Seventh Circuit Finds that Certain BIPA Violations Cause Injury Sufficient to Confer Article III Standing

By Stefan Dandelles, co-managing partner of the KD Chicago office and chair of the Fidelity & Surety practice group, and Jean Liu, attorney in KD Chicago

The Illinois Biometric Information Privacy Act (“BIPA”) was enacted to regulate the collection of biometric information. Section 15(a) of BIPA generally requires that a private entity in possession of biometric identifiers or biometric information develop and make publicly available a written retention policy, and Section 15(b) of BIPA requires that the private entity provide specific notice to and obtain written consent from the person whose biometrics the entity seeks to obtain. 740 ILCS 14/15(a)-(b). Notably, BIPA provides a private right of action to any individual “aggrieved” by a violation of the statute and provides for damages of at least $1,000 per negligent violation and $5,000 per intentional or willful violation of BIPA. Id. at 14/20.  

In January 2019, the Illinois Supreme Court held in Rosenbach v. Six Flags Entm’t Corp., 129 N.E.3d 1197, 1207 (Ill. 2019), that “an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under [BIPA], in order to qualify as an ‘aggrieved’ person and be entitled to seek liquidated damages and injunctive relief pursuant to [BIPA].” However, the Illinois Supreme Court’s finding in Rosenbach appeared to conflict with the U.S. Supreme Court’s ruling in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016) where the U.S. Supreme Court held that Article III standing requires a concrete harm beyond a bare procedural violation. Indeed, the majority of courts in the Seventh Circuit has found that plaintiffs alleging only violations of Sections 15(a) and 15(b), without some further harm, do not have constitutional standing to sustain their lawsuits.

On May 5th, 2020, in addressing what it considered a question of first impression, the Seventh Circuit issued its much anticipated opinion in Bryant v. Compass Group USA, Inc., No. 20-1443 (7th Cir. May 5, 2020), and determined whether, for federal-court purposes, a person who has suffered from a violation of the disclosure and informed consent obligations under BIPA has suffered the kind of injury-in-fact that supports Article III standing. In a departure from the trend set by the lower courts, the Seventh Circuit held in Bryant that “a failure to follow Section 15(b) of [BIPA] leads to an invasion of personal rights that is both concrete and particularized.” In Bryant, a call center employee used a vending machine owned and operated by Compass Group USA, Inc. By scanning her fingerprint on the vending machine, the employee was able to purchase items from the machine. The employee alleged that in violation of Section 15(a) of BIPA, Compass never made publicly available a retention schedule for its collection and storage of her fingerprints, and in violation of Section 15(b) of BIPA, neither provided written notice of the reason and duration for which her fingerprints were being stored nor obtained Bryant’s written release to collect, store, and use her fingerprint. After Compass removed the action to federal court under the Class Action Fairness Act, the employee moved to remand the action back to state court, claiming that the federal court lacked subject-matter jurisdiction because she had no concrete injury-in-fact as required under Article III. The district court agreed with the employee, finding that Compass’s alleged BIPA violations were bare procedural violations that caused the employee no concrete harm, and remanded the action to the state court. Compass appealed.

In analyzing whether the employee had the requisite Article III standing to sustain her lawsuit in federal court, the Seventh Circuit found that Compass’s failure to satisfy the requirements set forth in Section 15(b) of BIPA gave rise to a concrete injury-in-fact, noting that:

. . . Compass withheld substantive information to which Bryant was entitled and thereby deprived her of the ability to give the informed consent section 15(b) mandates. Equipped with the missing information, she may have chosen not to use the vending machines and instead brought her own lunch or snacks. Or she may have opted for the convenience of the machines. She did not realize that there was a choice to be made and what the costs and benefits were for each option. This deprivation is a concrete injury-in-fact that is particularized to Bryant. She thus meets the requirements for Article III standing on her section 15(b) claim.
 
However, the Seventh Circuit rejected that Compass’s alleged Section 15(a) violation gave rise to a concrete injury-in-fact, noting that:

Section 15(a) obligates private entities that collect biometric information to make publicly available a data retention schedule and guidelines for permanently destroying collected biometric identifiers and information. In contrast to the obligations set forth under section 15(b), the duty to disclose under section 15(a) is owed to the public generally, not to particular persons whose biometric information the entity collects. This provision is not part of the informed-consent regime, and Bryant allege no particularized harm that resulted from Compass’s violation of section 15(a).

As plaintiffs continue to bring lawsuits under BIPA, the Seventh Circuit’s decision in Bryant will lower the bar for plaintiffs to sustain an action in federal court.