Last Friday, the Illinois Supreme Court ruled in the long-awaited Rosenbach case that an individual does not have to plead an actual injury or harm, apart from the statutory violation itself, in order to have statutory standing to sue under the Illinois Biometric Information Privacy Act (BIPA).  The Illinois Supreme Court ruling will allow procedural BIPA violations to proceed (and multiply) in state court – and has reportedly already prompted parties to settle such actions.  However, recent rulings in federal court have offered a divergent interpretation of the related, but different Article III standing issue.

For example, several weeks prior to the Rosenbach decision, two decisions from the District Court for the Northern District of Illinois offered insight into the federal standing threshold for BIPA claims. While largely limited to their facts, the decisions present a defensive strategy for fending off BIPA claims in federal court. Faced with this latest batch of rulings, expect forum shopping by plaintiffs with more cases filed in state court and some careful calculations from defendants in deciding on removal and other litigation strategies.

To recap:

Rivera v. Google, No. 16-02714, 2018 WL 6830332 (N.D. Ill. Dec. 29, 2018), a dispute we covered previously, involved claims that Google’s free service, Google Photos, collected and stored face-geometry scans of uploaded photos in order to aid users in grouping and organizing their photos. The claims hinged on two purported violations: unlawful collection and creation of faceprints and unlawful retention of faceprints. One named plaintiff was a Google Photos user who had uploaded a number of photos before realizing that the facial scanning feature was on (the feature defaults on, but users can turn it off). The other named plaintiff was not a Google Photos user, but her face entered the scanning system when a friend uploaded photos that included her. While the case presented a “close question,” the Illinois district court held merely retaining an individual’s private information (without any third-party disclosure), on its own, is not a sufficiently concrete injury to satisfy Article III under Spokeo. In dicta, however, the court did note that Google could possibly monetize such biometric information in the future, a non-consensual use that “might very well constitute a concrete injury.”

Several days after Rivera was decided, the same district court judge, Judge Chang, issued his opinion in McGinnis v. U.S. Cold Storage, Inc., No. 17-08054 (N.D. Ill. Jan. 3, 2019),  which echoed a wave of similar suits, and involved a class action complaint against a former employer for violating BIPA by using a timekeeping system that collected and retained employees’ fingerprints (and handprints) for clocking in and out, allegedly without complying with the notice and consent provisions of BIPA. There, the court held that a former employer’s mere retention of fingerprints and handprints, which were obtained with the plaintiff’s knowledge for timekeeping authentication, is insufficient to confer Article III standing if there is no risk of unauthorized disclosure (note: we have written previously about several decisions where BIPA suits related to employee fingerprinting were remanded for lack of standing).

Not surprisingly, on January 24, 2019, the plaintiff Rivera refiled a BIPA class action complaint in Illinois state court against Google, highlighting that Article III standing is not necessarily a silver bullet and that other potential defenses to BIPA claims (e.g., consent, class certification, proof of intent, or that the information collected if not biometric information) may become more relevant as cases proceed past procedural issues. In a sense, Rosenbach, Rivera, and other cases tackling standing issues represent just a small part of the host of issues in these types of cases.

Final Thoughts

Interestingly, Judge Chang framed the Rivera opinion within the ever-evolving world of technology. In one footnote, Judge Chang explicitly limited the holding to the facts of this case, which concerns face scans, and acknowledged the legislature’s ability to amend the law or make additional findings that might alter the court’s standing calculus:

“This holding of course does not preclude the legislature from making additional findings either now or in the future. It is not hard to imagine more concrete concerns arising from facial-recognition technology, especially as it becomes more accurate and more widespread (along with video-surveillance cameras) to the point that private entities are able to use technology to pinpoint where people have been over extended time periods.”

In another footnote, Judge Chang noted the fact that the law’s tendency to lag behind technological development can often be a less-than-perfect fit with current advances:

“The difficulty in predicting technological advances and their legal effects is one reason why legislative pronouncements with minimum statutory damages and fee-shifting might reasonably be considered a too-blunt instrument for dealing with technology. Of course, there might be policy considerations that weigh in favor of taking the broader approach.”

It is no surprise that the Illinois legislature has considered amendments to BIPA in the past several years. Current advances in biometric technology, especially facial recognition, have already prompted calls for government regulation from both privacy advocates and the tech industry.