95346

IN THE UNITED STATES DISTRICT COURT

FOR THE NORTHERN DISTRICT OF ILLINOIS

EASTERN DIVISION

DEPAUL TURNER, individually and on behalf

of himself all others similarly situated,

Plaintiff,

v.

CROTHALL HEALTHCARE, INC.,

Defendant.

)

)

)

)

)

)

)

)

)

)

Case No. 20-cv-3026

CLASS ACTION COMPLAINT

Plaintiff DePaul Turner, individually and on behalf of all other persons similarly situated,

by his undersigned attorneys, as and for his Class Action Complaint for violations of the Illinois

Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1 et seq., against Defendant Crothall

Healthcare, Inc., (“Crothall” or “Defendant”), alleges on personal knowledge, due investigation of

his counsel, and, where indicated, on information and belief as follows:

NATURE OF THE ACTION

1. Plaintiff brings this action for damages and other legal and equitable remedies

resulting from the illegal actions of Defendant in collecting, storing and using his and other

similarly situated individuals’ biometric identifiers1 and/or biometric information2 (referred to

collectively at times as “biometrics”) without obtaining informed written consent or providing the

requisite data retention and destruction policies, in direct violation of BIPA.

1 A “biometric identifier” is any personal feature that is unique to an individual, including

fingerprints, iris scans, DNA and “face geometry”, among others.

2

“Biometric information” is any information captured, converted, stored or shared based on a

person’s biometric identifier used to identify an individual.

Case: 1:20-cv-03026 Document #: 1 Filed: 05/21/20 Page 1 of 15 PageID #:1
95346

- 2 -

2. The Illinois Legislature has found that “[b]iometrics are unlike other unique

identifiers that are used to access finances or other sensitive information.” 740 ILCS 14/15(c). “For

example, social security numbers, when compromised, can be changed. Biometrics, however, are

biologically unique to the individual; therefore, once compromised, the individual has no recourse,

is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated

transactions.” Id.

3. In recognition of these concerns over the security of individuals’ biometrics the

Illinois Legislature enacted BIPA, which provides, inter alia, that a private entity like Defendant

may not obtain and/or possess an individual’s biometrics unless it informs that person in writing

that biometric identifiers or information will be collected or stored. See 740 ILCS 14/15(b).

4. The BIPA further requires that entities collecting biometrics must inform those

persons in writing of the specific purpose and length of term for which such biometric identifiers

or biometric information are being collected, stored and used. See id.

5. Moreover, entities collecting biometrics must publish publicly available written

retention schedules and guidelines for permanently destroying biometrics collected. See 740 ILCS

14/15(a).

6. Further, the entity must store, transmit and protect an individual’s biometric

identifiers and biometric information using the same standard of care in the industry and in a

manner at least as protective as the means used to protect other confidential and sensitive

information. See 740 ILCS 14/15(c).

7. Finally, the entity is expressly prohibited from selling, leasing, trading or otherwise

profiting from an individual’s biometrics. See 740 ILCS 15/15(c).

Case: 1:20-cv-03026 Document #: 1 Filed: 05/21/20 Page 2 of 15 PageID #:2
95346

- 3 -

8. In direct violation of each of the foregoing provisions of §§ 15(a) and 15(b) of

BIPA, Defendant collected, stored and used–without first providing notice, obtaining informed

written consent or publishing data retention policies–the fingerprints and associated personally

identifying information of hundreds of its employees (and former employees), who are being

required to “clock in” with their fingerprints.

9. This practice of requiring employees to “clock in” using their fingerprints was in

place at least since approximately November 2019.

10. Plaintiff left Defendant’s employ in approximately March 2020 and was “clocking

in” using his fingerprints during his tenure of employment with Defendant.

11. If Defendant’s database of digitized fingerprints were to fall into the wrong hands,

by data breach or otherwise, the employees to whom these sensitive and immutable biometric

identifiers and/or biometric information belong could have their identities stolen, among other

serious issues.

12. BIPA confers on Plaintiff and all other similarly situated Illinois residents a right

to know of such risks, which are inherently presented by the collection and storage of biometrics,

and a right to know how long such risks will persist after termination of their employment.

