On May 5, 2020, the Seventh Circuit held that allegations that a defendant violated the Illinois Biometric Information Privacy Act (“BIPA”) by collecting a biometric information without first obtaining informed consent constituted an “injury in fact” sufficient to confer Article III standing.  Bryant v. Compass Group USA, Inc., No. 20-1443.  Prior to this ruling, a majority of federal district courts in Illinois had come to the opposite conclusion, resulting in employers having to litigate BIPA putative class actions in Illinois state court, which has more lenient standing requirements.  (We have blogged about BIPA-related standing issues here and here.)

Background

Plaintiff worked for a call center in Illinois which had a workplace cafeteria with vending machines operated by the Compass Group (“Compass”). The machines did not accept cash; rather, employees had to scan and use their fingerprints to create user accounts and to purchase items.

On August 13, 2019, Plaintiff filed a putative class action in the Circuit Court of Cook County, alleging Compass violated Section 15(b) of BIPA (the informed consent requirement) by never: (1) informing Plaintiff in writing that her biometric identifier was being collected or stored; (2) informing Plaintiff in writing of the specific purpose and length of term for which her fingerprint was being collected, stored, and used; or (3) obtaining Plaintiff’s written release to collect, store, and use her fingerprint.  In addition, Plaintiff alleged that Compass violated Section 15(a) of BIPA (the written policy requirement), because it never made publicly available a written policy setting forth a retention schedule and guidelines for permanently destroying the biometric identifiers it was collecting and storing.

Compass removed the action to federal court under the Class Action Fairness Act, 28 U.S.C. § 1332(d), and Plaintiff moved to remand to the state court, claiming the district court lacked subject-matter jurisdiction because she did not suffer a concrete injury-in-fact necessary to satisfy the federal requirement for Article III standing.  The district court found that Compass’s alleged violations of BIPA were bare procedural violations that caused no concrete harm to Plaintiff and thus remanded the action to the state court.  Compass then appealed to the Seventh Circuit.  In contrast to the usual dynamic, Compass—the defendant—argued that Plaintiff had sufficiently alleged an injury-in-fact and the lawsuit therefore belonged in federal court.

The Seventh Circuit’s Ruling

The issue before the Seventh Circuit was whether Plaintiff’s allegations that Compass’s failure to comply with BIPA’s requirements which resulted in the loss of the right to control her biometric identifiers and information constituted an actual, concrete and particularized injury in fact sufficient to meet Article III’s standing requirement.

Looking to Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1549 (2016), the court held that the Complaint had satisfied the injury-in-fact requirement of Article III with respect to Plaintiff’s claims under Section 15(b). The court reasoned that the informed consent requirement is the “heart of BIPA” and that the text of the statute demonstrates that its purpose is to ensure that individuals understand, before providing their biometric data, how that information will be used, who will have access to it, and for how long it will be retained.  The court continued that Compass’s alleged failure to abide by the requirements of Section 15(b) before it collected users’ fingerprints denied Plaintiff and others the opportunity to consider whether the terms of that collection and usage were acceptable given the purported attendant risks.  The court concluded that this was not a failure to satisfy a purely procedural requirement.  Rather, Compass allegedly withheld substantive information to which Plaintiff was entitled and thereby deprived her of the ability to give the informed consent Section 15(b) mandates.  According to the court, such a deprivation was a concrete injury-in-fact that was particularized to Plaintiff.

Conversely, though, the court concluded that Plaintiff’s claim under Section 15(a) of BIPA did not sufficiently allege a concrete and particularized injury sufficient to confer Article III standing.  The Court reasoned that any duty Compass had under Section 15(a) was owed to the public generally, and not to particular persons whose biometric information it collects, and Plaintiff failed to allege any particularized harm that resulted from Compass’s alleged violation of Section 15(a).

Implications

This decision deepens a circuit split on the issue between the Seventh and Ninth Circuits on the on hand, and the Second Circuit on the other.  However, employers defending BIPA claims in the Seventh Circuit may now have the strategic option of removing BIPA claims to federal court to take advantage of a more stringent class certification analysis under Rule 23 of the Federal Rules of Civil Procedure, and some other employer-friendly BIPA decisions.