1 

IN THE UNITED STATES DISTRICT COURT FOR THE

NORTHERN DISTRICT OF ILLINOIS, EASTERN DIVISION

DAVID FLEURY and CHRISTOPHER 

NUNNERY individually and on behalf of a 

class of similarly situated individuals,

Plaintiffs, 

v. 

UNION PACIFIC RAILROAD COMPANY, 

a Delaware Corporation,

Defendant. 

)

) 

) 

) 

) 

) 

) 

) 

) 

) 

) 

) 

)

Case No. 20-cv-00390 

Hon. Jorge L. Alonso 

Magistrate Jeffrey Cole

SECOND AMENDED CLASS ACTION COMPLAINT 

Plaintiffs David Fleury and Christopher Nunnery (“Plaintiffs”), individually and on behalf 

of other similarly situated individuals, bring this Second Amended Class Action Complaint against 

Defendant Union Pacific Railroad Company (“Union Pacific” or “Defendant”) for its violations of 

the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (“BIPA”), and to obtain 

redress for all persons injured by Defendant’s conduct. Plaintiffs allege as follows based on 

personal knowledge as to their own acts and experiences, and as to all other matters, upon 

information and belief, including an investigation conducted by their attorneys.

INTRODUCTION

1. BIPA defines a “biometric identifier” as any personal feature that is unique to an 

individual, including fingerprints and hand geometry. 740 ILCS 14/10. “Biometric information” 

is any information based on a biometric identifier, regardless of how it is converted or stored. 

Collectively, biometric identifiers and biometric information are known and referred to herein as 

“biometrics.” Id. 

Case: 1:20-cv-00390 Document #: 135 Filed: 03/20/23 Page 1 of 13 PageID #:1184
2 

2. Defendant is one of the largest freight railroad networks and railroad operators in 

North America.

3. Defendant requires truck drivers who visit its facilities located in Illinois, including 

Plaintiffs, to provide their biometric identifiers in the form of fingerprints and their related 

biometric information in order to access to such facilities on subsequent visits. 

4. The unique nature of biometrics allows private entities such as Defendant to gather 

an accurate “signature” of visitors to its facilities. 

5. BIPA provides, inter alia, that a private entity, such as Defendant, may not collect, 

capture, purchase, receive through trade, or otherwise obtain an individual’s biometric identifiers, 

such as fingerprints and hand scans, or any biometric information, including any data regardless 

of the manner it is converted or stored, unless it first:

a. informs that person in writing that biometric identifiers or biometric information 

will be collected or stored;

b. informs that person in writing of the specific purpose and the length of term for 

which such biometric identifiers or biometric information is being collected, stored 

and used; and 

c. receives a written release from the person for the collection of their biometric 

identifiers or biometric information.

740 ILCS 14/15(b)(1)-(3). 

6. Indeed, “biometrics are unlike other unique identifiers that are used to access 

finances or other sensitive information,” (740 ILCS 14/5), and therefore require special treatment 

compared to traditional private personal information. For example, even sensitive information like 

Social Security numbers, when compromised, can be changed. “Biometrics, however, are 

Case: 1:20-cv-00390 Document #: 135 Filed: 03/20/23 Page 2 of 13 PageID #:1185
3

biologically unique to each individual and therefore, once compromised, such individual has no 

recourse, is at a heightened risk for identity theft in, and is likely to withdraw from biometric 

facilitated transactions.” 740 ILCS 14/5.

7. Furthermore, BIPA requires private entities that possess biometrics to publish a 

publicly-available written policy outlining the retention schedule and destruction guidelines for

such biometrics. 750 ILCS 14/15(a).

8. Private entities are also prohibited from disclosing an individual’s biometrics to 

third parties without informed consent. 740 ILCS 14/15(d).

9. Plaintiffs bring this action for statutory damages and other remedies as a result of 

Defendant’s conduct in violating their biometric privacy rights under BIPA.

10. Compliance with BIPA is straightforward and minimally burdensome. The 

necessary disclosures and consent may be accomplished through a single signed sheet of paper or 

its electronic equivalent.

11. BIPA’s requirements bestow a right to privacy in biometrics and a right to make an 

informed decision when individuals determine whether they will provide or withhold their 

biometrics. 