13. But despite that BIPA has been the law for more than a decade, Defendant never

adequately informed Plaintiff or the Class of its biometrics collection practices, never obtained the

requisite written consent from Plaintiff or the Class regarding its biometric practices, and never

provided any data retention or destruction policies to Plaintiff or the Class.

14. Plaintiff brings this action to prevent Defendant from further violating the privacy

rights of Illinois residents and to recover statutory damages for Defendant’s unauthorized

collection, storage and use of these individuals’ biometrics in violation of BIPA.

Case: 1:20-cv-03026 Document #: 1 Filed: 05/21/20 Page 3 of 15 PageID #:3
95346

- 4 -

PARTIES

15. Plaintiff is, and has been at all relevant times, a resident and citizen of Illinois.

16. Defendant Crothall Healthcare, Inc. is a Delaware corporation whose principal

place of business is located in Wayne, Pennsylvania.

JURISDICTION AND VENUE

17. This Court has subject matter jurisdiction under 28 U.S.C. § 1332(d)(2). The matter

in controversy exceeds the sum or value of $5,000,000, exclusive of interest and costs, and is a

class action in which at least one of the class members of the proposed class of plaintiffs is a citizen

of a State different from Defendant within the meaning of 28 U.S.C. § 1332(d).

18. This Court has personal jurisdiction over Defendant because the conduct that gave

rise to this lawsuit occurred in this District. Specifically, Defendant collected, stored, and used

Plaintiff’s and the Class’s biometrics at its facility in Harvey, Illinois, which is situated in this

District.

19. Venue is proper pursuant to 28 U.S.C. § 1391 because a substantial part of the acts

and omissions underlying Plaintiff’s claims occurred in Harvey, Illinois. See 28 U.S.C. §

1331(b)(2).

FACTUAL BACKGROUND

I. Illinois’ Biometric Information Privacy Act.

20. In 2008, Illinois enacted BIPA due to the “very serious need [for] protections for

the citizens of Illinois when it [comes to their] biometric information.” Illinois House Transcript,

2008 Reg. Sess. No. 276. BIPA makes it unlawful for a company to, inter alia, “collect, capture,

purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric

identifiers and/or biometric information, unless it first:

Case: 1:20-cv-03026 Document #: 1 Filed: 05/21/20 Page 4 of 15 PageID #:4
95346

- 5 -

(1) informs the subject...in writing that a biometric identifier or biometric

information is being collected or stored;

(2) informs the subject...in writing of the specific purpose and length of

term for which a biometric identifier or biometric information is being collected,

stored, and used; and

(3) receives a written release executed by the subject of the biometric

identifier or biometric information or the subject’s legally authorized

representative.”

740 ILCS 14/15 (b).

21. Section 15(a) of BIPA also provides:

A private entity in possession of biometric identifiers or biometric information must

develop a written policy, made available to the public, establishing a retention

schedule and guidelines for permanently destroying biometric identifiers and

biometric information when the initial purpose for collecting or obtaining such

identifiers or information has been satisfied or within 3 years of the individual’s

last interaction with the private entity, whichever occurs first.

740 ILCS 14/15(a).

22. As alleged below, Defendant’s practices of collecting, storing and using

individuals’ biometric identifiers (specifically, fingerprints) and associated biometric information

without informed written consent violated all three prongs of § 15(b) of BIPA. Defendant’s failure

to provide a publicly available written policy regarding their schedule and guidelines for the

retention and permanent destruction of individuals’ biometric identifiers and biometric

information also violated § 15(a) of BIPA.

II. Defendant Violates Illinois’ Biometric Information Privacy Act.

23. Unbeknown to the average person, and in direct violation of § 15(b)(1) of BIPA,

Defendant scanned and collected, and then indefinitely stored in an electronic database, digital

copies of each employee’s fingerprints during the employee onboarding process from at least

approximately November 2019 to at least approximately March 2020, and on each occasion an

Case: 1:20-cv-03026 Document #: 1 Filed: 05/21/20 Page 5 of 15 PageID #:5
95346

- 6 -

employee clocks in or out of one of Defendant’s Illinois-based facility – all without ever informing

anyone of this practice in writing.

