IN THE UNITED STATES DISTRICT COURT

FOR THE NORTHERN DISTRICT OF ILLINOIS 

EASTERN DIVISION

DAVID FLEURY, individually and ) 

on behalf of a class of similarly situated ) 

individuals, ) 

 ) Case No. 20-cv-00390 

 Plaintiff, ) 

 v. ) Judge Jorge L. Alonso 

 ) 

UNION PACIFIC RAILROAD COMPANY, ) 

a Delaware corporation, ) 

 ) 

Defendant. ) 

Memorandum Opinion and Order

Plaintiff David Fleury filed this case alleging that Union Pacific violated various 

provisions of the Illinois Biometric Information Privacy Act, 745 ILCS 14/15 (“BIPA”). This 

order addresses two motions filed by Fleury: (1) a motion to sever and remand his section 15(a) 

BIPA claim back to the Circuit Court of Cook County; and (2) a motion to lift the stay imposed 

by the Court on June 23, 2021. For the reasons below, the Court denies the motion to remand 

[68] and grants the motion to lift the stay [78].

Background

Fleury filed this putative class action against Defendant Union Pacific alleging that it

violated various provisions under BIPA. Throughout 2019, Fleury worked as a truck driver 

which required him to visit various railyards in Illinois, including those owned by Union Pacific. 

To enter its facilities, Union Pacific required Fleury and others to provide biometric information 

through “identity verification kiosks.” Fleury alleges that Union Pacific failed to provide him or 

others with written disclosures describing the specific purpose and length of time that it would 

collect and store their biometric data. In addition, Fleury alleges that Union Pacific failed to 

Case: 1:20-cv-00390 Document #: 89 Filed: 06/02/22 Page 1 of 10 PageID #:649
2

develop retention or destruction policies governing the stored biometric data.

Fleury originally filed this case in the Circuit Court of Cook County. On January 17, 

2020, Union Pacific removed the case to the Northern District of Illinois. Fleury filed an 

amended complaint on June 16, 2020, that contains one general count for “Violations of the 

Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq,” although he specifies at 

various points throughout the complaint that Union Pacific violated sections 15(a), (b), (c), and 

(d) of BIPA. The Court previously entered an order staying discovery in this case pending certain 

state and federal appellate BIPA cases that would affect the scope of this case, both individually 

and on a proposed class basis. See [63].

Discussion

Fleury seeks to sever and remand his section 15(a) claim back to the Circuit Court of 

Cook County based on a lack of standing. He also asks the Court to lift the stay on proceedings. 

The Court addresses each motion in turn. 

I. Motion to Remand

Fleury argues that he lacks Article III standing to pursue his section 15(a) claim in federal 

court because he only alleges a procedural violation. Section 15(a) imposes on an entity 

collecting biometric information a duty to develop and publicly disclose retention schedules and 

guidelines for destroying the biometric data. This section further compels those entities to 

comply with their retention and destruction policies. The Court reproduces section 15(a) below:

A private entity in possession of biometric identifiers or biometric information 

must develop a written policy, made available to the public, establishing a 

retention schedule and guidelines for permanently destroying biometric identifiers 

and biometric information when the initial purpose for collecting or obtaining 

such identifiers or information has been satisfied or within 3 years of the 

individual’s last interaction with the private entity, whichever occurs first. Absent 

a valid warrant or subpoena issued by a court of competent jurisdiction, a private 

Case: 1:20-cv-00390 Document #: 89 Filed: 06/02/22 Page 2 of 10 PageID #:650
3

entity in possession of biometric identifiers or biometric information must comply 

with its established retention schedule and destruction guidelines. 740 ILCS 

14/15(a).

The party invoking federal jurisdiction, which in this case is Union Pacific as the 

removing party, bears the burden of establishing Article III standing. Collier v. SP Plus Corp., 

889 F.3d 894, 896 (7th Cir. 2018). To establish Article III standing, three requirements must be 

met: (1) the plaintiff must have suffered a concrete and particularized injury-in-fact; (2) there 

must be a causal connection between the plaintiff’s injury and the defendant’s conduct; and (3) 

the injury is likely to be redressed by a favorable judicial decision. Fox v. Dakkota Integrated 

Systems, LLC, 980 F.3d 1146, 1153 (7th Cir. 2020). Fleury challenges only the concrete and 

particularized injury factor. Before discussing it, however, the Court recaps three BIPA cases 

that inform the Court’s analysis. 

The first is Bryant v. Compass Group, USA, Inc., 958 F.3d 617 (7th Cir. 2020). In Bryant, 

the plaintiff’s employer installed “Smart Market” vending machines in its cafeteria. Id. at 619. 

