The Seventh Circuit has waded back into the waters of Article III standing for claims under the Illinois Biometric Information Privacy Act (BIPA) (740 ILCS § 14/1 et seq) with its decision in Fox v. Dakkota Integrated Sys., LLC, No. 20-2782, 2020 U.S. App. LEXIS 36148 (7th Cir. Nov. 17, 2020). Earlier this year, in Bryant v. Compass Group USA, Inc., the Seventh Circuit ruled a plaintiff has standing to bring a claim under Section 15(b), BIPA’s notice and consent provision, but not for a Section 15(a) claim that alleges the failure to publicly disclose a retention and destruction policy for biometric data. 958 F.3d 617, 619 (7th Cir. 2020) (see May 2020 GT Alert). Now, in Dakkota, the Seventh Circuit has concluded there is Article III standing where the Section 15(a) claim alleges the defendant had no retention and destruction policy for biometric data.

In 2008, Illinois enacted BIPA to regulate how private entities may collect and use an individual’s biometric data (identifiers, such as fingerprints, hand prints, facial geometry, or retina scans, and information based on those identifiers) for certain non-health-related reasons. Illinois is one of a few states that has enacted a statute to protect biometric information privacy, and it is the only state that provides a private right of action. Section 15(b) provides that no private entity may collect, store, or use biometric information without first giving notice to, and obtaining a written release or consent from, the subject. Section 15(a) requires private entities in possession of biometric data to develop, publicly disclose, and comply with a retention schedule and guidelines for permanently destroying the biometric data when the initial purpose for collection ends or after three years.

Standing to assert claims for BIPA violations, without alleging actual damages, was settled in Illinois state court nearly two years ago with the Illinois Supreme Court’s decision in Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186. In Rosenbach, the Supreme Court held that plaintiffs have standing as “aggrieved” persons under BIPA by alleging a mere statutory violation, without any further tangible injury.

Standing in federal courts, however, requires satisfying Article III – specifically, a plaintiff must suffer an invasion of a legally protected interest that is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.” Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992). In its 2016 decision in Spokeo v. Robins, 136 S. Ct. 1540 (2016), the U.S. Supreme Court noted an injury need not be tangible to be concrete, and Congress or a state legislature may identify and elevate historically non-cognizable intangible harms to the status of cognizable injuries.

In Bryant, the Seventh Circuit held that Article III standing exists for alleged violations of BIPA’s notice and consent requirements under Section 15(b) because such a violation would be an “invasion of [plaintiff’s] private domain, much like an act of trespass would be.” 958 F.3d at 624. However, the Seventh Circuit found that plaintiff lacked standing for the Section 15(a) claim because plaintiff alleged only a violation of the obligation to publicly disclose its data retention and destruction protocols. The Court reasoned that the failure to make a retention and destruction policy publicly available is a duty “owed to the public generally, not to any particular persons whose biometric information the entity collects.” Id. at 626. As such, plaintiff had merely alleged a bare procedural violation divorced from any “particularized harm that [] resulted from violations of Section 15(a)” and, therefore, lacked standing to pursue the claim. Id.

In its recent decision in Dakkota, the Seventh Circuit revisited Section 15(a) to consider standing to assert a violation of the statutory requirement to maintain retention and destruction policies for biometric data. The Dakkota Court emphasized that plaintiff’s claim in Bryant “was extremely narrow, alleging only a violation of the section 15(a) duty to publicly disclose data retention and destruction protocols,” and that Bryant did not address standing for claims alleging violations of Section 15(a)’s additional requirements. See Dakkota, 2020 U.S. App. LEXIS 36148, at *18 (analyzing the amended order following a petition for rehearing in Bryant, 2020 U.S. App. LEXIS 20468, at *1-2 (7th Cir. June 30, 2020)).

The plaintiff in Dakkota, a unionized employee, alleged that her employer and a third-party database administrator violated all obligations of Section 15(a), including failing to maintain and comply with biometric data retention and destruction policies. The failure to comply with such policies, plaintiff alleged, resulted in the unlawful retention of her biometric data after she left her employment with defendant. The Seventh Circuit agreed, finding the “unlawful retention of a person’s biometric data [under Section 15(a)] is as concrete and particularized an injury as unlawful collection of a person’s biometric data [under section 15(b)]” because both violate a duty owed to the individual. Id. at *19. The Seventh Circuit vacated the district court’s dismissal of plaintiff’s Section 15(a) claim and remanded to determine whether the claim was preempted by the Labor Management Relations Act because plaintiff was a unionized employee. Id. at *22.

With these rulings, the Seventh Circuit has now found that Article III standing can exist for both Section 15(a) and 15(b) claims. Although plaintiffs will often not know, at the pleading stage, whether a defendant maintains a biometric data retention and destruction policy, most BIPA plaintiffs allege this nevertheless. In Dakkota, the Seventh Circuit has concluded that such claims can be made – or kept – in federal court.