24. In direct violation of §§ 15(b)(2) and 15(b)(3) of BIPA, from at least approximately

November 2019 to at least approximately March 2020, Defendant never informed Illinois

employees who had their fingerprints collected of the specific purpose and length of time for which

their biometric identifiers or information would be collected, stored and used, nor did Defendant

obtain a written release from these individuals.

25. In direct violation of § 15(a) of BIPA, from at least March 2020, Defendant did not

have written, publicly available policies identifying its retention schedules or guidelines for

permanently destroying any of these biometric identifiers or biometric information.

III. Plaintiff DePaul Turner’s Experience.

26. Plaintiff began working for Defendant in or around November 2019.

27. During the course of Plaintiff’s employment, Defendant required Plaintiff to place

his fingers on a fingerprint scanner, at which point Defendant scanned and collected, and stored in

an electronic database, digital copies of Plaintiff’s fingerprints.

28. Plaintiff worked for Defendant until approximately March 2020. During his

employment tenure, Plaintiff was required to place his fingers on a fingerprint scanner, which

scanned, collected and stored his fingerprints each time he “clocked” in and out as part of the

timekeeping system.

29. Then, Defendant’s fingerprint matching technology compared Plaintiff’s scanned

fingerprint against the fingerprint previously stored in Defendant’s fingerprint database.

30. On each occasion of “clocking in,” Plaintiff was granted access to Defendant’s

facility in order to begin work.

Case: 1:20-cv-03026 Document #: 1 Filed: 05/21/20 Page 6 of 15 PageID #:6
95346

- 7 -

31. Plaintiff never consented, agreed or gave permission–written or otherwise–to

Defendant for the collection or storage of his unique biometric identifiers and/or biometric

information.

32. Further, Defendant never provided Plaintiff with nor did he ever sign a written

release allowing Defendant to collect or store his unique biometric identifiers and/or biometric

information.

33. Likewise, Defendant never provided Plaintiff with the requisite statutory

disclosures nor an opportunity to prohibit or prevent the collection, storage or use of his unique

biometric identifiers and/or biometric information.

34. By collecting Plaintiff’s unique biometric identifiers and/or biometric information

without his consent, written or otherwise, Defendant invaded Plaintiff’s statutorily protected right

to privacy in his biometrics.

35. Finally, Defendant never provided Plaintiff with a retention schedule and/or

guideline for permanently destroying his biometric identifiers and/or biometric information.

36. Defendant’s acts and omissions denied Plaintiff the opportunity to consider whether

the terms of Defendant’s collection, storage, and usage of his biometric identifiers and/or biometric

information were acceptable given the attendant risks, and denied him the ability to use the

undisclosed information in the way BIPA envisioned, all of which harmed his concrete interests

that the legislature sought to protect by enacting BIPA.

CLASS ALLEGATIONS

37. Class Definition: Plaintiff brings this action pursuant to 735 ILCS 5/2-801 on

behalf of a class of similarly situated individuals, defined as follows (the “Class”):

All individuals who, while residing in the State of Illinois, had their fingerprints

collected, captured, received or otherwise obtained and/or stored by Defendant.

Case: 1:20-cv-03026 Document #: 1 Filed: 05/21/20 Page 7 of 15 PageID #:7
95346

- 8 -

38. Plaintiff represents and is a member of the Class. Excluded from the Class are

Defendant and any entities in which Defendant has a controlling interest, Defendant’s employees

and agents, the Judge to whom this action is assigned, and any member of the Judge’s staff and

immediate family.

39. Plaintiff and all members of the Class have been harmed by Defendant’s acts and

omissions.

40. Defendant’s acts and omissions denied the Class the opportunity to consider

whether the terms of Defendant’s collection, storage, and usage of their biometric identifiers and/or

biometric information were acceptable given the attendant risks, and denied them the ability to use

the undisclosed information in the way BIPA envisioned, all of which harmed their concrete

interests that the legislature sought to protect by enacting BIPA.

