EXHIBIT A 

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 1 of 22 PageID #:11
1 

IN THE CIRCUIT COURT OF COOK COUNTY, ILLINOIS 

COUNTY DEPARTMENT, CHANCERY DIVISION 

JAMES NOSAL, individually, and on behalf of 

all others similarly situated, 

 Plaintiff, 

v. 

RICH PRODUCTS CORPORATION, 

 Defendant. 

) 

) 

) 

) 

) 

) 

) 

) 

) 

) 

) 

 

 Case No. 2018-CH-07627 

 

SECOND AMENDED CLASS ACTION COMPLAINT 

Plaintiff James Nosal (“Nosal” or “Plaintiff”), individually and on behalf of all others 

similarly situated (the “Class”), by and through his attorneys, brings the following Second 

Amended Class Action Complaint (“Second Amended Complaint”) pursuant to the Illinois Code 

of Civil Procedure, 735 ILCS §§ 5/2-801 and 2-802, against Rich Products Corporation (“Rich 

Products” or “Defendant”), its subsidiaries and affiliates, to redress and curtail Defendant’s 

unlawful collection, use, storage, and disclosure of Plaintiff’s sensitive and proprietary biometric 

data. Plaintiff alleges as follows upon personal knowledge as to himself, his own acts and 

experiences and, as to all other matters, upon information and belief, including investigation 

conducted by his attorneys. 

NATURE OF THE ACTION 

1. Defendant Rich Products is a multinational supplier and solutions provider for food 

service, in-store bakery and retail marketplaces. 

FILED

7/24/2020 5:14 PM

DOROTHY BROWN

CIRCUIT CLERK

COOK COUNTY, IL

2018CH07627

9884855

Return Date: No return date scheduled

Hearing Date: No hearing scheduled

Courtroom Number: No hearing scheduled

Location: No hearing scheduled

 FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 2 of 22 PageID #:12
2 

2. When Rich Products hires an employee, he or she is enrolled in its ADP employee 

database. Rich Products uses the ADP employee database to monitor the time worked by its hourly 

employees. 

3. While many employers use conventional methods for tracking time worked (such 

as ID badge swipes or punch clocks), Rich Products’ employees are required, as a condition of 

employment, to have their fingerprints scanned by a biometric timekeeping device. 

4. Biometrics are not relegated to esoteric corners of commerce. Many businesses – 

such as Rich Products – and financial institutions have incorporated biometric applications into 

their workplace in the form of biometric timeclocks, and into consumer products, including such 

ubiquitous consumer products as checking accounts and cell phones. 

5. Unlike ID badges or time cards – which can be changed or replaced if stolen or 

compromised – fingerprints are unique, permanent biometric identifiers associated with each 

employee. This exposes Rich Products employees to serious and irreversible privacy risks. For 

example, if a database containing fingerprints or other sensitive, proprietary biometric data is 

hacked, breached, or otherwise exposed – like in the recent Yahoo, eBay, Equifax, Uber, Home 

Depot, MyFitnessPal, Panera, Whole Foods, Chipotle, Omni Hotels & Resorts, Trump Hotels and 

Facebook/Cambridge Analytica data breaches – employees have no means by which to prevent 

identity theft, unauthorized tracking or other unlawful or improper use of this highly personal and 

private information. 

6. In 2015, a data breach at the United States Office of Personnel Management 

exposed the personal identification information, including biometric data, of over 21.5 million 

federal employees, contractors, and job applicants. U.S. Off. of Personnel Mgmt., Cybersecurity 

Incidents (2018), available at www.opm.gov/cybersecurity/cybersecurity-incidents. 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 3 of 22 PageID #:13
3 

7. An illegal market already exists for biometric data. Hackers and identity thieves 

have targeted Aadhaar, the largest biometric database in the world, which contains the personal 

and biometric data – including fingerprints, iris scans, and a facial photograph – of over a billion 

Indian citizens. See Vidhi Doshi, A Security Breach in India Has Left a Billion People at Risk of 

Identity Theft, The Washington Post (Jan. 4, 2018), available at 

https://www.washingtonpost.com/news/worldviews/wp/2018/01/04/a-security-breach-in-indiahas-left-a-billion-people-at-risk-of-identity-theft/?utm_term=.b3c70259fl38. 