12. On behalf of themselves and the proposed Class defined below, Plaintiffs seek an 

award of statutory damages to the Class members in an amount to be determined at trial, together 

with costs and reasonable attorneys’ fees, and an injunction requiring Defendant to comply with 

BIPA.

Case: 1:20-cv-00390 Document #: 135 Filed: 03/20/23 Page 3 of 13 PageID #:1186
4

PARTIES

13. Defendant is a Delaware company that conducts, and is licensed by the Illinois 

Secretary of State to conduct, business in Illinois. Defendant is headquartered in Nebraska and 

conducts business throughout Illinois and Cook County. 

14. At all relevant times, Plaintiffs have been residents and citizens of the state of 

Illinois and visited Defendant’s facilities in Illinois, including within this District. 

JURISDICTION AND VENUE

15. This Court has subject matter jurisdiction over the majority of this matter pursuant 

to the Class Action Fairness Act, 28 U.S.C. §1322(d) et seq., because this case is a class action in 

which the amount in controversy exceeds the sum or value of $5,000,000.00 exclusive of interest 

and costs; there are greater than 100 putative class members; at least one putative class member is 

a citizen of a state other than Defendant’s states of citizenship; and none of the exceptions under 

subsection 1332(d) apply to this instant action.

16. Plaintiffs maintain that the Court does not have subject matter jurisdiction over 

Plaintiffs’ claims brought under Section 15(a) of BIPA.

17. This Court may assert personal jurisdiction over Defendant because it conducts 

substantial business throughout Illinois, including in this District. 

FACTS SPECIFIC TO PLAINTIFFS 

18. During the relevant time period, Plaintiffs worked as non-union truck drivers for 

third-party companies. 

19. In their work as truck drivers, Plaintiffs visited Illinois railyards owned and 

operated by Defendant. At Defendant’s Illinois facilities, Plaintiffs were required to register their

Case: 1:20-cv-00390 Document #: 135 Filed: 03/20/23 Page 4 of 13 PageID #:1187
5

biometrics into biometrically-enabled “kiosks,” which are part of “Auto-Gate Systems” that 

partially control ingress at Defendant’s facilities.

20. Using its Auto-Gate Systems, Defendant collected, captured, received through 

trade, or otherwise obtained biometric identifiers and associated biometric information

(“biometrics”) from Plaintiffs.

21. Thereafter, on subsequent visits to Defendant’s Illinois facilities, Plaintiffs were 

asked to provide their fingerprint biometrics to Defendant for scanning, and Defendant captured, 

collected, received through trade, or otherwise obtained their biometrics on each occasion that 

their identities were verified using Defendant’s biometrically-enabled Auto-Gate Systems.

22. Although Defendant collected, captured, received through trade, or otherwise 

obtained the biometrics of Plaintiffs, it failed to first provide any written disclosures describing 

the purpose and duration of such collection and use and failed to obtain informed written consent

from Plaintiffs and other truck drivers prior to collecting, capturing, and storing such information,

as required by BIPA.

23. In the course of installing, maintaining, operating, and customizing its Auto-Gate 

Systems in Illinois, Defendant engaged multiple third-party technology providers.

24. Through these engagements, Defendant disclosed, redisclosed and/or disseminated

Plaintiffs’ and the Class members’ biometrics to these third-party technology providers, or 

otherwise provided them access to such biometrics, without first gaining Plaintiffs’ and the Class 

members’ consent.

25. Eventually, and after violating BIPA for many years with respect to both Plaintiffs 

and the Class, Defendant made efforts to partially comply with BIPA.

Case: 1:20-cv-00390 Document #: 135 Filed: 03/20/23 Page 5 of 13 PageID #:1188
6

26. After Plaintiff Fleury filed this suit seeking redress for Defendant’s violations of 

BIPA, Defendant belatedly sought and received Plaintiff Fleury’s purported written consent to 

collect, capture, receive through trade, or otherwise obtain his biometrics when he visited one of 

Defendant’s Illinois facilities.

27. Defendant never received any written consent to collect, capture, receive through 

trade, or otherwise obtain biometrics from Plaintiff Nunnery.

