In Bryant v. Compass Group USA, Inc., the Seventh Circuit ruled last week that alleging a defendant failed to comply with prior notice and consent requirements under Section 15(b) of the Illinois Biometric Information Privacy Act (BIPA) is sufficient to confer Article III standing, even without any further alleged harm. The ruling upends prior decisions in the Northern District of Illinois, which had concluded that mere violations of the statute did not confer standing without alleging a tangible injury. However, the Seventh Circuit also ruled there is no Article III standing for alleged violations of Section 15(a) of BIPA, which requires a company to make its biometric data retention policy available to the public.
Standing Under BIPA Before Bryant
In 2008, Illinois enacted BIPA to regulate how private entities may collect and use an individual’s biometric identifiers and information (e.g., fingerprints, hand prints, facial geometry, or retina scans) for certain non-health related reasons. Illinois is one of a few states that has enacted a statute to protect biometric information privacy, and it is the only state that provides a private right of action for individuals. The law provides no private entity may collect, store, or use biometric information without first giving notice to, and obtaining a written release or consent from, the subject. Under BIPA, “[a]ny person aggrieved by a violation of [the] Act shall have a right of action.” 740 ILCS 14/20.
Class action lawsuits brought for alleged violations of BIPA have continued to appear in Illinois state courts since the Illinois Supreme Court’s 2019 decision, Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186. In Rosenbach, the Court held plaintiffs have standing as “aggrieved” persons to bring claims under the Act by alleging a mere statutory violation, without any further tangible injury. The Court based its ruling on the overriding purpose of BIPA, which it described as an individual’s “right to control their biometric information.” Requiring a plaintiff to plead actual harm “misapprehends” BIPA’s purpose. Accordingly, the Court found a technical violation of the statute—i.e., collecting a person’s biometric information without consent or notice—denies the individual the right to control his or her biometric privacy. The Court stated, “This is no mere ‘technicality.’ This injury is real and significant.” Furthermore, it reasoned that “requir[ing] individuals to wait until they have sustained compensable injury” would be “antithetical to the Act’s preventative and deterrent purposes.”
Although standing to bring BIPA claims was solidified in Illinois state courts following Rosenbach, federal district courts in the Seventh Circuit routinely found that alleging mere statutory violations under BIPA was insufficient to confer Article III standing. Consequently, BIPA lawsuits removed to federal court often were remanded for lack of standing, including Bryant, which was removed to the Northern District of Illinois.
Defendant in Bryant made vending machines available to its employees, which allowed employees to link their fingerprints to user accounts that facilitated paying for drinks and snacks purchased from the vending machines. Facing BIPA allegations brought in state court, the defendant removed the case to federal court pursuant to the Class Action Fairness Act. Plaintiff moved to remand the case, contending she lacked standing because she did not suffer an injury-in-fact as required by Article III. Following the trend in the Northern District, the district court granted plaintiff’s motion and held , where an employer has not surreptitiously collected an employee’s data or distributed that data to third parties, there has been no appreciable risk of harm, and thus no standing. The court relied on the “unanimity among courts within this district,” finding that without additional harm, statutory violations alone did not confer Article III standing.
The Seventh Circuit’s Decision
The Seventh Circuit, in a unanimous decision, reversed, in part, the district court’s ruling in a surprise opinion on May 5, 2020. The Seventh Circuit found a plaintiff alleging a mere violation of Section 15(b)—which requires prior notice and consent before the collection of biometric information and data—has Article III standing without alleging any further injury.
Although the Seventh Circuit noted that Rosenbach did not control this issue, it found the reasoning of Rosenbach instructive. Because federal standing requirements are more stringent than state requirements, the court turned to the U.S. Supreme Court’s 2016 decision in Spokeo v. Robins to bridge this gap. In Spokeo, the Supreme Court noted an injury need not be tangible to be concrete, and even a risk of harm may meet this standard. The Seventh Circuit particularly focused on Justice Thomas’s concurring opinion in Spokeo, which distinguished between injuries that arise when a private plaintiff asserts violations of her personal rights and those that arise when a private plaintiff seeks to vindicate public rights. The Seventh Circuit determined the Bryant plaintiff had alleged a violation infringing on her personal rights. As such, “[t]his was no bare procedural violation; it was an invasion of her private domain, much like an act of trespass would be.”
The Seventh Circuit interpreted the purpose of BIPA as ensuring persons understand when and how their biometric data will be collected and used so they can make an informed decision about whether to provide that data. By allegedly withholding substantive information about the use of plaintiff’s biometric data, the Seventh Circuit reasoned, defendant had stripped her of this opportunity and created a concrete injury.
The Seventh Circuit also held, however, that not every alleged violation of BIPA confers Article III standing. Specifically, the court ruled a plaintiff who alleges violations of Section 15(a)—which requires companies that collect biometric data to post a data retention schedule and destruction guidelines in a publicly available site—“lacks standing under Article III to pursue that claim in federal court.” Because the court found Section 15(a) is aimed at protecting public rights, it determined an alleged violation does not raise a particularized harm as required by Article III.
BIPA Litigation Post-Bryant
Defendants seeking to litigate in federal court may now remove Section 15(b) BIPA claims, provided that the defendant can satisfy the other jurisdictional requirements, such as under the Class Action Fairness Act. However, the Seventh Circuit’s rejection of Article III standing for Section 15(a) claims may result in those claims being unable to proceed in federal court, even in tandem with a Section 15(b) claim. See DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 351-52 (2006) (declining to permit federal court to exercise supplemental jurisdiction over claim that did not itself satisfy Article III standing requirement because “our standing cases confirm that a plaintiff must demonstrate standing for each claim he seeks to press”); see also Johnson v. U.S. Office of Pers. Mgmt., 783 F.3d 655, 661 (7th Cir. 2015) (“A plaintiff must demonstrate standing for each claim he seeks to press.”). Whether plaintiffs will seek to split their BIPA claims into concurrent state and federal proceedings remains to be seen. Under the Seventh Circuit’s reasoning that Section 15(a) claims involve public, rather than individual, injuries, plaintiffs are likely to face a heavy burden in seeking damages awards based on violations of Section 15(a).
Finally, the Seventh Circuit’s differing conclusions on standing for Section 15(a) and Section 15(b) claims also straddles the divide between decisions from the Ninth and Second Circuits. The Ninth Circuit has found Article III standing for both Sections 15(a) and 15(b) BIPA claims based on the common-law right to privacy. Conversely, the Second Circuit has ruled Article III standing does not exist for either Section 15(a) or 15(b) BIPA claims where nothing more than a “bare procedural violation” is alleged. The Seventh Circuit’s decision in Bryant takes a new view by fashioning a split in standing for alleged BIPA violations. Whether the Supreme Court gets called upon to resolve this split remains to be seen.