To use these machines, a patron had to create an account using his or her fingerprint. Id. The 

plaintiff alleged that the defendant violated, among other provisions, section 15(a) by failing to 

publicly disclose its retention and destruction schedules. Id. The Seventh Circuit held that an 

entity owes the duty to disclose under section 15(a) to the public generally and not to specific 

persons whose biometric data it collects. Id. at 626. As a result, the court found that the plaintiff 

lacked Article III standing to bring a section 15(a) claim because she alleged only a procedural 

violation owed to the public and thus did not suffer a particularized injury. Id. Importantly, the 

Seventh Circuit understood the plaintiff to assert only that the defendant failed to make its 

retention and destruction policies publicly available. Id.

Case: 1:20-cv-00390 Document #: 89 Filed: 06/02/22 Page 3 of 10 PageID #:651
4

With respect to her section 15(b) claim, however, Bryant found that the plaintiff did 

allege a concrete and particularized injury because the failure to comply with the informedconsent provision in section 15(b) denied the plaintiff, and others like her, the “opportunity to 

consider whether the terms of that collection and usage were acceptable given the attendant 

risk.” Id. The court highlighted the Illinois General Assembly’s judgment that biometric 

information presents a particularly heightened risk of identity theft or other privacy or economic 

harm that can result from dissemination, such that people should be made aware of to whom and 

for what purpose they are giving up control of their biometric information. Id.

The second case is Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019). In Patel, the 

plaintiffs sued Facebook for BIPA violations based on its “Tag Suggestions” feature, which uses 

facial-recognition technology to detect whether an uploaded photo depicts a user’s Facebook 

friend. Id. at 1268. The plaintiffs alleged that Facebook failed to obtain their consent prior to 

collecting their biometric data and failed to maintain retention or destruction guidelines, thereby 

violating BIPA sections 15(a) and 15(b). Id. at 1274. The Ninth Circuit held that the users 

suffered a concrete and particularized injury based on these acts. Id. Patel reasoned that 

“[b]ecause the privacy right protected by BIPA is the right not to be subject to the collection and 

use of such biometric data, Facebook’s alleged violation of these statutory requirements would 

necessarily violate the plaintiffs’ substantive privacy interests.” Id.

Like Bryant, Patel relied on the Illinois General Assembly’s judgment that “[t]he public 

welfare, security, and safety [would][] be served by regulating the collection, use, safeguarding, 

handling, storage, retention, and destruction of biometric identifiers and information.” Id. at 1273 

(citing 740 Ill. Comp. Stat. 14/5(g)). Thus, the Ninth Circuit ruled that the plaintiffs had Article 

III standing to sue under sections 15(a) and (b) of BIPA. Id. at 1274. Though Patel is a 

Case: 1:20-cv-00390 Document #: 89 Filed: 06/02/22 Page 4 of 10 PageID #:652
5

nonprecedential decision from another circuit, the Seventh Circuit has cited it multiple times in 

its BIPA cases. See Bryant, 958 F.3d at 622; Fox, 980 F.3d at 1153.

Last is Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146 (7th Cir. 2020). In that 

case, the plaintiff alleged that her former employer violated section 15(a) by failing to comply 

with its own retention and destruction policies. Id. at 1150. The Seventh Circuit held that the 

plaintiff had standing to bring her section 15(a) claim because she alleged that the defendant 

violated the full panoply of duties in section 15(a), not just the duty to publicly disclose. Id. at 

1154-55. Notably, when distinguishing Fox from Bryant, the court recognized that section 15(a) 

places three independent duties upon entities collecting biometric data: a duty to develop, duty to 

publicly disclose, and duty to comply with its data retention and destruction policies. Id. at 1154. 

The court further explained that “unlawful retention of biometric data inflicts a privacy injury in 

the same sense as an unlawful collection does.” Id. The court noted that Bryant carefully

narrowed its holding to the duty to publicly disclose. Id. But the Fox court reached the duty to 

comply, analogizing a violation of this duty to the privacy injury resulting from unlawful 

collection under section 15(b). Id. at 1155.

In this case, Fleury argues that his section 15(a) claim should be severed and remanded 

because he alleges only a procedural violation—i.e., the duty to publicly disclose biometric data

retention and destruction policies. Union Pacific, on the other hand, argues that Fleury alleges 

that it failed to develop these policies in addition to unlawfully retaining his biometric data, 

thereby satisfying the particularized injury component.