8. In January 2018, an Indian newspaper reported that the information housed in 

Aadhaar was available for purchase for less than $8 and in as little as 10 minutes. Rachna Khaira, 

Rs 500, 10 Minutes, and You Have Access to Billion Aadhaar Details, The Tribune (Jan. 4, 2018), 

available at http://www.tribuneindia.com/news/nation/rs-500-10-minutes-and-you-have-accessto-billion-aadhaar-details/523361.html. 

9. Recognizing the need to protect its citizens from situations like these, Illinois 

enacted the Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1, et seq., specifically to 

regulate companies that collect, store, use and disseminate Illinois citizens’ biometrics, such as 

fingerprints. 

10. Notwithstanding the clear and unequivocal requirements of the law, Rich Products 

disregards its employees’ statutorily protected privacy rights and unlawfully collects, stores, 

disseminates, and uses their biometric data in violation of BIPA. Specifically, Defendant has 

violated and continues to violate BIPA because it did not and continues not to: 

a. Properly inform Plaintiff and others similarly situated in writing of the 

specific purpose and length of time for which their fingerprints were being 

collected, stored, and used, as required by BIPA; 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 4 of 22 PageID #:14
4 

b. Provide a publicly available retention schedule and guidelines for 

permanently destroying Plaintiff’s and other similarly-situated individuals’ 

fingerprints, as required by BIPA; 

c. Receive a written release from Plaintiff and others similarly situated to 

collect, store, or otherwise use their fingerprints, as required by BIPA; and 

d. Obtain consent from Plaintiff and others similarly situated to disclose, 

redisclose, or otherwise disseminate their fingerprints to a third party as 

required by BIPA 

11. Accordingly, Plaintiff, on behalf of himself as well as the putative Class, seeks an 

Order: (1) declaring that Defendant’s conduct violates BIPA; (2) requiring Defendant to cease the 

unlawful activities discussed herein; and (3) awarding statutory damages to Plaintiff and the 

proposed Class. 

PARTIES 

12. Plaintiff James Nosal is a natural person and a citizen of the State of Illinois. 

13. Defendant Rich Products is a corporation organized and existing under the laws of 

Delaware, with its principal place of business in Buffalo, New York. Rich Products is registered 

with the Illinois Secretary of State and conducts business in the State of Illinois, including Cook 

County. 

JURISDICTION AND VENUE 

14. This Court has jurisdiction over Defendant pursuant to 735 ILCS § 5/2-209 because 

Defendant conducts business transactions in Illinois, committed the statutory violations alleged 

herein in Illinois and is registered to conduct business in Illinois. 

15. Venue is proper in Cook County because Defendant is authorized to conduct 

business in this State, Defendant conducts business transactions in Cook County, and Defendant 

committed the statutory violations alleged herein in Cook County and throughout Illinois. 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 5 of 22 PageID #:15
5 

FACTUAL BACKGROUND 

I. The Biometric Information Privacy Act. 

16. Major national corporations started using Chicago and other locations in Illinois in 

the early 2000s to test “new applications of biometric-facilitated financial transactions, including 

finger-scan technologies at grocery stores, gas stations, and school cafeterias.” 740 ILCS § 14/5(c). 

Given its relative infancy, an overwhelming portion of the public became weary of this thengrowing yet unregulated technology. See 740 ILCS § 14/5. 

17. In late 2007, a biometrics company called Pay by Touch, which provided major 

retailers throughout the State of Illinois with fingerprint scanners to facilitate consumer 

transactions, filed for bankruptcy. That bankruptcy was alarming to the Illinois Legislature because 

suddenly there was a serious risk that millions of fingerprint records – which, like other unique 

biometric identifiers, can be linked to people’s sensitive financial and personal data – could now 

be sold, distributed, or otherwise shared through the bankruptcy proceedings without adequate 

protections for Illinois citizens. The bankruptcy also highlighted the fact that most consumers who 

used that company’s fingerprint scanners were completely unaware the scanners were not 

transmitting fingerprint data to the retailer who deployed the scanner, but rather to the nowbankrupt company, and that their unique biometric identifiers could now be sold to unknown third 

parties. 

