Heard v. Becton, Dickinson and Company

               UNITED STATES DISTRICT COURT                          
               NORTHERN DISTRICT OF ILLINOIS                         
                    EASTERN DIVISION                                 

COREY HEARD, individually and on behalf of  )                             
all others similarly situated,      )                                     
                              )                                      
     Plaintiff,               )                                      
                              )                                      
     v.                       )    Case No. 19 C 4158                
                              )                                      
BECTON, DICKINSON & CO.            )    Judge Rebecca R. Pallmeyer        
                              )                                      
     Defendant.               )                                      


             MEMORANDUM OPINION AND ORDER                            
Since 2015, Plaintiff Corey Heard has worked as a respiratory therapist at several 
hospitals in Illinois that use the Pyxis MedStation system—an automated medication dispensing 
system manufactured by Defendant Becton, Dickinson and Company ("BD").  A user gains access 
to Pyxis devices by scanning his fingerprint.  Heard alleges that he "was required" to access Pyxis 
devices with his fingerprint "[a]s a condition of his employment" at the hospitals.  (Compl. [1-
1] ¶ 50.)  He has sued BD on behalf of a putative class for allegedly collecting, storing, and 
disseminating  biometric  data—specifically,  fingerprints—in  violation  of  the  Illinois  Biometric 
Information Privacy Act, 740 ILCS 14/1 et seq. (the "BIPA").  Heard initially filed this lawsuit in the 
Circuit Court of Cook County, Illinois.  BD removed the action to this court on the basis of diversity 
jurisdiction and the Class Action Fairness Act (see Notice of Removal [1], 1), and now moves for 
dismissal of all claims under Federal Rule of Civil Procedure 12(b)(6).  In addition, BD has moved 
to strike Heard's class allegations.  For the following reasons, BD's motion to dismiss is granted 
and its motion to strike the class allegations is terminated as moot.     
                      BACKGROUND                                     

The  court  recounts  the  following  facts  from  Heard's  Complaint.    BD  is  a  leading 
manufacturer and seller of medical technology, including the Pyxis MedStation system and related 
Pyxis devices (hereinafter, "Pyxis" or "Pyxis devices").  (Compl. ¶ 1.)  As noted, Pyxis devices 
"require . . . users to scan a fingerprint" for access to the system and the medication it dispenses.  
(Id. ¶¶ 1-2.)  "[W]hen an employee first begins work at a company that uses a Pyxis device," he 
is "required to have [his] fingerprint or palm print scanned in order to enroll [him] in the Pyxis 
database."  (Id. ¶ 38.)  Once the employee has done so, he has "access to multiple Pyxis devices" 
at his place of employment.  (Id. ¶ 2.)  BD "markets its Pyxis devices . . . as superior" to other 
medication-disbursement methods by emphasizing that they "improve[] precision and accuracy 
of user access via biometric information."  (Id. ¶ 42.)  BD "provides Pyxis devices to dozens of 
hospitals" in Illinois.  (Id. ¶ 1.)                                       
Between  2015  and  the  present,  Heard  has  worked  for  at  least  five  hospitals  (the 
"Hospitals") that use Pyxis devices.  (Id. ¶ 49.)  "As a condition of employment" at the Hospitals, 
Heard "was required to scan his fingerprint so it could be used as an authentication method to 
access the Pyxis devices."  (Id. ¶ 50.)  BD "subsequently stored [Heard's] fingerprint data in their 
systems."  (Id. ¶ 51; see also id. ¶ 44 (alleging that BD has "assembl[ed] a database of biometric 
data through broadly deployed fingerprint scanners").)  The Hospitals, too, "subsequently stored 
[Heard's] fingerprint data in their systems."  (Id. ¶ 52.)  Heard was "required to scan his fingerprint 
each time he accessed the Pyxis devices."  (Id. ¶ 53.)  Heard alleges "[u]pon information and 
belief" that BD "improperly discloses Pyxis user's [sic] fingerprint data to other, currently unknown, 
third parties, including but not limited to third parties that host biometric data in their data 
center(s)."  (Id. ¶ 11.)                                                  
The BIPA "imposes numerous restrictions on how private entities collect, retain, disclose 
and destroy biometric identifiers," including fingerprints.  Rosenbach v. Six Flags Entm't Corp., 