The Court finds that the allegations in the First Amended Complaint rise to the level of a 

concrete and particularized injury for purposes of Article III standing. Unlike Bryant, Fleury 

alleges that Union Pacific failed to develop any data-retention or destruction policies

Case: 1:20-cv-00390 Document #: 89 Filed: 06/02/22 Page 5 of 10 PageID #:653
6

whatsoever—not just that it failed to publish them. The Court likens this to the particularized 

injury the Seventh Circuit found in Fox. To be sure, Fox addressed compliance with data 

retention and destruction policies, not the mere requirement to establish those policies. But Fox

also noted that “[t]he BIPA requirement to implement data retention and destruction protocols 

protects a person’s biometric privacy just as concretely as the statute’s informed-consent 

regime.” Id. at 1155. Flipping that around, the failure to develop retention and destruction 

policies once (or before) an entity begins retaining a person’s biometric data inflicts a privacy 

injury in the same way that unlawful collection does. 

Consequently, once an entity collects a person’s biometric data, the duty to develop 

retention and destruction policies becomes one that adheres to the person whose identifiers were

collected—much the same way the duty to comply with retention/destruction policies does. This 

makes the duty to develop particularized in a way that the duty to publicly disclose is not. The 

Court finds that this approach best reflects the Seventh Circuit’s holdings in Fox and Bryant and 

aligns with the way other judges in this circuit view the issue. See Kalb v. GardaWorld Cashlink 

LLC, Case No. 21-cv-1092, 2021 WL 1668036, at *3-4 (C.D. Ill. April 28, 2021); Marsh v. CLS 

Plasma, Inc., 503 F. Supp. 3d 677, 681-83 (N.D. Ill. 2020); but cf. Cottingham v. The Ultimate 

Software Group, Inc., 20-cv-1172, Dkt. 26, at pg. 6 (C.D. Ill. May 25, 2021) (noting minor 

distinction in how Bryant and Fox frame the section 15(a) duties).

And in this case, Fleury alleges that Union Pacific failed to develop retention/destruction 

policies while still retaining his and others’ biometric data. The Court finds these allegations 

sufficient to establish Article III standing. 

Fleury also argues that he does not have Article III standing to pursue his section 15(a) 

claim in federal court because he continues to access Union Pacific’s railyards and, therefore, the 

Case: 1:20-cv-00390 Document #: 89 Filed: 06/02/22 Page 6 of 10 PageID #:654
7

continued retention of his biometric data is not unlawful given that the initial purpose for 

collecting his identifiers has not been satisfied, nor has 3 years elapsed since his last interaction 

with Union Pacific.0F

1

The Court does not read the statute this way. Indeed, it makes little sense to read BIPA 

this way because such a reading would contradict the proactive approach to biometric data 

collection and retention that the General Assembly sought when it enacted BIPA. Rather, the 

Court reads the phrase “...when the initial purpose for collecting or obtaining such identifiers or 

information has been satisfied or within 3 years of the individual’s last interaction with the 

private entity, whichever occurs first” to explain what the policies must describe—not to create a 

time frame within which these policies must be developed. Put differently, BIPA requires that 

the policies describe what happens to an individual’s biometric data after the initial purpose is 

completed or three years after the last interaction, but it does not say when those policies must be 

created. See also Namuwonge v. Kronos, Inc., 418 F. Supp. 3d 279, 284 (N.D. Ill. 2019) 

(recognizing that the BIPA statute does not explicitly address timing for when the written policy 

should be formulated).

At minimum, the statute imposes the duty to develop these policies as soon as the entity 

possesses the biometric data. See 740 ILCS 14/15(a) (“A private entity in possession of biometric 

identifiers or biometric information must develop a written policy...”) (emphasis added). Based 

on the allegations, Union Pacific owed Fleury this duty to develop as soon as it possessed his 

biometric information. For those reasons, the Court denies the motion to remand.

1 Fleury’s interpretation appears to concede that Union Pacific does not owe him a current duty to develop 

or publish retention and destruction policies. If the duty to develop arises only after the initial purpose is 

satisfied or three years after the last contact, then Union Pacific owes Fleury no duty and he would not be 

able to win on the merits of his claim. See, e.g., Hazlitt v. Apple Inc., 543 F.Supp.3d 643, 649-50 (S.D. Ill. 

2021) (addressing similar argument). In any event, the Court need not reach that merits issue to resolve 

the motion to remand.

Case: 1:20-cv-00390 Document #: 89 Filed: 06/02/22 Page 7 of 10 PageID #:655
8

II. Motion to Lift Stay

Next, the Court addresses the motion to stay. Fleury asks the Court to lift the stay arguing 

that it is no longer needed. For its part, Union Pacific argues that a stay is still appropriate for the 

same reasons articulated in its prior briefing. 