CLASS ALLEGATIONS

28. Pursuant to Fed. R. Civ. P 23, Plaintiffs bring this action on behalf of themselves 

and a Class of similarly situated individuals (the “Class”) defined as follows:

All persons who, after December 13, 2014, had their fingerprints registered or scanned by 

Defendant’s Automatic Gate Systems in Illinois without first providing written consent to 

Defendant.

29. Excluded from the Class are any members of the judiciary assigned to preside over 

this matter; any officer or director of Defendant; and any immediate family member of such officer 

or director.

30. There are at least tens of thousands of members of the Class, making the members 

of the Class so numerous that joinder of all members is impracticable. 

31. Plaintiffs’ claims are typical of the claims of the Class they seek to represent, 

because the basis of Defendant’s liability to Plaintiffs and the Class is substantially the same, and 

because Defendant’s conduct has resulted in similar injuries to Plaintiffs and to the Class.

32. There are many questions of law and fact common to the claims of Plaintiffs and 

the Class, and those questions predominate over any questions that may affect individual members 

of the Class. Common questions for the Class include, but are not limited to, the following:

a. Whether the Auto-Gate Systems collect, capture, or otherwise obtain 

Case: 1:20-cv-00390 Document #: 135 Filed: 03/20/23 Page 6 of 13 PageID #:1189
7

biometrics;

b. Whether Defendant obtained written consent from the Class before capturing, 

collecting, receiving through trade, or otherwise obtaining their biometrics;

c. Whether Defendant obtained consent from the Class before disclosing, 

redisclosing, and/or disseminating their biometrics;

d. Whether Defendant’s conduct violates BIPA;

e. Whether Defendant’s BIPA violations were willful or reckless; and

f. Whether Plaintiffs and the Class are entitled to damages and injunctive relief.

33. Absent a class action, most members of the Class would find the cost of litigating 

their claims to be prohibitively expensive and would thus have no effective remedy. The class 

treatment of common questions of law and fact is superior to multiple individual actions or 

piecemeal litigation in that it conserves the resources of the courts and the litigants and promotes 

consistency and efficiency of adjudication.

34. Plaintiffs will fairly and adequately represent and protect the interests of the other 

members of the Class they seek to represent. Plaintiffs have retained counsel with substantial 

experience in prosecuting complex litigation and class actions. Plaintiffs and their counsel are

committed to vigorously prosecuting this action on behalf of the other members of the Class and 

have the financial resources to do so. Neither Plaintiffs nor their counsel have any interest adverse 

to those of the other members of the Class.

35. Defendant has acted and failed to act on grounds generally applicable to the 

Plaintiffs and the other members of the Class, requiring the Court’s imposition of uniform relief 

to ensure compatible standards of conduct toward the members of the Class and making injunctive 

or corresponding declaratory relief appropriate for the Class as a whole.

Case: 1:20-cv-00390 Document #: 135 Filed: 03/20/23 Page 7 of 13 PageID #:1190
8 

COUNT I

Violations of the Illinois Biometric Information Privacy Act, 740 ILCS 14/15(b)

(On behalf of Plaintiffs and the Class and against Defendant Union Pacific) 

36. Plaintiffs incorporate the foregoing allegations as if fully set forth herein.

37. Defendant is a private entity under BIPA. 

38. Defendant collects, captures, receives through trade, or otherwise obtains Plaintiffs’ 

and Class members’ fingerprint biometrics through its Auto-Gate Systems in Illinois. 

39. Prior to first collecting, capturing, purchasing, receiving through trade, or otherwise 

obtaining Plaintiffs’ and the Class members’ biometrics, Defendant failed to inform Plaintiffs and 

the Class members: (1) that biometrics were being collected or stored; (2) the specific purpose for 

which such biometrics were being collected, stored or used; and (3) the length of time for which 

such biometrics would be collected, stored or used. Each such failure constitutes a violation of 740 

ILCS 14/15(b).

