Even in instances of the parties agreeing on jurisdiction, federal courts still have an obligation to conclude that jurisdiction is proper before moving ahead with assessing the merits of a case. This possibility was vividly displayed in Figueroa v. Kronos Inc., 2020 U.S. Dist. LEXIS 131093 (N.D. Ill. Jul. 24, 2020).

In yet another BIPA class action, plaintiffs bring claims against Kronos for multiple violations of the law. One of these is that Kronos allegedly violated BIPA Section 15(a) when it did not “develop, publish, and comply with a written retention schedule and destruction guidelines.” Figueroa at *5. While neither party challenged the claims being removed to federal court, the Court independently determined that it must first assess whether or not it has appropriate jurisdiction to review the claim arising from BIPA Section 15(a).

The test established in Spokeo, Inc. v. Robbins, is that constitutional standing has three elements: “The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct or the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” 136 S. Ct. 1540, 1547, 194 L. Ed. 2d 635 (2016). Further, the injury in fact must be concrete and particularized, and actual or imminent. Id. at 1548.

The Court promptly determined the first of these requirements, an injury in fact, to be lacking, following the Seventh Circuit’s decision in Bryant v. Compass Group USA, Inc., 958 F. 3d 617 ( 7th Cir. 2020). (Read CPW’s full analysis of this significant case here.) In Bryant, the Court determined that the duty of publishing the retention schedule is owed to the public, and not to a particular individual.  Bryant at 626. In the present case the Court agreed with this finding on the premise that the plaintiffs did not definitively even know that Kronos collected and stored their biometric information, and therefore the lack of publication does not cause them any injury, never mind injury in fact. Figueroa at *10-11.

Turning to the destruction requirement in BIPA Section 15(a), the Court reviewed the precedent set in Gubala v. Time Warner Cable, Inc., 846 F. 3d 909 (7th Cir. 2017). In Gubala the Seventh Circuit assessed a different legal requirement to destroy personally identifiable information once no longer needed for its intended purpose. The Court concluded that even though some risk of harm was present due to the wrongful retention of personally identifiable information that was no longer needed, standing was lacking in the absence of evidence that it had been or would be given away or stolen. Id. at 910. Therefore, the Court in Figueroa likewise concluded that the absence of destruction did not give rise to standing. Figueroa at *11-12.

The plaintiffs alleged that the retention of unlawfully collected biometric data distinguished their claim from Gubala, but the Court was not persuaded. Instead the Court noted that if an entity was acting for malicious purposes, this may be a consideration, but in the case at hand nothing indicated that Kronos’s practices or motives make them a “risky information holder.” Figueroa at *12. Similarly the Court was unpersuaded by a further attempt to distinguish from Gubala stating that the dissemination of the biometric information created a different circumstance than that in the prior case. The Court reasoned that purely sharing with firms hosting data centers is both routine and does not present any real risk of harm or concrete injury. Figueroa at *13.

As a final attempt to distinguish, the plaintiffs alleged that biometric information creates a heightened risk that would not be present for the improper retention of regular personal information. Again, the Court was unconvinced, (including due to the lack of cited authority – always show your work!), because regardless of a possible increase in sensitivity, mere wrongful retention does not give rise to a concrete harm, and there was no indication that the harm was otherwise sufficiently heightened by Kronos’s actions. Id. at *13-14.

The Court therefore remanded the claim regarding BIPA Section 15(a) to state court.

While the Court determined sua sponte that plaintiffs did not have standing to the claim presented in Figueroa on BIPA Section 15(a), the analysis may have been different under a newly proposed federal law. The National Biometric Information Privacy Act of 2020 was proposed in the Senate in early August 2020. Interestingly, the proposed law explicitly states that any “violation [of the law] constitutes an injury-in-fact and a harm to any affected individual.” It remains to be seen if this bill will move forward and potentially become law. Further still, it is unclear whether such a declaration would hold-up against challenge. Regardless of how it fares, it certainly recognizes the complexity of these cases, and the debate over federal standing faced by at least some BIPA class action claim.