employees enrolled using its timeclocks in Illinois.”  Id. at *15. 

Implications For Businesses

Unfortunately, the story in Speedway is one that employers who utilize biometric timekeeping systems in Illinois know all too well.  A seemingly routine business decision regarding timekeeping practices evolved into exponential liability, despite a plaintiff’s own admission that he did not suffer an injury-in-fact.

Fortunately, for companies with an Illinois presence that utilize biometrics, reprieve is on the way.  On August 2, 2024, Illinois Governor J.B. Pritzker signed Senate Bill 2979, which amends the draconian penalties under Sections 15(b) and 15(d) of the BIPA.  For businesses caught in the BIPA’s crosshairs, this reform ushers in a welcome era of relief in terms of bet-the-company liability.