40. Defendant failed to receive informed written consent, and thus failed to obtain a 

written release, from Plaintiffs and the Class members prior to first collecting, capturing, 

purchasing, receiving through trade, or otherwise obtaining their biometrics, also in violation of 

740 ILCS 14/15(b). 

41. Defendant also captured, collected, received through trade, or otherwise obtained 

the biometrics of Plaintiffs and the Class members on each subsequent occasion they had their 

fingerprints scanned using Defendant’s biometrically-enabled Auto-Gate Systems in Illinois.

42. Defendant thus violated Section 15(b) on each occasion that it captured, collected, 

received through trade, or otherwise obtained biometrics from Plaintiffs and the Class members in 

Illinois. 

Case: 1:20-cv-00390 Document #: 135 Filed: 03/20/23 Page 8 of 13 PageID #:1191
9

43. BIPA provides for statutory damages of $5,000 for each willful and/or reckless 

violation of BIPA and, alternatively, damages of $1,000 for each negligent violation of the BIPA. 

44. Defendant has known it was violating BIPA since at least January 2019, if not

earlier.

45. At some point in or around 2020, Defendant engaged in efforts to become 

compliant with some of BIPA’s requirements.

46. Similarly, while Defendant ultimately sought to comply with the law by designing 

and implementing software changes to its biometrically-enabled Auto Gate Systems, such 

compliance efforts took many months, if not years, to be implemented. In the meantime, Defendant 

failed or refused to implement a paper-consent compliance regime. As a result, Defendant 

knowingly, recklessly, and/or intentionally violated Section 15(b) of BIPA every time an 

individual’s biometrics were collected, captured, received through trade, or otherwise obtained

through one of its Illinois Auto Gate Systems. 

47. Once Defendant’s biometric consent regime was ready, it still continued to violate 

Section 15(b) by implementing its consent regime through a “soft-launch,” which was not 

mandatory for drivers, who were still having their biometrics captured, collected, received through 

trade, or otherwise obtained at Defendant’s Illinois facilities without their informed written 

consent. 

48. Only after Plaintiff Fleury filed this suit did Defendant attempt to implement 

mandatory BIPA consent procedures. 

49. Defendant’s violations of BIPA, as set forth herein, were knowing and willful, or 

were at least in reckless disregard of the statutory requirements, which have been in place since 

Case: 1:20-cv-00390 Document #: 135 Filed: 03/20/23 Page 9 of 13 PageID #:1192
10 

2008. Alternatively, Defendant negligently failed to comply with Section 15(b) of BIPA in the 

course of its conduct or omissions as set forth herein. 

50. Accordingly, Plaintiffs, on behalf of themselves and the proposed Class, pray for 

the relief set forth below.

COUNT II 

Violations of the Illinois Biometric Information Privacy Act, 740 ILCS 14/15(a)

(On behalf of Plaintiffs and the Class and against Defendant Union Pacific) 

51. Plaintiffs incorporate the foregoing allegations as if fully set forth herein. 

52. Defendant is a private entity under BIPA. 

53. Defendant possesses and stores Plaintiffs’ and the Class members’ biometrics that 

are captured, collected, received through trade, or otherwise obtained through its Auto-Gate 

Systems in Illinois.

54. Thus, Defendant was obligated to post a publicly-available biometric retention and 

destruction schedule in accordance with Section 15(a) of BIPA.

55. Defendant has known it was violating BIPA through the operation of its Auto-Gate 

Systems since at least January of 2019, if not earlier.

56. However, despite knowing it was not in compliance with BIPA, Defendant still 

failed to timely comply with Section 15(a)’s requirement that it maintain a publicly-available 

biometric retention and destruction schedule. 

57. Defendant thus violated the posting requirement of Section 15(a) of BIPA with 

respect to Plaintiffs and the Class members.

58. Publishing such a policy on Defendant’s website and/or at its Illinois locations 

(which were still collecting biometrics) would have taken very little effort and could have easily 

Case: 1:20-cv-00390 Document #: 135 Filed: 03/20/23 Page 10 of 13 PageID #:1193
11 

been accomplished within weeks of learning of BIPA, particularly for a company with Defendant’s 

resources.

59. BIPA provides for statutory damages of $5,000 for each willful and/or reckless 

violation of BIPA and, alternatively, damages of $1,000 for each negligent violation of the BIPA.