18. Recognizing the “very serious need [for] protections for the citizens of Illinois 

when it [came to their] biometric information,” Illinois enacted BIPA in 2008. See Illinois House 

Transcript, 2008 Reg. Sess. No. 276; 740 ILCS 14/5. 

19. Additionally, to ensure compliance, BIPA provides that, for each violation, the 

prevailing party may recover $1,000 or actual damages, whichever is greater, for negligent 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 6 of 22 PageID #:16
6 

violations and $5,000, or actual damages, whichever is greater, for intentional or reckless 

violations. 740 ILCS 14/20. 

20. BIPA is an informed consent statute which achieves its goal by making it unlawful 

for a company to, among other things, “collect, capture, purchase, receive through trade, or 

otherwise obtain a person’s or a customer’s biometric identifiers or biometric information, unless 

it first: 

a. Informs the subject in writing that a biometric identifier or biometric 

information is being collected, stored and used; 

b. Informs the subject in writing of the specific purpose and length of term for 

which a biometric identifier or biometric information is being collected, 

stored, and used; and 

c. Receives a written release executed by the subject of the biometric identifier 

or biometric information. 

See 740 ILCS 14/15(b). 

21. BIPA specifically applies to employees who work in the State of Illinois. BIPA 

defines a “written release” specifically “in the context of employment [as] a release executed by 

an employee as a condition of employment.” 740 ILCS 14/10. 

22. Biometric identifiers include retina and iris scans, voiceprints, scans of hand and 

face geometry, and – most importantly here – fingerprints. See 740 ILCS 14/10. Biometric 

information is separately defined to include any information based on an individual’s biometric 

identifier that is used to identify an individual. Id. 

23. BIPA also establishes standards for how companies must handle Illinois citizens’ 

biometric identifiers and biometric information. See, e.g., 740 ILCS 14/15(c)-(d). For example, 

BIPA prohibits private entities from disclosing a person’s or customer’s biometric identifier or 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 7 of 22 PageID #:17
7 

biometric information without first obtaining consent for such disclosures. See 740 ILCS 

14/15(d)(1). 

24. BIPA also prohibits selling, leasing, trading, or otherwise profiting from a person’s 

biometric identifiers or biometric information (740 ILCS 14/15(c)) and requires companies to 

develop and comply with a written policy – made available to the public – establishing a retention 

schedule and guidelines for permanently destroying biometric identifiers and biometric 

information when the initial purpose for collecting such identifiers or information has been 

satisfied or within three years of the individual’s last interaction with the company, whichever 

occurs first. 740 ILCS 14/15(a). 

25. The Illinois legislature enacted BIPA due to the increasing use of biometric data in 

financial and security settings, the general public’s hesitation to use biometric information, and – 

most significantly – the unknown ramifications of biometric technology. Biometrics are 

biologically unique to the individual and, once compromised, an individual is at a heightened risk 

for identity theft and left without any recourse. 

26. BIPA provides individuals with a private right of action, protecting their right to 

privacy regarding their biometrics. BIPA also protects individuals’ rights to know the precise 

nature for which their biometrics are used and how they are being stored and ultimately destroyed, 

allowing individuals to make a truly informed choice. Unlike other statutes that only create a right 

of action if there is a qualifying data breach, BIPA strictly regulates the manner in which entities 

may collect, store, use, and disseminate biometrics and creates a private right of action for lack of 

statutory compliance. 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 8 of 22 PageID #:18
8 

27. Plaintiff, like the Illinois legislature, recognizes how imperative it is to keep 

biometric information secure. Biometric information, unlike other personal identifiers such as a 

social security number, cannot be changed or replaced if hacked or stolen. 

II. Defendant Violates the Biometric Information Privacy Act. 

28. By the time BIPA passed through the Illinois Legislature in mid-2008, most 

companies who had experimented with using individuals’ biometric data stopped doing so. 

29. However, Defendant failed to take note of the shift in Illinois law governing the 

collection, use, storage and dissemination of biometric data. As a result, Defendant continues to 

collect, store, use and disseminate individuals’ biometric data in violation of BIPA. 

30. Specifically, when employees are hired by Rich Products, they are required to have 

their fingerprints captured and stored to enroll them in its ADP employee database(s). 

31. Rich Products uses an employee time-tracking system supplied by ADP that 

requires employees to use their fingerprint as a means of authentication. Unlike a traditional 

timeclock, employees have to use their fingerprints multiple times each day to “punch” in and out 

of work. 