129 N.E.3d 1197, 1199

, 

432 Ill. Dec. 654, 656

, 

2019 IL 123186

 ¶ 1 (2019).  "Under the Act, any 
person 'aggrieved' by a violation of its provisions 'shall have a right of action against an offending 
party' and 'may recover for each violation.'"  Id. (quoting 740 ILCS 14/20).  Heard asserts claims 
against BD under Sections 15(a), 15(b), and 15(d) of the BIPA.  Section 15(a) requires entities 
"in  possession  of"  biometric  data  to  develop  a  publicly  available  retention  schedule  and 
destruction deadline for the data.  740 ILCS 14/15(a).  Section 15(b) requires entities that collect 
biometric data to first inform the subject in writing that they are doing so; state the "specific 
purpose and length of term for which" the data "is being collected, stored, and used"; and receive 
an executed written release authorizing them to collect the data.  740 ILCS 14/15(b).  Finally, 
Section 15(d) prohibits entities "in possession of" biometric data from disclosing it except in certain 
circumstances.  740 ILCS 14/15(b).                                        
In recent months, employees who have been subject to fingerprint scans have brought 
suit against their employers under the BIPA.1  In this case, Heard sues the manufacturer of the 
fingerprint scanning device itself, Defendant BD.  He alleges that BD never informed him or 
similarly situated individuals that it was collecting, using, or storing their biometric data, and never 
stated the purpose and length of time for which it was doing so, in violation of Section 15(b). (See, 
e.g., Compl. ¶¶ 10, 39, 94.)  He also alleges that BD failed to obtain an executed written release 
from him or similarly situated individuals authorizing the collection of their biometric data, in 
violation of Section 15(b).  (See, e.g., id. ¶¶ 10, 93.)  In addition, Heard alleges that BD never 
provided him or similarly situated individuals with a publicly available retention schedule for 
permanent destruction of the biometric data it collected, in violation of Section 15(a).  (See, e.g., 
id. ¶¶ 10, 84.)  Finally, Heard alleges "[u]pon information and belief" that BD disclosed his 
biometric data and that of similarly situated individuals to "unknown" third parties without obtaining 
consent, in violation of Section 15(d).  (Id. ¶ 11; see also id. ¶ 103.)  Heard seeks to represent a 
class defined as "[a]ll individuals working in the State of Illinois who had their fingerprints collected, 
captured, received, or otherwise obtained or disclosed by Defendant during the applicable 


1    Heard himself is a lead plaintiff in at least four other putative class actions brought 
under the BIPA in Illinois state courts.  (See BD Mem. in Supp. of Mot. to Strike Class Allegations 
[19], 1 n.1 (referencing Heard v. Omnicell, Inc., No. 2019-CH-06817 (Cir. Ct. of Ill. Cook Cnty.); 
Heard v. Weiss Mem'l Hosp., No. 2019-CH-06763 (Cir. Ct. of Ill. Cook Cnty.); Heard v. St. Bernard 
Hosp., No. 2017-CH-16828 (Cir. Ct. of Ill. Cook Cnty.); Heard v. TCH-North Shore, Inc., No. 2017-
CH-16918 (Cir. Ct. of Ill. Cook Cnty.)).)                                 
statutory period."  (Id. ¶ 68.)                                           
                      DISCUSSION                                     
A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) tests the sufficiency of 
the complaint.  See, e.g., Bell v. City of Country Club Hills, 

841 F.3d 713, 716

 (7th Cir. 2016).  In 
ruling on a Rule12(b)(6) motion, the court accepts all well-pleaded facts in a plaintiff's complaint 
as true and views them in the light most favorable to the plaintiff.  See United States ex rel. 
Berkowitz v. Automation Aids, Inc., 

