The U.S. Court of Appeals for the Seventh Circuit recently held that a plaintiff alleging violations of the Illinois Biometric Information Privacy Act (BIPA) has Article III standing. The decision confirms that BIPA class actions are not going to recede anytime soon. 

The Seventh Circuit now joins the Ninth Circuit in finding that a BIPA plaintiff satisfied Article III standing, albeit on different grounds. Relying on the Supreme Court’s decision in Spokeo, the court stated that the plaintiff’s allegations that her biometric information was taken without her informed consent were itself sufficient to show an injury-in-fact and confer Article III standing. 

In Bryant v. Compass Group USA, Inc., the plaintiff asserted a putative BIPA class action against an owner and operator of vending machines that use fingerprint scans instead of currency. The plaintiff alleged that the defendant failed to inform her that her biometric information (in this case, her fingerprint) was being taken and stored, or to obtain her consent. The plaintiff alleged that the defendant violated her rights, and the rights of the putative class members, under BIPA. The plaintiff originally filed her claim in Illinois state court, but the defendant removed to federal court under the Class Action Fairness Act (CAFA). The plaintiff then sought to remand the case back to state court, arguing, in something of a “role reversal,” that she lacked Article III standing to pursue her claims in federal court. The district court agreed, and remanded. The defendant appealed, and the Seventh Circuit reversed.

Finding that the plaintiff had Article III standing, the court explained that the plaintiff was not alleging a “bare procedural violation; [she alleged] an invasion of her private domain, much like an act of trespass would be.” The court went further, stating that the failure to provide notice and obtain the plaintiff’s consent, as BIPA requires, may inflict an injury that is sufficiently concrete “if the plaintiff establishes that the withholding impaired her ability to use the information in a way the statute envisioned.” 

According to the court, because the defendant failed obtain the plaintiff’s informed consent – which is at the heart of BIPA – it deprived her of the opportunity to consider the risks of providing her biometric information to the defendant. The court found that this was not a purely procedural failure; rather, the defendant withheld substantive information to which the plaintiff was entitled. Had she been given this information, the court reasoned, the plaintiff may have decided not to use the vending machine. Thus, the court found that because the defendant allegedly withheld substantive information that could have affected her decision to provide her biometric information, the deprivation of the information was a concrete injury-in-fact.

While the court found that the plaintiff had Article III standing with respect to her claim that the defendant had failed to give her proper notice and obtain written consent, it held that the plaintiff did not have standing to assert a claim that the defendant failed to disclose information concerning how her biometric information was retained. In contrast to the notice and consent requirement, the court explained that BIPA’s retention disclosure requirement is owed to the public generally, not the plaintiff in particular. As such, the plaintiff could not show a particularized harm, and lacked standing to assert such a claim.

The Compass decision deepens a circuit split between the Seventh and Ninth Circuits on one side, and the Second Circuit’s decision in Santana v. Take-Two Interactive Software Inc. on the other. Thus, it remains to be seen whether the Supreme Court will be called upon to resolve the issue of Article III standing for BIPA plaintiffs. For now, the Compass case is a significant development in the BIPA litigation landscape. 

Illinois remains the epicenter of BIPA litigation, and since the Illinois Supreme Court’s Rosenbach decision, plaintiffs’ counsel’s preferred venue has been state court. Assuming that grounds exist for removal jurisdiction, like under CAFA, the Compass decision provides a clear path for litigating BIPA class actions in federal court. That said, while federal court may sometimes be a preferable venue for employers, defense of BIPA class actions still presents the same substantive challenges for employers. Employers would do well to take this decision as yet another reminder to ensure that if they use biometric systems for their workforce, BIPA-compliant policies and practices are in place.