41. Numerosity: The number of persons within the Class is substantial and includes

hundreds of persons. It is, therefore, impractical to join each member of the Class as a named

Plaintiff. Further, the size and relatively modest value of the claims of the individual members of

the Class renders joinder impractical. Accordingly, utilization of the class action mechanism is the

most economically feasible means of determining and adjudicating the merits of this litigation.

Moreover, the Class is ascertainable and identifiable from Defendant’s and/or third-parties’

records.

42. Commonality and Predominance: There are well-defined common questions of

fact and law that exist as to all members of the Class and that predominate over any questions

affecting only individual members of the Class. These common legal and factual questions, which

do not vary from Class member to Class member, and which may be determined without reference

to the individual circumstances of any Class Member, include, but are not limited to, the following:

Case: 1:20-cv-03026 Document #: 1 Filed: 05/21/20 Page 8 of 15 PageID #:8
95346

- 9 -

(a) whether Defendant collected or otherwise obtained Plaintiff’s and the

Class’s biometric identifiers and/or biometric information;

(b) whether Defendant properly informed Plaintiff and the Class that it

collected, used, and stored their biometric identifiers and/or biometric

information;

(c) whether Defendant obtained a written release (as defined in 740 ILCS

1410) to collect, use, and store Plaintiff’s and the Class’s biometric

identifiers and/or biometric information;

(d) whether Defendant developed a written policy, made available to the

public, establishing a retention schedule and guidelines for permanently

destroying biometric identifiers and biometric information when the

initial purpose for collecting or obtaining such identifiers or information

has been satisfied or within 3 years of their last interaction, whichever

occurs first;

(e) whether Defendant used Plaintiff’s and the Class’s biometric identifiers

and/or biometric information to identify them; and

(f) whether Defendant’s violations of BIPA were committed intentionally,

recklessly, or negligently.

43. Typicality: As a person whose biometric identifiers and/or biometric information

Defendant collected, stored, and used without first providing notice, obtaining informed written

consent, and publishing the required data retention policy, Plaintiff asserts claims that are typical

of the Class.

44. Adequate Representation: Plaintiff has retained and is represented by qualified

and competent counsel who are highly experienced in complex consumer class action litigation.

Plaintiff and his counsel are committed to vigorously prosecuting this class action. Moreover,

Plaintiff is able to fairly and adequately represent and protect the interests of such a Class. Neither

Plaintiff nor his counsel has any interest adverse to, or in conflict with, the interests of the absent

members of the Class. Plaintiff has raised viable statutory claims or the type reasonably expected

to be raised by members of the Class, and will vigorously pursue those claims. If necessary,

Case: 1:20-cv-03026 Document #: 1 Filed: 05/21/20 Page 9 of 15 PageID #:9
95346

- 10 -

Plaintiff may seek leave of this Court to amend this Class Action Complaint to include additional

Class representatives to represent the Class, additional claims as may be appropriate, or to amend

the Class definition to address any steps that Defendant took.

45. Superiority: A class action is superior to other available methods for the fair and

efficient adjudication of this controversy because individual litigation of the claims of all Class

members is impracticable. Even if every member of the Class could afford to pursue individual

litigation, the Court system could not. It would be unduly burdensome to the courts in which

individual litigation of numerous cases would proceed. Individualized litigation would also present

the potential for varying, inconsistent or contradictory judgments, and would magnify the delay

and expense to all parties and to the court system resulting from multiple trials of the same factual

issues. By contrast, the maintenance of this action as a class action, with respect to some or all of

the issues presented herein, presents few management difficulties, conserves the resources of the

parties and of the court system and protects the rights of each member of the Class. Plaintiff

anticipates no difficulty in the management of this action as a class action. Class-wide relief is

essential to compliance with BIPA.

