In a groundbreaking and somewhat surprising ruling, the Seventh Circuit Court of Appeals held that putative class action lawsuits alleging certain technical violations of Illinois’ Biometric Information Privacy Act (BIPA) sufficiently allege Article III standing in order to proceed in federal court, overturning a lower court ruling. See Bryant v. Compass Grp. USA, Inc., Case No. 20-1443 (May 5, 2020).
This ruling is important for any business operating in Illinois and collecting fingerprints or utilizing facial-recognition technology. And, potentially, this ruling adds yet another perspective to the ongoing Spokeo standing debate currently raging in the federal courts.
Emerging Divisions on BIPA
BIPA went into effect in 2008 and has been heavily litigated in both state and federal courts since 2015. A divide has emerged between state and federal courts, however, regarding when a plaintiff has standing to sue for alleged BIPA violations.
At the state level, the Illinois Supreme Court held last year in Rosenbach v. Six Flags Entm’t Corp. that “an individual need not allege some actual injury or adverse effect, beyond violation of [their] rights under [BIPA], in order to qualify as an ‘aggrieved’ person” under the Act. 129 N.E.3d 1197, 1207 (Ill. 2019). This meant a technical violation of the law, such as collecting biometric information of an individual without notice or consent, was sufficient to grant the plaintiff standing, even in the absence of any “actual” or concrete injury. See id.
The Rosenbach decision caused tension with the U.S. Supreme Court’s Spokeo, Inc. v. Robins decision, which held that Article III of the U.S. Constitution requires “a concrete injury even in the context of a statutory violation” and “a bare procedural violation, divorced from any concrete harm” was not enough to establish constitutional standing. Spokeo v. Robins, 136 S. Ct. at 1540, 1543 (2016).
The Lawsuit
In Bryant, the plaintiff, Christine Bryant, initially filed the lawsuit in state court, and the defendant, Compass Group USA, removed it to federal court. In an interesting twist, Bryant moved to remand the case and she – rather than Compass – argued that she lacked the constitutional standing necessary for her to remain in federal court.
The lawsuit alleged violations of BIPA Sections 15(a) and 15(b). BIPA Section 15(a) obligates private entities that collect biometric information to make publicly available a data retention schedule and guidelines for permanently destroying the collected biometric information. BIPA Section 15(b) lays out the Act’s informed-consent regime. The Bryant district court held that the defendant’s “bare procedural violations” of BIPA under both sections did not establish the Spokeo-required concrete harm and remanded the action back to state court.
That district court’s ruling was overruled in part by the Seventh Circuit Court of Appeals on May 5, 2020. The unanimous three-judge appellate panel stated the collection of the plaintiff’s biometric information without notice or consent in violation of BIPA Section 15(b) was “the kind of injury-in-fact that supports” standing under Article III of the Constitution. Bryant at p. 2. The Court of Appeals framed the injury-in-fact as an invasion of the plaintiff’s privacy, “much like an act of trespass would be.” Id. at p. 12. Therefore, according to the court, a “direct application of Spokeo, [] leads to the result that [the plaintiff] satisfied the injury-in-fact requirement of Article III” for its Section 15(b) allegations. See id.
The Seventh Circuit, however, did not reach the same result as to the plaintiff’s claims under BIPA Section 15(a) regarding the Act’s data retention schedule requirements. The Seventh Circuit concluded that the duties owed under 15(a) were to the public generally, and not to particular persons whose biometric information it collects. Id. at p. 16. The court relied on this distinction in holding that the plaintiff did not allege a particularized harm resulting from the defendant’s violation of Section 15(a). See id. Therefore, the plaintiff lacked Article III standing to pursue her claims arising under Section 15(a) in federal court, but could proceed with the Section 15(b) claims. Id.
Potential Takeaways
There are many potential takeaways from the Bryant decision. First, employers and other entities that generally prefer to defend cases in federal rather than the more plaintiff-friendly state courts have a stronger chance of successfully removing some cases to federal court, assuming diversity jurisdiction requirements are met. Second, the “injuries to the public” vs. “injuries to a particular plaintiff” distinction could be applied in the context of other privacy statutes, such as the Fair Credit Reporting Act and Telephone Consumer Protection Act.
The development of the Article III standing issue will continue to be important, especially given the possible proliferation of biometric tracking in response to the COVID-19 pandemic. While an appeal in Bryant is expected, one has not been filed to date.
Our Privacy, Cybersecurity and Data Management Team will continue to monitor the latest BIPA developments and provide insights as we continue to monitor the ever-changing, ever-shifting legal landscape on this particular regulation.