896 F.3d 834, 839

 (7th Cir. 2018).  To survive a motion to 
dismiss, the complaint must contain sufficient factual information to "state a claim to relief that is 
plausible on its face."  Bell Atl. Corp. v. Twombly, 

550 U.S. 544, 570

 (2007).  A claim has facial 
plausibility when "the plaintiff pleads factual content that allows the court to draw the reasonable 
inference that the defendant is liable for the misconduct alleged."  Ashcroft v. Iqbal, 

556 U.S. 662, 678

 (2009).  "Threadbare recitals of the elements of a cause of action, supported by mere 
conclusory statements, do not suffice."  Id.; see also, e.g., Brooks v. Ross, 

578 F.3d 574, 581

 (7th 
Cir. 2009) (plaintiffs cannot satisfy the notice pleading rule by "merely parrot[ing] the statutory 
language of the claims that they are pleading"; rather, they must provide "some specific facts to 
ground those legal claims").                                              
A.   Whether the BIPA's "Health Care Exemption" Is Limited to Patient Information 
BD argues that the court should dismiss Heard's claims outright because, according to 
BD, the biometric data at issue falls under a "health care exemption" to the BIPA, which can be 
found in the Act's definition of biometric identifiers.  (BD Mem. in Supp. of Mot. to Dismiss ("BD 
Mot.") [16], 4.)  The definition states, in relevant part, that "[b]iometric identifiers do not include 
information captured from a patient in a health care setting or information collected, used, or 
stored for health care treatment, payment, or operations under the federal Health Insurance 
Portability and Accountability Act of 1996 ["HIPAA"]."  740 ILCS 14/10 (emphasis added).  BD 
contends that the latter clause—"information collected, used, or stored for health care treatment, 
payment, or operations under" HIPAA—"must be read to reach information other than that 
collected from a patient so as to avoid rendering it superfluous."  (See BD Mot. 4.)  It then 
emphasizes that according to Heard's Complaint, Pyxis users scan their fingerprints in order to 
access medication (presumably for patients, considering that Heard is a hospital employee).  
Thus, in BD's view, Heard's "purported biometric data is exempted [from the BIPA] as 'information 
collected, used, or stored for health care treatment, payment, or operations' under HIPAA."  (Id. 
(quoting 740 ILCS 14/10).)                                                
The court is aware of only two other cases in which defendants have advanced this theory.  
Both were in Illinois circuit courts, and the courts reached opposite conclusions concerning the 
theory's viability.  (See Ex. A to BD Reply in Supp. of Mot. to Dismiss [29-1], Diaz v. Silver Cross 
Hosp. & Med. Ctrs., No. 2018 CH 001327 (Cir. Ct. of Ill. Will Cnty.), Aug. 29, 2019 Hrg. Tr. 4:1-6, 
19:16-18, 21:11-24 (determining that HIPAA protects not only data that is "patient-driven," but 
also data that "relates to the patient" in a "secondary" sense; finding that a plaintiff-nurse's 
fingerprint was "information collected, used, or stored for health care treatment"; agreeing that the 
BIPA exempts such information; and dismissing the plaintiff's claims on that basis); Ex. 1 to Heard 
Opp. to BD Mot. to Dismiss [25-1], Bruhn v. New Alberton's, Inc., No. 2018 CH 01737 (Cir. Ct. of 
Ill. Cook Cnty.), July 2, 2019 Hrg. Tr. 53:1-22 (stating that interpreting the statute in the same 
manner BD proposes here would be "nonsensical" because it would leave "large categories" of 
health  care  workers—whose  biometric  information  is  not  protected  under  HIPAA—without 
recourse to protect that information under the BIPA, and stating if the Illinois legislature had 
intended to create such a significant "doughnut hole," it would have said so in clearer terms).)  
The court finds the reasoning in Bruhn more persuasive, particularly considering the Illinois 
Supreme  Court's  recent  statement  that  the  Illinois  legislature  "codified  [in  the  BIPA]  that 
individuals possess a right to privacy in and control over their biometric" data.  Rosenbach, 