COUNT I – FOR DAMAGES AGAINST DEFENDANT

VIOLATION OF 740 ILCS 14/15(a) – FAILURE TO INSTITUTE, MAINTAIN, AND ADHERE TO

PUBLICLY AVAILABLE RETENTION SCHEDULE

46. Plaintiff incorporates the foregoing allegations as if fully set forth herein.

47. BIPA mandates that companies in possession of biometric data establish and

maintain a satisfactory biometric data retention – and, importantly, deletion – policy. Specifically,

those companies must: (i) make publicly available a written policy establishing a retention

schedule and guidelines for permanent deletion of biometric data (at most three years after the

Case: 1:20-cv-03026 Document #: 1 Filed: 05/21/20 Page 10 of 15 PageID #:10
95346

- 11 -

company’s last interaction with the individual); and (ii) actually adhere to that retention schedule

and actually delete the biometric information. See 740 ILCS 14/15(a).

48. Defendant failed to comply with these BIPA mandates.

49. Defendant is a company registered to do business in Illinois and thus qualifies as a

“private entity” under BIPA. See 740 ILCS 14/10.

50. Plaintiff is an individual who had his “biometric identifiers” captured and/or

collected by Defendant, as explained in detail in above. See 740 ILCS 14/10.

51. Plaintiff’s biometric identifiers were used to identify Plaintiff and, therefore,

constitute “biometric information” as defined by BIPA. See 740 ILCS 14/10.

52. Defendant failed to provide a publicly available retention schedule or guidelines

for permanently destroying biometric identifiers and biometric information as specified by BIPA.

See 740 ILCS 14/15(a).

53. Upon information and belief, Defendant lacked retention schedules and guidelines

for permanently destroying Plaintiff’s and the Class’s biometric data and have not and will not

destroy Plaintiff’s and the Class’s biometric data when the initial purpose for collecting or

obtaining such data has been satisfied or within three years of the individual’s last interaction with

the company.

54. On behalf of himself and the Class, Plaintiff seeks: (1) declaratory relief; (2)

injunctive and equitable relief as is necessary to protect the interests of Plaintiff and the Class by

requiring Defendant to comply with BIPA’s requirements for the collection, capture, storage, and

use of biometric identifiers and biometric information as described herein; (3) statutory damages

of $5,000 for each intentional and/or reckless violation of BIPA pursuant to 740 ILCS 14/20(2) or,

in the alternative, statutory damages of $1,000 for each negligent violation of BIPA pursuant to

Case: 1:20-cv-03026 Document #: 1 Filed: 05/21/20 Page 11 of 15 PageID #:11
95346

- 12 -

740 ILCS 14/20(1); and (4) reasonable attorneys’ fees and costs and other litigation expenses

pursuant to 740 ILCS 14/20(3).

COUNT II – FOR DAMAGES AGAINST DEFENDANT

VIOLATION OF 740 ILCS 14/15(b) – FAILURE TO OBTAIN INFORMED WRITTEN CONSENT AND

RELEASE BEFORE OBTAINING BIOMETRIC IDENTIFIERS OR INFORMATION

55. Plaintiff incorporates the foregoing allegations as if fully set forth herein.

56. BIPA requires companies to obtain informed written consent from employees

before acquiring their biometric data. Specifically, BIPA makes it unlawful for any private entity

to “collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s

biometric identifiers or biometric information unless [the entity] first: (1) informs the subject...in

writing that a biometric identifier or biometric information is being collected or stored; (2) informs

the subject...in writing of the specific purpose and length of term for which a biometric identifier

or biometric information is being collected, stored, and used; and (3) receives a written release

executed by the subject of the biometric identifier or biometric information...” 740 ILCS 14/15(b)

(emphasis added).

57. Defendant failed to comply with these BIPA mandates.

58. Defendant is a company registered to do business in Illinois and thus qualifies as a

“private entity” under BIPA. See 740 ILCS 14/10.

59. Plaintiff and the Class are individuals who have had their “biometric identifiers”

collected and/or captured by Defendant, as explained in detail above. See 740 ILCS 14/10.

60. Plaintiff’s and the Class’s biometric identifiers were used to identify them and,

therefore, constitute “biometric information” as defined by BIPA. See 740 ILCS 14/10.