32. Upon information and belief, Rich Products failed and continues to fail to inform 

its employees that it discloses their fingerprint data to at least one out-of-state third-party vendor, 

ADP, and likely others; fails to inform its employees that it discloses their fingerprint data to other, 

currently unknown, third parties, which host the biometric data in their data centers; fails to inform 

its employees of the purposes and duration for which it collects their sensitive biometric data; and, 

fails to obtain written releases from employees before collecting their fingerprints. 

33. Furthermore, Defendant fails to provide employees with a written, publicly 

available policy identifying its retention schedule and guidelines for permanently destroying 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 9 of 22 PageID #:19
9 

individuals’ fingerprints when the initial purpose for collecting or obtaining their fingerprints is 

no longer relevant, as required by BIPA. 

34. The Pay by Touch bankruptcy that catalyzed the passage of BIPA, as well as the 

recent data breaches, highlight why such conduct – where individuals are aware that they are 

providing a fingerprint, but not aware of to whom or for what purposes they are doing so – is 

dangerous. The Pay by Touch bankruptcy spurred Illinois citizens and legislators into realizing 

that it is crucial for individuals to understand when providing biometric identifiers, such as a 

fingerprint, who exactly is collecting their biometric data, where it will be transmitted, for what 

purposes, and for how long. Defendant disregards these obligations and its employees’ statutory 

rights and instead unlawfully collects, stores, uses and disseminates individuals’ biometric 

identifiers and information, without ever receiving the individual’s informed written consent 

required by BIPA. 

35. Upon information and belief, Defendant lacks a retention schedule and guidelines 

for permanently destroying Plaintiff’s and other similarly-situated individuals’ biometric data and 

has not and will not destroy Plaintiff’s and other similarly-situated individuals’ biometric data 

when the initial purpose for collecting or obtaining such data has been satisfied or within three 

years of the individual’s last interaction with the company. 

36. Plaintiff and others similarly situated are not told what might happen to their 

biometric data if and when Defendant merges with another company, or worse, if and when 

Defendant’s business folds or when the other third parties that have received the biometric data 

businesses fold. 

37. Since Defendant neither publishes a BIPA-mandated data retention policy nor 

disclose the purposes for its collection of biometric data, Rich Products employees have no idea 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 10 of 22 PageID #:20
10 

whether Defendant sells, discloses, re-discloses, or otherwise disseminates their biometric data. 

Moreover, Plaintiff and others similarly situated are not told the extent to whom Defendant 

currently discloses their biometric data, or what might happen to their biometric data in the event 

of a merger or a bankruptcy. 

38. These violations have raised a material risk that Plaintiff’s and other similarlysituated individuals’ biometric data will be unlawfully accessed by third parties. 

39. By and through the actions detailed above, Defendant disregarded Plaintiff’s and 

other similarly-situated individuals’ legal rights in violation of BIPA. 

III. Plaintiff James Nosal’s Experience 

40. Plaintiff James Nosal worked for Rich Products located at 21511 Division Street, 

Crest Hill, IL 60403, as a maintenance technician from approximately November 2012 until 

approximately November 2017. 

41. As an employee, Nosal was required to scan his fingerprint so Rich Products could 

use it as an authorization method to track his time. 

42. Rich Products subsequently stored Nosal’s fingerprint data in its ADP database. 

43. Nosal was required to scan his fingerprint each time he began and ended his 

workday. 

44. Nosal has never been informed, prior to the collection of his biometric identifiers 

and/or biometric information, of the specific limited purposes or length of time for which 

Defendant collected, stored, used and/or disseminated his biometric data. 

45. Prior to the collection of his biometric identifiers and/or biometric information, 

Nosal has never been informed of any biometric data retention policy developed by Defendant, 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 11 of 22 PageID #:21
11 

nor has he ever been informed of whether Defendant will ever permanently delete his biometric 

data. 

46. Prior to the collection of his biometric identifiers and/or biometric information, 

Nosal has never been provided with nor ever signed a written release allowing Defendant to collect, 

store, use or disseminate his biometric data. 

47. Nosal has continuously and repeatedly been exposed to the risks and harmful 

conditions created by Defendant’s violations of BIPA alleged herein. 