129 N.E.3d at 1206

, 

432 Ill. Dec. at 663

, 

2019 IL 123186

 ¶ 33.  It seems unlikely that the legislature 
intended to deprive health care workers of that privacy and control merely because they are using 
their biometric information for the purpose of patient treatment.  Ultimately, however, the court 
need  not  decide  whether  BD's  statutory  interpretation  is  correct  because,  for  the  reasons 
discussed below, Heard fails to state a claim under the BIPA in any event.  
B.   Section 15(b) of the BIPA                                            
Unlike Sections 15(a), (c), (d), and (e) of the BIPA—all of which apply to entities "in 
possession of" biometric data—Section 15(b) applies to entities that "collect, capture, purchase, 
receive through trade, or otherwise obtain" biometric data.  740 ILCS 14/15(a)-(e).  Recognizing 
this distinction, the parties agree that mere possession of biometric data is insufficient to trigger 
Section 15(b)'s requirements.  (See BD Mot. 8; Heard Opp. to BD Mot. to Dismiss ("Heard Opp.") 
[25], 10.)  This interpretation of Section 15(b) finds ample support in case law.  See Namuwonge 
v. Kronos, Inc., No. 1:19-cv-03239, 

2019 WL 6253807

, at *5 (N.D. Ill. Nov. 22, 2019) (because 
"[t]he Illinois legislature used the term possession in certain sections of BIPA . . . but chose not to 
include possession in section 15(b)," there "is a difference between possessing and collecting 
biometric information");2 Bernal v. ADP, LLC, No. 2017-CH-12364, 

2019 WL 5028609

, at *1 (Cir. 
Ct. of Ill. Cook Cnty. Aug. 23, 2019) (crediting the argument that "the legislature intended for 
possession alone to not be enough to make an entity subject to § 15(b)"); see also, e.g., Dana 
Tank Container, Inc. v. Human Rights Comm'n, 

292 Ill. App. 3d 1022, 1026

, 

227 Ill. Dec. 179, 181

, 

687 N.E.2d 102, 104

 (1st Dist. 1997) ("Where the legislature uses certain words in one 
instance and different words in another, it intended different results."). 
The parties dispute, however, whether Section 15(b) applies only to entities that "actively" 
collect biometric data.  (BD Mot. 8.)  BD argues that it does and contends that Heard's allegations 
do not sufficiently plead that BD itself actively collected his biometric data (or that of the putative 
class members).  (See id. at 7-10.)  Heard maintains that BD is reading a nonexistent requirement 
into the statute.  (See Heard Opp. 10.)  Pointing to the "otherwise obtain" language in Section 
15(b), Heard contends that the provision applies to "any entity that obtains biometric data, no 

2    Namuwonge was issued after the parties had fully briefed BD's motion to dismiss. 
matter the source or the manner of collection."  (Id.)  He also emphasizes that the bankruptcy of 
a company called Pay By Touch—which allegedly "provided major retailers . . . with fingerprint 
scanners to facilitate consumer transactions"—motivated the Illinois legislature to pass the BIPA.  
(See Compl. ¶¶ 25-26 (alleging, inter alia, that Pay By Touch's bankruptcy "was alarming to the 
Illinois Legislature because suddenly there was a serious risk that millions of fingerprint records" 
could be "sold, distributed, or otherwise shared through the bankruptcy proceedings without 
adequate protections for Illinois citizens"); Heard Opp. 11 (citing same).)  Heard contends that 
because "it was Pay By Touch's clients that 'actively collected' individuals' fingerprints," active 
collection cannot be "the touchstone of liability under Section 15(b)."  (Heard Opp. 11 (emphasis 
added).)                                                                  
Heard's arguments are flawed.  First, Heard agrees that Section 15(b) requires something 
more than mere possession of biometric data, but does not explain what that "something more" 
is, if not an affirmative act of collection.  In this vein, Heard does not specify how an entity could 
"otherwise obtain" biometric information without taking an active step to do so.  And as BD points 
out, Black's Law Dictionary defines "obtain" as "[t]o bring into one's own possession; to procure, 
esp. through effort."  (Obtain, BLACK'S LAW DICTIONARY (11th ed. 2019) (emphasis added); see 
BD Mot. 8 (quoting same).)  Second, the fact that Pay By Touch's bankruptcy may have influenced 
the Illinois legislature's decision to enact the BIPA does not mean that the legislature drafted every 
provision with Pay By Touch in mind, or that it intended for every provision to cover entities that 
operate exactly as Pay By Touch did.  Moreover, it is not clear from Heard's own allegations that 
Pay By Touch did not engage in an affirmative act of collection.  The court concludes that for 
Section 15(b)'s requirements to apply, an entity must, at a minimum, take an active step to "collect, 
capture, purchase, receive through trade, or otherwise obtain" biometric data.  740 ILCS 14/15(b).   
Heard has not adequately pleaded that BD took such any such step.  For example, Heard 
repeatedly alleges that BD "collected" his biometric data without alleging how, when, or any other 
factual detail.  (See, e.g., Compl. ¶¶ 9, 37, 39-40, 54, 68, 82, 91, 94, 95, 101; see also id. ¶ 93 
(alleging that BD "systematically and automatically collected" Heard's and the putative class 
members' biometric data).)  These allegations "merely parrot" the BIPA's statutory language; they 
do not provide any "specific facts to ground [Heard's] legal claims."  Brooks, 