Case: 1:20-cv-03026 Document #: 1 Filed: 05/21/20 Page 12 of 15 PageID #:12
95346

- 13 -

61. Defendant systematically and automatically collected, captured, used, and stored

Plaintiff’s and the Class’s biometric identifiers and/or biometric information without first

obtaining the written release required by 740 ILCS 14/15(b)(3).

62. Defendant never informed Plaintiff, and never informed any member of the Class

at least prior to June 2019, in writing that their biometric identifiers and/or biometric information

were being collected, captured, stored, and/or used, nor did Defendant inform Plaintiff and the

Class in writing of the specific purpose(s) and length of term for which their biometric identifiers

and/or biometric information were being collected, stored, used and disseminated as required by

740 ILCS 14/15(b)(1)-(2).

63. By collecting, capturing, storing, and/or using Plaintiff’s and the Class’s biometric

identifiers and/or biometric information as described herein, Defendant violated Plaintiff’s and the

Class’s rights to privacy in their biometric identifiers and/or biometric information as set forth in

BIPA. See 740 ILCS 14/1, et seq.

64. On behalf of himself and the Class, Plaintiff seeks: (1) declaratory relief; (2)

injunctive and equitable relief as is necessary to protect the interests of Plaintiff and the Class by

requiring Defendant to comply with BIPA’s requirements for the collection, captures, storage, use

and dissemination of biometric identifiers and biometric information as described herein; (3)

statutory damages of $5,000 for each intentional and/or reckless violation of BIPA pursuant to 740

ILCS 14/20(2) or, in the alternative, statutory damages of $1,000 for each negligent violation of

BIPA pursuant to 740 ILCS 14/20(1); and (4) reasonable attorneys’ fees and costs and other

litigation expenses pursuant to 740 ILCS 14/20(3).

Case: 1:20-cv-03026 Document #: 1 Filed: 05/21/20 Page 13 of 15 PageID #:13
95346

- 14 -

PRAYER FOR RELIEF

WHEREFORE, Plaintiff DePaul Turner, on behalf of himself and the proposed Class,

respectfully requests that this Court enter an Order:

A. Certifying this case as a class action on behalf of the Class defined above,

appointing Plaintiff as representative of the Class, and appointing his counsel as

Class Counsel;

B. Declaring that Defendant’s actions, as set out above, violate BIPA, 740 ILCS 14/1,

et seq.;

C. Awarding statutory damages of $5,000.00 for each and every intentional and/or

reckless violation of BIPA pursuant to 740 ILCS 14/20(2), or alternatively,

statutory damages of $1,000.00 for each and every violation pursuant to 740 ILCS

14/20(1) if the Court finds that Defendant’s violations were negligent;

D. Awarding injunctive and other equitable relief as is necessary to protect the

interests of the Class, including, inter alia, an Order requiring Defendant to collect,

store, and use biometric identifiers and/or biometric information in compliance

with BIPA;

E. Awarding Plaintiff and the Class their reasonable attorneys’ fees and costs and

other litigation expenses pursuant to 740 ILCS 14/20(3);

F. Awarding Plaintiff and the Class pre- and post-judgment interest, to the extent

allowable; and

G. Awarding such other and further relief as equity and justice may require.

JURY DEMAND

Plaintiff, individually and on behalf of all others similarly situated, hereby demands a trial

by jury on all issues so triable.

Case: 1:20-cv-03026 Document #: 1 Filed: 05/21/20 Page 14 of 15 PageID #:14
95346

Dated: May 21, 2020 Respectfully submitted,

DEPAUL TURNER, individually and on behalf of

all others similarly situated,

By: /s/ Gregg M. Barbakoff

Keith J. Keogh

Gregg M. Barbakoff

KEOGH LAW, LTD.

55 W. Monroe St., Suite 3390

Chicago, Illinois 60603

Tel.: (312) 726-1092

Fax: (312) 726-1093

keith@keoghlaw.com

gbarbakoff@keoghlaw.com

Attorneys for Plaintiff and the Putative Class

Case: 1:20-cv-03026 Document #: 1 Filed: 05/21/20 Page 15 of 15 PageID #:15