48. No amount of time or money can compensate Nosal if his biometric data is 

compromised by the lax procedures through which Defendant captured, stored, used, and 

disseminated his and other similarly-situated individuals’ biometric data. Moreover, Nosal would 

not have provided his biometric data to Defendant if he had known that it would retain such 

information for an indefinite period of time without his consent. 

49. A showing of actual damages is not necessary in order to state a claim under BIPA. 

See Rosenbach v. Six Flags Ent. Corp., 2019 IL 123186, ¶ 40 (“[A]n individual need not allege 

some actual injury or adverse effect, beyond violation of his or her rights under the Act, in order 

to qualify as an “aggrieved” person and be entitled to seek liquidated damages and injunctive relief 

pursuant to the Act”). 

50. As Nosal is not required to allege or prove actual damages in order to state a claim 

under BIPA, he seeks statutory damages under BIPA as compensation for the injuries caused by 

Defendant. Rosenbach, 2019 IL 123186, ¶ 40. 

CLASS ALLEGATIONS

51. Pursuant to the Illinois Code of Civil Procedure, 735 ILCS 5/2-801, Plaintiff brings 

claims on his own behalf and as a representative of all other similarly-situated individuals pursuant 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 12 of 22 PageID #:22
12 

to BIPA, 740 ILCS 14/1, et seq., to recover statutory penalties, prejudgment interest, attorneys’ 

fees and costs, and other damages owed. 

52. As discussed supra, Section 14/15(b) of BIPA prohibits a company from, among 

other things, collecting, capturing, purchasing, receiving through trade, or otherwise obtaining a 

person’s or a customer’s biometric identifiers or biometric information, unless it first (1) informs 

the individual in writing that a biometric identifier or biometric information is being collected or 

stored; (2) informs the individual in writing of the specific purpose and length of time for which a 

biometric identifier or biometric information is being collected, stored, and used; and (3) receives 

a written release executed by the subject of the biometric identifier or biometric information. 740 

ILCS 14/15. 

53. Plaintiff seeks class certification under the Illinois Code of Civil Procedure, 735 

ILCS 5/2-801, for the following class of similarly situated individuals under BIPA: 

All individuals working for Rich Products in the State of Illinois who had their 

fingerprints collected, captured, received, obtained, maintained, stored, disclosed 

or disseminated by Defendant during the applicable statutory period. 

54. This action is properly maintained as a class action under 735 ILCS 5/2-801 

because: 

A. The class is so numerous that joinder of all members is impracticable; 

B. There are questions of law or fact that are common to the class; 

C. The claims of the Plaintiff are typical of the claims of the class; and, 

D. The Plaintiff will fairly and adequately protect the interests of the class. 

Numerosity 

55. The total number of putative class members exceeds fifty (50) individuals. The 

exact number of class members may easily be determined from Rich Products’ payroll records. 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 13 of 22 PageID #:23
13 

Commonality 

56. There is a well-defined commonality of interest in the substantial questions of law 

and fact concerning and affecting the Class in that Plaintiff and all members of the Class have been 

harmed by Defendant’s failure to comply with BIPA. The common questions of law and fact 

include, but are not limited to the following: 

A. Whether Defendant collected, captured, maintained, stored or otherwise 

obtained Plaintiff’s and the Class’s biometric identifiers or biometric 

information; 

B. Whether Defendant properly informed Plaintiff and the Class of its purposes 

for collecting, using, storing and disseminating their biometric identifiers or 

biometric information; 

 

C. Whether Defendant obtained a written release (as defined in 740 ILCS 

14/10) to collect, use, store and disseminate Plaintiff’s and the Class’s 

biometric identifiers or biometric information; 

D. Whether Defendant has disclosed or re-disclosed Plaintiff’s and the Class’s 

biometric identifiers or biometric information; 

E. Whether Defendant has sold, leased, traded, or otherwise profited from 

Plaintiff’s and the Class’s biometric identifiers or biometric information; 

F. Whether Defendant developed a written policy, made available to the 

public, establishing a retention schedule and guidelines for permanently 

destroying biometric identifiers and biometric information when the initial 

purpose for collecting or obtaining such identifiers or information has been 

satisfied or within three years of its last interaction with the individual, 

whichever occurs first; 

G. Whether Defendant complies with any such written policy (if one exists); 

H. Whether Defendant’s violations of BIPA have raised a material risk that 

Plaintiff’s and the putative Class’ biometric data will be unlawfully 

accessed by third parties; 

I. Whether Defendant used Plaintiff’s and the Class’s fingerprints to identify 

them; 

J. Whether the violations of BIPA were committed negligently; and 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 14 of 22 PageID #:24
14 

K. Whether the violations of BIPA were committed intentionally and/or 

recklessly. 

