The Illinois Biometric Information Privacy Act (“BIPA”) went into effect in 2008 and since then has been heavily litigated in state and federal court.  Since its inception, there has been an emerging divide between state and federal courts regarding when a plaintiff has standing to pursue claims for alleged violations of BIPA.  Generally, state courts have been quick to allow enforcement of the statute in the absence of any actual harm, while federal courts have been less keen on permitting cases to continue where the Plaintiff did not suffer a “concrete” harm.  In May, as CPW covered, the Seventh Circuit Court of Appeals held that BIPA plaintiffs do have standing to recover damages in federal court for claims brought under BIPA—at least in certain cases.  See Bryant v. Compass Grp. USA, Inc., 20-1443 (decided May 5, 2020).  Well, the Seventh Circuit this week in Fox v. Dakkota Integrated Sys., 2020 U.S. App. LEXIS 36148, issued a groundbreaking BIPA ruling following up on Bryant and expanding the categories of BIPA claims that may be brought in federal court.  Read more below.

As a refresher, BIPA was enacted for the specific purpose of addressing the heightened risk of identity theft associated with the processing of biometric data (face shape, fingerprints, etc.).  Unlike other unique identifiers used for financial and other purposes—like a phone number or an address—when biological data is compromised—such as by data theft— the hacker/thief has a permanent identifier for the affected individual.  Section 15(a) of BIPA requires publicly posting a general notice about the company’s biometric data retention periods whereas Section 15(b) of BIPA requires providing specific notice and obtaining consent from the particular person whose biometric information is collected.  740 Ill. Comp. Stat. 14/15(a), (b).  BIPA also bans the sale or trade of personal biometric information for profit.  Id. at 14/15(c).  And importantly BIPA provides for a private right of action to “[a]ny person aggrieved by a violation” of the statute.  Id. at 14/20 (emphasis added).  The costs of noncompliance with these provisions are significant, with uncapped statutory damages in the amount of $1,000 per negligent violation of BIPA and $5,000 for each intentional or reckless violation.  Id. at 14/20.

In Bryant v. Compass Group USA, Inc., the Seventh Circuit addressed standing to sue for two BIPA claims: (1) a violation of Section 15(b), the Act’s informed-consent provision; and (2) a violation of one part of Section 15(a)—namely, the duty to publicly disclose a data-retention policy.  The Court held that the plaintiff had standing to pursue the Section 15(b) claim.  However, the Court’s view of the Section 15(a) claim was different, as the plaintiff in Bryant had not alleged any concrete and particularized harm from the defendant’s failure to publicly disclose a data-retention policy.  As such, the Seventh Circuit held that the Bryant plaintiff lacked standing on that claim.  The Court cautioned, however, that its latter holding was confined to the narrow violation the plaintiff alleged (the Court did not address standing requirements for claims under other parts of Section 15(a)).  In Fox v. Dakkota Integrated Sys., the Court addressed this issue head on.

The plaintiff in Fox filed a putative class action in state court alleging that her former employer collected, used, retained, and disclosed her handprint for its timekeeping system.  This included allegations that:

• The defendant did not obtain plaintiff’s informed written consent before collecting her biometric identifiers as required by the Act and unlawfully disclosed or disseminated her biometric data to unnamed third parties without her consent.

• The defendant failed to develop, publicly disclose, and implement a data-retention schedule and guidelines for the permanent destruction of its employees’ biometric identifiers.

• The defendant failed to permanently destroy plaintiff’s biometric data when she left the company and still has not done so.

The plaintiff alleged several claims under BIPA arising from these underlying factual violations, including violation of Section 15(a).  The defendant removed the case to federal court under the Class Action Fairness Act (“CAFA”) and moved to dismiss the claims as preempted by federal labor law.  Applying Bryant, the district court found Article III standing foreclosed for 15(a) claimants, so he remanded that claim to state court and dismissed the others.

The Seventh Circuit, however, reversed. The Seventh Circuit classified the district court’s ruling as a “mistake,” explaining that:

Unlike in Bryant, [plaintiff’s] Section 15(a) claim does not allege a mere procedural failure to publicly disclose a data-retention policy.  Rather, [plaintiff] alleges a concrete and particularized invasion of her privacy interest in her biometric data stemming from [defendant’s] violation of the full panoply of its Section 15(a) duties—the duties to develop, publicly disclose, and comply with data retention and destruction policies—resulting in the wrongful retention of her biometric data after her employment ended, beyond the time authorized by law.

The Court found that these allegations sufficed to plead an injury in fact for purposes of Article III.  This was because, the Court reasoned, the invasion of a legally protected privacy right, though intangible, is personal and real, not general and abstract.  Id. at *3-4.

The Seventh Circuit’s decision was based on its earlier opinion in Miller v. Southwest Airlines Co., 926 F.3d 898 (7th Cir. 2019) and its ruling in Bryant, in addition to BIPA case law from other Circuits.  In regards to Bryant, the court distinguished the Fox plaintiff’s Section 15(a) claims as being “much broader.”  This was because, the court explained, the plaintiff “does not allege a mere failure to publicly disclose a data-retention policy” and instead alleged that defendant “violated the full range of its Section 15(a) duties by failing to develop, publicly disclose, and comply with a data-retention schedule and guidelines for the permanent destruction of biometric data when the initial purpose for collection ends.”  Id. at *18 (emphasis in original).  Moreover, it was that violation that allegedly “resulted in the unlawful retention of [plaintiff’s] handprint after she left [employment with defendant] and the unlawful sharing of her biometric data”.

This distinction was critical to the Seventh Circuit, as it held that “[a]n unlawful retention of biometric data inflicts a privacy injury in the same sense that an unlawful collection does . . .[t]he BIPA requirement to implement data retention and destruction protocols protects a person’s biometric privacy just as concretely as the statute’s informed-consent regime.  It follows that an unlawful retention of a person’s biometric data is as concrete and particularized an injury as an unlawful collection of a person’s biometric data.”  (emphasis in original).  As such, the Court held the plaintiff satisfied the requirements of Article III standing.  Additionally, relying on Miller, the Court also held the plaintiff in Fox had standing on another independent basis—the plaintiff was a union member and the collection, use, and retention of biometric data are topics for collective bargaining and could be used to win offsetting concessions on wages or other topics.  Miller, 926 F.3d at 902.

So there it is.  Fox, particularly when read in conjunction with Bryant, makes clear to defendants named in BIPA litigation that removal to federal court remains a sound strategic option for a broad range of claims.  It also may mark the end of a trend among some federal courts to dismiss BIPA claims for lack of Article III standing.  Stay tuned.