The Illinois Biometric Information Privacy Act (“BIPA”) continues to attract litigation, and the battle continues as to what allegations of a BIPA violation may proceed in the federal courts.   As you will recall, BIPA was enacted in 2008 to protect the privacy of personal biometric data.  Section 15(a) of BIPA requires a company to publicly post a general notice about the company’s biometric data retention periods.  740 Ill. Comp. Stat. 14/15(a). Section 15(b) of BIPA requires a company to provide specific notice and obtain consent from the particular person whose biometric information is collected.  Id. at 14/15(b).  BIPA also bans the sale or trade of personal biometric information for profit.  Id. at 14/15(c).  Notably, BIPA provides for a private right of action for anyone “aggrieved by a violation” of the statute.  Id. at 14/20.

Under the Illinois Supreme Court’s ruling in Rosenbach, an alleged statutory violation of BIPA is sufficient to bring a BIPA claim in the state courts. 129 N.E.3d 1197, 1207 (Ill. 2019).   However, the standard is different for litigating BIPA claims in federal court.  The U.S. Supreme Court in Spokeo clarified that Article III standing requires more than just a “bare procedural violation.” 136 S. Ct. 1540, 1549 (2016).  So, whether a BIPA case will be able to proceed in federal court depends on the allegations in the complaint.  Here is what the Seventh Circuit has had to say about Article III standing in the context of BIPA litigations:

• In Miller v. Southwest Airlines Co., 926 F.3d 898 (7th Cir. 2019), the unionized plaintiffs alleged that their employer violated section 15(a) and (b) of BIPA by scanning their fingerprints without abiding by BIPA’s notice and consent requirements.  Although the Court reasoned that the plaintiffs did satisfy Article III standing, the Railway Labor Act (“RLA”), which preempts state law, required dismissal of their claims.  Under the RLA, plaintiffs had to raise their disputes before an adjustment board.

• In Bryant v. Compass Grp. USA, Inc., 958 F.3d 617 (7th Cir. 2020), the Court held that BIPA plaintiffs had standing to recover damages in federal court for the alleged violations of section 15(b), but not section 15(a).  The plaintiff alleged that the defendant obtained her fingerprints without providing the required BIPA disclosures in violation of section 15(b) and failed to comply with the general data retention schedule requirements in violation of section 15(a).  The Seventh Circuit reversed the district court’s decision as to the section 15(b) claim, concluding that “a failure to follow section 15(b) of [BIPA] leads to an invasion of personal rights that is both concrete and particularized.”  The Court took a close look at the complaint and noted that because plaintiff alleged her own (as opposed to the public’s generally) biometric information was obtained without disclosure, she had standing to sue in federal court.  However, the Court held that the plaintiff did not have standing to pursue the section 15(a) claim, because—under plaintiff’s theory—there was no concrete and particularized harm.

• In Fox v. Dakkota Integrated Sys., 980 F.3d 1146 (7th Cir. 2020), the Seventh Circuit clarified when claims under section 15(a) may proceed in federal court.  The Fox Plaintiff made several claims under BIPA, including section 15(a), premised on the allegations that the defendant collected and disclosed plaintiff’s biometric identifiers without prior consent.  The plaintiff also alleged that the defendant failed to develop, publicly disclose, and implement a data retention schedule for destruction of employee biometric identifiers, and failed to destroy the plaintiff’s biometric data when she left the company.  The Court distinguished the “mere procedural failure” in Bryant when holding that the Fox Plaintiff had sufficiently alleged facts to satisfy Article III standing.  Specifically, the Court noted that the plaintiff “allege[d] a concrete and particularized invasion of her privacy interest in her biometric data stemming from [defendant’s] violation of the full panoply of its Section 15(a) duties [] resulting in the wrongful retention of her biometric data after her employment ended.”

• In Thornley v. Clearview AI, No. 20-3249, 2021 U.S. App. LEXIS 1006 (7th Cir. Jan. 14, 2021), the Seventh Circuit remanded the case to state court after finding that the complaint only alleged a violation of BIPA section 15(c).  The plaintiffs’ decision to plead a statutory violation, without any particularized injury, was a permissible strategic choice that precluded them from satisfying the Article III standing requirement. The Thornley Court also concluded that the plaintiffs’ narrow class definition did not allow for an interpretation that some class members may have suffered a particularized harm, and therefore did not impact the standing analysis.  After the Court denied Clearview AI’s petition for rehearing en banc, Clearview AI petitioned to stay the issuance of the mandate so it will have the opportunity to file a petition for writ of certiorari the Supreme Court.  (We will keep you informed on the status of the writ.)

Even with the Seventh Circuit’s recent decisions, it is still not crystal-clear what kinds of BIPA claims can proceed in federal court.  According to Bryant, a claim under section 15(b) inherently raises a concrete and particularized harm, so Article III standing is established for such claims.  Reviewing Bryant and Fox, standing for purposes of a section 15(a) claim depends on the specific allegations pled.  If the complaint fails to tie a particularized, personal harm to the alleged violation of 15(a)—but instead pleads a procedural violation only—the plaintiff will not be able to proceed in federal court.  Finally, Thornley’s analysis of section 15(c) is consistent with Bryant’s and Fox’s analyses of section 15(a): plaintiffs will lack Article III standing when the complaint alleges procedural violations only.