57. Plaintiff anticipates that Defendant will raise defenses that are common to the class. 

Adequacy 

58. Plaintiff will fairly and adequately protect the interests of all members of the class, 

and there are no known conflicts of interest between Plaintiff and class members. Plaintiff, 

moreover, has retained experienced counsel that are competent in the prosecution of complex 

litigation and who have extensive experience acting as class counsel. 

Typicality 

59. The claims asserted by Plaintiff are typical of the class members he seeks to 

represent. Plaintiff has the same interests and suffers from the same unlawful practices as the class 

members. 

60. Upon information and belief, there are no other class members who have an interest 

individually controlling the prosecution of his or her individual claims, especially in light of the 

relatively small value of each claim and the difficulties involved in bringing individual litigation 

against one’s employer. However, if any such class member should become known, he or she can 

“opt out” of this action pursuant to 735 ILCS 5/2-801. 

Predominance and Superiority

61. The common questions identified above predominate over any individual issues, 

which will relate solely to the quantum of relief due to individual class members. A class action is 

superior to other available means for the fair and efficient adjudication of this controversy because 

individual joinder of the parties is impracticable. Class action treatment will allow a large number 

of similarly-situated persons to prosecute their common claims in a single forum simultaneously, 

efficiently and without the unnecessary duplication of effort and expense if these claims were 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 15 of 22 PageID #:25
15 

brought individually. Moreover, as the damages suffered by each class member are relatively small 

in the sense pertinent to class action analysis, the expenses and burden of individual litigation 

would make it difficult for individual class members to vindicate their claims. 

62. Additionally, important public interests will be served by addressing the matter as 

a class action. The cost to the court system and the public for the adjudication of individual 

litigation and claims would be substantially more than if claims are treated as a class action. 

Prosecution of separate actions by individual class members would create a risk of inconsistent 

and varying adjudications, establish incompatible standards of conduct for Defendant and/or 

substantially impair or impede the ability of class members to protect their interests. The issues in 

this action can be decided by means of common, class-wide proof. In addition, if appropriate, the 

Court can and is empowered to fashion methods to efficiently manage this action as a class action. 

FIRST CAUSE OF ACTION 

Violation of 740 ILCS 14/15(a): Failure to Institute, Maintain and Adhere to PubliclyAvailable Retention Schedule 

63. Plaintiff incorporates the foregoing allegations as if fully set forth herein. 

64. BIPA mandates that companies in possession of biometric data establish and 

maintain a satisfactory biometric data retention – and, importantly, deletion – policy. Specifically, 

those companies must: (i) make publicly available a written policy establishing a retention 

schedule and guidelines for permanent deletion of biometric data (at most three years after the 

company’s last interaction with the individual); and (ii) actually adhere to that retention schedule 

and actually delete the biometric information. See 740 ILCS § 14/15(a). 

65. Defendant fails to comply with these BIPA mandates. 

66. Defendant qualifies as a “private entity” under BIPA. See 740 ILCS § 14/10. 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 16 of 22 PageID #:26
16 

67. Plaintiff and the Class are individuals who have had their “biometric identifiers” 

collected by Defendant (in the form of their fingerprints), as explained in detail in Sections II and 

III, supra. See 740 ILCS § 14/10. 

68. Plaintiff’s and the Class’s biometric identifiers were used to identify them and, 

therefore, constitute “biometric information” as defined by BIPA. See 740 ILCS § 14/10. 

69. Defendant failed to provide a publicly available retention schedule or guidelines 

for permanently destroying biometric identifiers and biometric information as specified by BIPA. 

See 740 ILCS § 14/15(a). 