578 F.3d at 581

.  
Heard also alleges that "[a]s a condition of employment" at the Hospitals, he "was required to 
scan his fingerprint" to use Pyxis—and that BD "subsequently stored [his] fingerprint data in their 
systems."  (Compl. ¶¶ 50-51.)  But Heard does not allege how the data made its way to BD's 
systems.  Nor does he argue or allege that there is a difference between storage and mere 
possession.                                                               
Heard's allegations are much like those in Namuwonge, where a court dismissed the 
plaintiff's Section 15(b) claims under Rule 12(b)(6).  See 

2019 WL 6253807

, at *5.  The plaintiff 
in Namuwonge alleged that her employer (Brookdale) and the supplier of Brookdale's fingerprint 
scanning equipment (Kronos) each "systematically and automatically collected, used, stored and 
disseminated" her biometric information.  

Id.

  But "the more precise allegation" in the plaintiff's 
complaint "ma[de] clear that Brookdale collected the fingerprints using a system that Kronos 
supplied to Brookdale."  

Id.

  The court held that "[t]ogether, these allegations do not plausibly 
allege  that  Kronos  collected,  captured,  or  otherwise  obtained  [the  plaintiff's]  biometric 
information."  

Id.

  So too here.  Similarly, an Illinois circuit court recently dismissed a Section 15(b) 
claim against a provider of biometric scanning technology because the plaintiff "failed to allege 
facts sufficient . . . for the Court to properly assess Defendant's actual involvement, relative to the 
biometric scanning technology, beyond the fact that Defendant supplied [the plaintiff's employer] 
with the technology."  Bernal, 

2019 WL 5028609

, at *2.  As in Bernal, Heard's allegations do not 
enable the court to "assess [BD's] actual involvement" in the alleged collection of biometric data. 
Notably, in Neals v. PAR Technology Corp., a court in this district determined that to state 
a claim for a Section 15(b) violation, the plaintiff did not need to "substantiate her allegation that 
[the defendant] collected her biometric information."  Neals, No. 19 C 5660, 

2019 WL 6907995

, 
at *2 (internal quotation marks omitted).3  Rather, the allegation that the defendant "collected such 
information through its customer's use of" its fingerprint scanning system was sufficient.  

Id.

  
Whatever the merit of that conclusion, Neals is distinguishable in that Heard does not even allege 
that BD collected biometric information "through its customer's use of" Pyxis.  

Id.