A court has the “inherent power to stay proceedings and ‘to control the disposition of the

causes on its docket with economy of time and effort for itself, for counsel, and for litigants.’”

Stone v. I.N.S., 514 U.S. 386, 411 (1995) (quoting Landis v. N. Am. Co., 299 U.S. 248, 254

(1936)). Orders staying proceedings must both be “[]moderate” and within “reasonable limits.”

Landis, 299 U.S. at 257. In evaluating a motion to stay, courts consider whether the stay will: (1)

simplify the issues in question and streamline the trial, (2) reduce the burden of litigation on the 

parties and on the court, and (3) unduly prejudice or tactically disadvantage the nonmoving 

party. Burnett. Ocwen Loan Servicing, LLC, Case No. 17-cv-3474, 2017 WL 5171226, at *2 

(N.D. Ill. Nov. 8, 2017) “The proponent of a stay bears the burden of establishing its need.” 

Clinton v. Jones, 520 U.S. 681, 708 (1997).

The Court previously stayed discovery in this case pending appellate decisions in Tims v. 

Black Horse Carriers, Inc., No. 1-28-0563 (Ill. App. Ct., 1st Dist.); Marion v. Ring Container 

Technologies, LLC, No. 3-20-0184 (Ill. App. Ct., 3rd Dist.); and Cothron v. White Castle Sys., 

Inc., Case No. 20-3202 (7th Cir.). See [63]. Tims and Marion, Illinois Appellate Court cases, 

considered whether a one-year, two-year, or five-year statute of limitations applies to BIPA 

claims. See Tims v. Black Horse Carriers, Inc., No. 1-20-0562; Marion v. Ring Container Techs., 

LLC, No. 3-20-0184; see also Herron v. Gold Standard Banking, Inc., No. 20-cv-07469, 2021 

WL 1340804, at *2 (N.D. Ill. April 9, 2021). Relatedly, Cothron, a Seventh Circuit case, 

addresses when a BIPA claim accrues and, more precisely, if a private entity violates BIPA only 

Case: 1:20-cv-00390 Document #: 89 Filed: 06/02/22 Page 8 of 10 PageID #:656
9

when it first collects or discloses an individual’s biometric data without making the required 

disclosures, or if a violation occurs each time the entity collects or discloses the data. See 

Cothron v. White Castle Sys., Inc., No. 19-cv-00382, Dkt. 141 (N.D. Ill. Oct. 1, 2020). 

On September 17, 2021, the First District issued a decision in Tims, holding that a fiveyear statute of limitations applies to section 15(a) and 15(b) claims. But the Illinois Supreme 

Court allowed leave to appeal in Tims. See [81-2]. On March 19, 2021, the Illinois Third District 

Appellate Court stayed Marion pending the Illinois Supreme Court’s decision in McDonald v. 

Symphony Bronzeville Park LLC, No. 126511. The Illinois Supreme Court issued a decision in 

McDonald on February 3, 2022. On December 20, 2021, the Seventh Circuit certified the claim 

accrual question in Cothron to the Illinois Supreme Court.

Looking to the factors, the Court finds that a stay is no longer necessary. While the 

simplicity factor weighs in favor of continuing the stay, the remaining factors weigh in the 

opposite direction and outweigh that factor. The First District has issued a decision in Tims, 

which gives enough guidance for this case. Moreover, the Court agrees with Fleury that the 

prejudice to plaintiff continues to grow the longer this case sits. No doubt, the law as it relates to 

BIPA cases will continue to evolve. But that is not, in the Court’s view, a sufficient reason to 

continue staying this case. It is time for this case to move forward. Moreover, at this point, the 

Illinois Appellate Court and Illinois Supreme Court are likely to issue decisions in Tims, Marion, 

and Cothron before any dispositive motions or class certification motions arise in this case.

Accordingly, the Court grants Fleury’s motion to lift the stay. 

Conclusion

The motion to remand [68] is denied. The motion to lift the stay on proceedings [78] is 

granted. Fact discovery shall be completed by September 30, 2022. The Court previously entered 

Case: 1:20-cv-00390 Document #: 89 Filed: 06/02/22 Page 9 of 10 PageID #:657
10

a referral to the Magistrate Judge for discovery supervision and settlement (if requested). The 

Court will continue to monitor the docket and set further hearing dates as necessary. 

SO ORDERED. ENTERED: June 2, 2022

 ______________________ 

HON. JORGE ALONSO

United States District Judge

Case: 1:20-cv-00390 Document #: 89 Filed: 06/02/22 Page 10 of 10 PageID #:658