70. Upon information and belief, Defendant lacks retention schedules and guidelines 

for permanently destroying Plaintiff’s and the Class’s biometric data and has not and will not 

destroy Plaintiff’s and the Class’s biometric data when the initial purpose for collecting or 

obtaining such data has been satisfied or within three years of the individual’s last interaction with 

the company. 

71. On behalf of himself and the Class, Plaintiff seeks: (1) declaratory relief; (2) 

injunctive and equitable relief as is necessary to protect the interests of Plaintiff and the Class by 

requiring Defendant to comply with BIPA’s requirements for the collection, storage, and use of 

biometric identifiers and biometric information as described herein; (3) statutory damages of 

$5,000 for each intentional and/or reckless violation of BIPA pursuant to 740 ILCS 14/20(2) or, 

in the alternative, statutory damages of $1,000 for each negligent violation of BIPA pursuant to 

740 ILCS 14/20(1); and (4) reasonable attorneys’ fees and costs and other litigation expenses 

pursuant to 740 ILCS 14/20(3). 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 17 of 22 PageID #:27
17 

SECOND CAUSE OF ACTION 

Violation of 740 ILCS § 14/15(b): Failure to Obtain Informed Written Consent and Release 

Before Obtaining Biometric Identifiers or information 

72. Plaintiff incorporates the foregoing allegations as if fully set forth herein. 

73. BIPA requires companies to obtain informed written consent from individuals 

before acquiring their biometric data. Specifically, BIPA makes it unlawful for any private entity 

to “collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s 

biometric identifiers or biometric information unless [the entity] first: (1) informs the subject...in 

writing that a biometric identifier or biometric information is being collected or stored; (2) informs 

the subject...in writing of the specific purpose and length of term for which a biometric identifier 

or biometric information is being collected, stored, and used; and (3) receives a written release 

executed by the subject of the biometric identifier or biometric information...” 740 ILCS 14/15(b) 

(emphasis added). 

74. Defendant fails to comply with these BIPA mandates. 

75. Defendant qualifies as a “private entity” under BIPA. See 740 ILCS § 14/10. 

76. Plaintiff and the Class are individuals who have had their “biometric identifiers” 

collected by Defendant (in the form of their fingerprints), as explained in detail in Sections II and 

III, supra. See 740 ILCS § 14/10. 

77. Plaintiff’s and the Class’s biometric identifiers were used to identify them and, 

therefore, constitute “biometric information” as defined by BIPA. See 740 ILCS § 14/10. 

78. Defendant systematically and automatically collected, used, stored and 

disseminated Plaintiff’s and the Class’s biometric identifiers and/or biometric information without 

first obtaining the written release required by 740 ILCS 14/15(b)(3). 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 18 of 22 PageID #:28
18 

79. Defendant did not inform Plaintiff and the Class in writing that their biometric 

identifiers and/or biometric information were being collected, stored, and used, nor did Defendant 

inform Plaintiff and the Class in writing of the specific purpose(s) and length of term for which 

their biometric identifiers and/or biometric information were being collected, stored, and used as 

required by 740 ILCS 14/15(b)(1)-(2). 

80. By collecting, storing, and using Plaintiff’s and the Class’s biometric identifiers 

and biometric information as described herein, Defendant violated Plaintiff’s and the Class’s rights 

to privacy in their biometric identifiers and/or biometric information as set forth in BIPA. See 740 

ILCS 14/1, et seq. 

81. On behalf of himself and the Class, Plaintiff seeks: (1) declaratory relief; (2) 

injunctive and equitable relief as is necessary to protect the interests of Plaintiff and the Class by 

requiring Defendant to comply with BIPA’s requirements for the collection, storage, and use of 

biometric identifiers and biometric information as described herein; (3) statutory damages of 

$5,000 for each intentional and/or reckless violation of BIPA pursuant to 740 ILCS 14/20(2) or, 

in the alternative, statutory damages of $1,000 for each negligent violation of BIPA pursuant to 

740 ILCS 14/20(1); and (4) reasonable attorneys’ fees and costs and other litigation expenses 

pursuant to 740 ILCS 14/20(3). 

