## Facts

- CSX Intermodal Terminals, Inc. operated an intermodal rail terminal in Chicago that required truck drivers to use automated kiosks to access the facility and retrieve containers.
- Richard Rogers, a truck driver, alleged CSX required fingerprint scans for identity verification at the terminal.
- Rogers alleged CSX collected and stored his fingerprint data and linked it to his personal identifying information.
- Rogers claimed CSX did not provide the written disclosures required by the Illinois Biometric Information Privacy Act (BIPA) before collecting biometric identifiers.
- Rogers alleged CSX did not obtain a written release authorizing collection and use of his biometric data as required by BIPA.
- Rogers also alleged CSX failed to develop and publicly disclose a written biometric data retention schedule and destruction guidelines.
- Rogers sued in federal court individually and for a putative class under BIPA.
- CSX moved to dismiss under Rule 12(b)(1) for lack of Article III standing and under Rule 12(b)(6) for failure to state a claim.

## Issues

1. Whether alleged failures to provide BIPA-required written notice, obtain a written release, and publish a retention/destruction policy constitute a concrete injury-in-fact sufficient for Article III standing.
2. Whether a person is an “aggrieved person” with a private right of action under BIPA based solely on statutory noncompliance, without alleging additional tangible harm.
3. Whether the complaint plausibly stated claims under BIPA §§ 15(a) and 15(b) at the pleading stage.

## Decision

- The court held Rogers alleged a concrete injury-in-fact and therefore had Article III standing.
- The court held Rogers qualified as an “aggrieved person” under BIPA because the alleged statutory violations themselves were sufficient to sue.
- The court found the complaint plausibly alleged violations of BIPA § 15(b) (collection without required written notice and written release) and § 15(a) (failure to publicly disclose retention and destruction policies).
- The court denied CSX’s motion to dismiss in full.

## Legal Principles

- Deprivation of the opportunity to provide informed, written consent for biometric collection and use can constitute a concrete privacy and informational injury for Article III standing.
- Under BIPA, a plaintiff may be “aggrieved” by a private entity’s failure to comply with the statute’s requirements, without alleging further harm such as identity theft or financial loss.
- BIPA’s notice, consent, and retention/destruction requirements protect a substantive privacy interest in control over biometric identifiers; alleged noncompliance states a claim when statutory elements are plausibly pled.

## Conclusion

The court allowed the putative class action to proceed, concluding that alleged noncompliance with BIPA’s fingerprint notice, consent, and retention-policy duties plausibly alleged actionable privacy harm and satisfied both Article III standing and BIPA’s “aggrieved person” requirement.


Rogers v. CSX Intermodal Terminals, Inc., 409 F. Supp. 3d 612 (N.D. Ill. 2019)