Background
Charles Schwab uses voice-identification technology supplied by Nuance Communications to authenticate customers making requests by telephone. Norma Cisneros, a Schwab customer, alleged in a putative class action that Nuance collected her voice-ID data without the written consent required by the Illinois Biometric Information Privacy Act and failed to publish or follow the Act’s required retention and deletion schedules.
Schwab was not named as a defendant because BIPA exempts financial institutions subject to Title V of the Gramm-Leach-Bliley Act. The district court concluded that Nuance also qualified for the exemption because it provided authentication services to Schwab and entered judgment for Nuance on the pleadings, although it analyzed the case under Rule 12(b)(6).
The Court’s Holding
The Seventh Circuit affirmed. It held that Nuance falls within BIPA’s Section 25(c) financial-institution exemption to the extent it authenticates Schwab customers conducting financial transactions. The Gramm-Leach-Bliley Act’s definition encompasses institutions engaged in financial activities identified under federal banking law, and Federal Reserve regulations classify identity authentication for financial and nonfinancial transactions as an activity closely related to banking.
The court rejected Cisneros’s arguments that Nuance waived the exemption or had to plead it as an affirmative defense. A statutory exception does not automatically constitute an affirmative defense, and Nuance had not yet filed an answer. Although the complaint stated a Section 15(b) claim and therefore should not have been dismissed under Rule 12(b)(6) based on an exception it was not required to plead around, the proper disposition was judgment on the pleadings under Rule 12(c). Because the parties had fully joined issue on the exemption’s meaning and no factual dispute required further proceedings, remand merely to invoke the correct rule was unnecessary.
The court also concluded that Cisneros had Article III standing on her Section 15(b) consent theory. It did not decide whether she independently had standing on claims concerning retention and deletion schedules because the exemption defeated the collection claim and caused the related schedule and retention claims to fall away.
Key Takeaways
- A voice-authentication provider is exempt from BIPA under Section 25(c) to the extent it authenticates customers in financial transactions for a regulated financial institution.
- A statutory exception is not necessarily an affirmative defense that must be pleaded under Rule 8(c), particularly before an answer is due.
- A complaint need not anticipate a statutory exception, so Rule 12(c), rather than Rule 12(b)(6), was the appropriate procedural basis for judgment on the pleadings.
Why It Matters
The decision extends BIPA’s financial-institution exemption beyond a regulated financial company itself to a technology provider performing an activity that federal banking regulations treat as closely related to banking. It also aligns the Seventh Circuit with the Third Circuit’s interpretation of the same Illinois-law exemption.
For litigants, the opinion distinguishes between whether a complaint states a claim and whether undisputed material in the pleadings establishes a statutory exception. That distinction affects the correct procedural vehicle, even when it does not change the ultimate judgment.