THIRD CAUSE OF ACTION 

Violation of 740 ILCS § 14/15(d): Disclosure of Biometric Identifiers and Information 

Before Obtaining Consent 

82. Plaintiff incorporates the foregoing allegations as if fully set forth herein. 

83. BIPA prohibits private entities from disclosing a person’s or customer’s biometric 

identifier or biometric information without first obtaining consent for that disclosure. See 740 

ILCS 14/15(d)(1). 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 19 of 22 PageID #:29
19 

84. Defendant fails to comply with this BIPA mandate. 

85. Defendant qualifies as a “private entity” under BIPA. See 740 ILCS § 14/10. 

86. Plaintiff and the Class are individuals who have had their “biometric identifiers” 

collected by Defendant (in the form of their fingerprints), as explained in detail in Sections II and 

III, supra. See 740 ILCS § 14/10. 

87. Plaintiff’s and the Class’s biometric identifiers were used to identify them and, 

therefore, constitute “biometric information” as defined by BIPA. See 740 ILCS § 14/10. 

88. Defendant systematically and automatically disclosed, redisclosed, or otherwise 

disseminated Plaintiff’s and the Class’s biometric identifiers and/or biometric information without 

first obtaining the consent required by 740 ILCS 14/15(d)(1). 

89. By disclosing, redisclosing, or otherwise disseminating Plaintiff’s and the Class’s 

biometric identifiers and biometric information as described herein, Defendant violated Plaintiff’s 

and the Class’s rights to privacy in their biometric identifiers and/or biometric information as set 

forth in BIPA. See 740 ILCS 14/1, et seq. 

90. On behalf of himself and the Class, Plaintiff seeks: (1) declaratory relief; (2) 

injunctive and equitable relief as is necessary to protect the interests of Plaintiff and the Class by 

requiring Defendant to comply with BIPA’s requirements for the collection, storage, use and 

dissemination of biometric identifiers and biometric information as described herein; (3) statutory 

damages of $5,000 for each intentional and/or reckless violation of BIPA pursuant to 740 ILCS § 

14/20(2) or, in the alternative, statutory damages of $1,000 for each negligent violation of BIPA 

pursuant to 740 ILCS § 14/20(1); and (4) reasonable attorneys’ fees and costs and other litigation 

expenses pursuant to 740 ILCS § 14/20(3). 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 20 of 22 PageID #:30
20 

PRAYER FOR RELIEF

Wherefore, Plaintiff James Nosal respectfully requests that this Court enter an Order: 

A. Certifying this case as a class action on behalf of the Class defined above, 

appointing Plaintiff James Nosal as Class Representative, and appointing Stephan 

Zouras, LLP, as Class Counsel; 

B. Declaring that Defendant’s actions, as set forth above, violate BIPA; 

C. Awarding statutory damages of $5,000 for each intentional and/or reckless 

violation of BIPA pursuant to 740 ILCS 14/20(2) or, in the alternative, statutory 

damages of $1,000 for each negligent violation of BIPA pursuant to 740 ILCS 

14/20(1); 

D. Declaring that Defendant’s actions, as set forth above, were intentional or reckless; 

E. Awarding injunctive and other equitable relief as is necessary to protect the 

interests of Plaintiff and the Class, including an Order requiring Defendant to 

collect, store, use and disseminate biometric identifiers and/or biometric 

information in compliance with BIPA; 

F. Awarding Plaintiff and the Class their reasonable attorneys’ fees and costs and 

other litigation expenses pursuant to 740 ILCS 14/20(3); 

G. Awarding Plaintiff and the Class pre- and post-judgment interest, to the extent 

allowable; and, 

 

H. Awarding such other and further relief as equity and justice may require. 

 

Date: July 24, 2020 Respectfully Submitted, 

/s/ Andrew C. Ficzko 

Ryan F. Stephan 

James B. Zouras 

Andrew C. Ficzko 

Stephan Zouras, LLP 

100 N. Riverside Plaza 

Suite 2150 

Chicago, Illinois 60606 

312.233.1550 

312.233.1560 f

rstephan@stephanzouras.com 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 21 of 22 PageID #:31
21 

jzouras@stephanzouras.com 

aficzko@stephanzouras.com 

Firm ID: 43734 

ATTORNEYS FOR PLAINTIFF 

FILED DATE: 7/24/2020 5:14 PM 2018CH07627

Case: 1:20-cv-04972 Document #: 1-1 Filed: 08/24/20 Page 22 of 22 PageID #:32