  He instead 
alleges with no factual support that BD "collect[ed]" his biometric data and "stored [it] in their 
systems."  (See, e.g., Compl. ¶¶ 9, 51.)  Additionally, in his opposition to BD's motion to dismiss, 
Heard relies on information that appears nowhere in his Complaint.  Specifically, Heard states 
that BD "does not directly collect biometric data with every Pyxis system it sells; some of its 
products collect and store biometric data only locally in the network in which they are deployed."  
(Heard Opp. 3 n.1.)  He continues, "That is not the case for the named Plaintiff in this action and 
the putative class alleged in the Complaint, from whom BD collects the information directly."  (Id. 
(citing Compl. ¶¶ 51, 68, which state nothing of the sort).)  And he states that BD "chose to market 
biometric devices that transmit data to BD-controlled servers for storage."  (Heard Opp. 9.)  These 
statements suggest that Heard has some understanding, based on some factual source, of how 
BD allegedly collects biometric data.  Yet Heard chose not to include the information in these 
statements—or any factual content concerning the critical issue of collection—in his pleadings.   
The court concludes that Heard has not plausibly alleged that BD "collect[ed], capture[d], 
purchase[d], receive[d] through trade, or otherwise obtain[ed]" biometric data from Heard or the 
putative class members.  740 ILCS 14/15(b).  The court therefore grants BD's motion to dismiss 
Heard's Section 15(b) claim and declines to address BD's alternative argument that because it "is 
not [Heard's] employer," it "does not have to (and could not) comply with Section 15(b)'s notice 
and consent provisions."  (BD Mot. 6.)                                    
C.   Sections 15(a) and 15(d) of the BIPA                                 
Sections 15(a) and 15(d) of the BIPA apply to entities "in possession of" biometric data.  

3    Neals, too, was decided after the parties had fully briefed BD's motion to dismiss. 
740  ILCS  14/15(a),  (d).    The  BIPA  does  not  define  "possession."    See  740  ILCS  14/10.  
Accordingly, the court "assumes [that] the legislature intended for [the term] to have its popularly 
understood meaning," or its "settled legal meaning" if one exists.  Rosenbach, 

129 N.E.3d at 1205

, 

432 Ill. Dec. at 662

, 

2019 IL 123186

 ¶ 29 (applying these canons of construction to the term 
"aggrieved," which is also undefined in the BIPA).  The Illinois Supreme Court has held that 
"possession, as ordinarily understood, occurs when a person has or takes control of the subject 
property or holds the property at his or her disposal."  People v. Ward, 

215 Ill.2d 317, 325

, 

830 N.E.2d 556, 560

,  

249 Ill. Dec. 144

,  148  (2005)  (internal  quotation  marks  omitted);  see 
Namuwonge, 

2019 WL 6253807

, at *3 (citing same).  BD argues that the term "possession" in the 
BIPA contemplates an exercise of dominion and control "to the exclusion of others" (BD Mot. 11), 
but the court disagrees.  The ordinary meaning of possession does not contemplate exclusive 
control, see Ward, 

215 Ill.2d at 325

, 

830 N.E.2d at 560

, 249 Ill. Dec. at 148, and nothing in the 
BIPA indicates that the ordinary definition of possession does not apply.  See Namuwonge, 

2019 WL 6253807

, at *3 (same).  If anything, the Illinois legislature's findings that "[t]he use of 
biometrics is growing" and "[t]he full ramifications of biometric technology are not fully known" 
reflect a recognition that multiple entities could control the same data.  740 ILCS 14/5(a), (f). 
Nonetheless,  the  court  agrees  with  BD  that  Heard  has  not  adequately  pleaded 
"possession" because he fails to allege that BD "exercised any dominion or control over [his] 
biometric data." (BD Mot. 11.)  Like Heard's allegations concerning collection, most of his 
allegations concerning possession merely parrot the statutory language.  (See Compl. ¶¶ 9, 37, 
39-40, 54, 68, 93-95 (alleging, without more, that BD "stored" biometric information).)  Only one 
paragraph of the Complaint provides more detail:  it states that at some time after the hospitals 
required Heard to scan his fingerprint into Pyxis devices, BD "subsequently stored [Heard's] 
fingerprint data in their systems."  (Id. ¶ 51.)  This allegation does not plead that BD exercised 
any form of control over the data or that it held the data "at [its] disposal."  Ward, 