60. Given Defendant’s awareness of BIPA’s requirements, its failure to post such a 

policy for many months, if not years, after becoming aware of the law amounts to intentional or 

reckless violations of Section 15(a) of BIPA, which has been in effect since 2008. Alternatively, 

Defendant negligently failed to comply with Section 15(a) of BIPA in the course of its conduct or 

omissions as set forth herein.

COUNT III

Violations of the Illinois Biometric Information Privacy Act, 740 ILCS 14/15(d)

(On behalf of Plaintiffs and the Class and against Defendant Union Pacific) 

61. Plaintiffs incorporate the foregoing allegations as if fully set forth herein.

62. Defendant is a private entity under BIPA.

63. During the relevant time period, Defendant engaged multiple third-party 

technology providers to assist Defendant in installing, maintaining, operating and customizing its 

Auto-Gate Systems in Illinois.

64. Through these engagements, including after 2019, Defendant disclosed, 

redisclosed, and/or disseminated Plaintiffs’ and the Class members’ biometrics to these third-party 

technology providers without first gaining Plaintiffs’ and the Class members’ consent.

65. Defendant thus violated Section 15(d) of BIPA on each occasion that it disclosed, 

redisclosed, and/or disseminated Plaintiffs’ and the Class members’ biometrics which were 

collected, captured, received through trade, or otherwise obtained in Illinois.

Case: 1:20-cv-00390 Document #: 135 Filed: 03/20/23 Page 11 of 13 PageID #:1194
12

66. BIPA provides for statutory damages of $5,000 for each willful and/or reckless 

violation of BIPA and, alternatively, damages of $1,000 for each negligent violation of the BIPA.

67. Given Defendant’s awareness of BIPA’s requirements, its disclosures, 

redisclosures, and/or disseminations after becoming aware of the law amounts to intentional or 

reckless violations of Section 15(d) of BIPA, which has been in effect since 2008. Alternatively, 

Defendant negligently failed to comply with Section 15(d) of BIPA in the course of its conduct or 

omissions as set forth herein.

PRAYER FOR RELIEF

WHEREFORE, Plaintiffs, on behalf of themselves and the proposed Class, respectfully 

request that this Court enter an Order:

a. Certifying the Class as defined above, appointing Plaintiffs as class representatives

and the undersigned as class counsel;

b. Declaring that Defendant’s actions, as set forth herein, violate BIPA;

c. Awarding injunctive and equitable relief as necessary to protect the interests of 

Plaintiffs and the Class by requiring Defendant to comply with BIPA;

d. Awarding statutory damages of $5,000 for each willful and/or reckless violation of 

the BIPA, pursuant to 740 ILCS 14/20(2);

e. Awarding statutory damages of $1,000 for each negligent violation of the BIPA, 

pursuant to 740 ILCS 14/20(1); 

f. Awarding reasonable attorneys’ fees, costs, and other litigation expenses, pursuant 

to 740 ILCS 14/20(3); 

g. Awarding pre- and post-judgment interest, as allowable by law; and

h. Awarding such further and other relief as the Court deems just and equitable.

Case: 1:20-cv-00390 Document #: 135 Filed: 03/20/23 Page 12 of 13 PageID #:1195
13 

JURY DEMAND

Plaintiffs request trial by jury of all claims that can be so tried.

Dated: March 20, 2023 Respectfully Submitted,

 

DAVID FLEURY and CHRISTOPHER 

NUNNERY, individually and on 

behalf of a Class of similarly situated individuals

 

By: /s/ David L. Gerbie 

 One of Plaintiffs’ Attorneys 

Myles McGuire

Evan M. Meyers

David L. Gerbie 

Brendan Duffner 

MCGUIRE LAW, P.C. 

55 W. Wacker Drive, 9th Fl. 

Chicago, IL 60601 

Tel: (312) 893-7002 

mmcguire@mcgpc.com

emeyers@mcgpc.com

dgerbie@mcgpc.com 

bduffner@mcgpc.com 

Attorneys for Plaintiffs and the Putative Class

Case: 1:20-cv-00390 Document #: 135 Filed: 03/20/23 Page 13 of 13 PageID #:1196