215 Ill.2d at 325

, 

830 N.E.2d at 560

, 249 Ill. Dec. at 148.  Indeed, it does not say whether BD could freely access 
the data or even how BD allegedly received it.  (Compl. ¶ 51.)  Compare Namuwonge, 

2019 WL 6253807

, at *3 (the plaintiff's "allegation that Brookdale disclosed their employees' fingerprint data 
to Kronos sufficiently alleges that Kronos possessed the fingerprint data collected by Brookdale").  
Heard's allegations that BD improperly disseminated the data—which, if true, would suggest that 
BD had control over the data—do not alter the court's conclusion because, as the court discusses 
below,  Heard's  pleadings  do  not  plausibly  indicate  that  BD  ever  disseminated  the  data.  
Accordingly, the court concludes that Heard has failed to "plead[] factual content that allows the 
court to draw the reasonable inference" that BD was "in possession" of his biometric data, or that 
of the putative class members.  Iqbal, 

556 U.S. at 678

.  The court, therefore, grants BD's motion 
to dismiss Heard's claims for violations of Section 15(a) and 15(d).      
The court also dismisses Heard's claim under Section 15(d) for an independent reason:  
Heard offers no basis for the allegation that BD disclosed his biometric data (or that of the putative 
class members).  See 740 ILCS 14/15(d) (providing that entities "in possession of" biometric data 
cannot disclose it except in limited circumstances).  Heard concedes that he relies solely on 
"information and belief" in alleging that BD violated Section 15(d), but argues that he is permitted 
to do so because the "facts of necessity" are within BD's exclusive control.  (See Heard Opp. 13; 
Compl. ¶ 11.)  "The Twombly plausibility standard . . . does not prevent a plaintiff from pleading 
facts alleged upon information and belief where the facts are peculiarly within the possession and 
control of the defendant."  Arista Records, LLC v. Doe 3, 

604 F.3d 110, 120

 (2d Cir. 2010) (internal 
quotation marks omitted); see also Green v. Beth, 

663 F. App'x 471, 474

 (7th Cir. 2016) (same).  
Heard has not satisfied the court that BD alone has possession of the facts necessary to Heard's 
Section 15(d) claim.  If Heard has a legitimate reason to suspect that BD disclosed his biometric 
data or that of the putative class members, he surely possesses information of some kind that 
triggered his suspicion—such as reports that BD has unlawfully disseminated biometric data in 
the past, or indications that Heard or the putative class members experienced identify theft after 
they used their employers' Pyxis systems.  Such information would not be within BD's exclusive 
possession.  Heard, therefore,  is not entitled to plead disclosure based upon information and 
belief.  In its current form, Heard's Complaint contains no allegations of fact which, if true, suggest 
there is any basis to even suspect that BD disseminated the biometric data at issue.  The court is 
not required to credit rank speculation.  See Taha v. Int'l Bhd. of Teamsters, Local 781, 

947 F.3d 464, 469

 (7th Cir. 2020). 
 For the reasons stated above, the court grants BD's motion to dismiss Heard's claims for 
violations of Sections 15(a), 15(b), and 15(d) of the BIPA.  The dismissal is without prejudice.  If 
Heard wishes to file an amended complaint,  he must do so by March 31, 2020.  Because the 
court is dismissing Heard's Complaint in its entirety, it terminates BD's motion to strike the class 
allegations  as  moot,  without  prejudice  to  refiling  in  the  event  that  Heard  files  an  amended 
complaint. 
                           CONCLUSION 
 For the foregoing reasons, the court grants Defendant Becton, Dickinson and Company's 
Motion to Dismiss [15] and terminates Defendant Becton,  Dickinson and Company's Motion to 
Strike Class Allegations [18] as moot, without prejudice to refiling.  If Heard wishes to file an 
amended complaint, he must do so by March 31, 2020. 

                               ENTER: 

Dated:  February 24, 2020               Lbrern   Hf   foseape—— 
                               REBECCA R. PALLMEYER 
                               United States District Judge 

                                 12