Recently, the U.S. Seventh Circuit Court of Appeals held that a putative class action lawsuit alleging a technical violation of the Illinois Biometric Information Privacy Act (BIPA) was sufficient to establish the Article III standing required in order to proceed in federal court, reversing the District Court’s dismissal of the claims. Only time will tell the full impact of this ruling but it does have the potential to be an important precedent that any business operating in Illinois and collecting fingerprints or utilizing facial-recognition technology must be aware of. Beyond its potential impact on Illinois businesses, the ruling is another decision interpreting the Supreme Court’s 2016 decision in Spokeo, Inc. v. Robins and the requirements set forth in that opinion for establishing Article III standing, and particularly the injury-in-fact prong of the standing analysis.
The plaintiff, Christine Bryant, worked for a call center in Illinois which had a workplace cafeteria with vending machines operated by the Compass Group. The machines did not accept cash and instead, employees had to scan and use their fingerprints to create user accounts and to purchase items.
Bryant initially filed a putative class action lawsuit in state court in the Circuit Court of Cook County. Her complaint alleged that Compass violated Section 15(b) of BIPA, which contains the requirement to obtain informed consent of individuals, by failing to: (1) inform her in writing that her biometric identifier was being collected or stored; (2) inform her in writing of the specific purpose and length of term for which her fingerprint was being collected, stored, and used; or (3) obtain her written release to collect, store, and use her fingerprint. Bryant’s complaint additionally alleged that Compass had also violated another section of BIPA, Section 15(a), which requires private entities that collect biometric information to make publicly available a data retention schedule and guidelines for permanently destroying the collected biometric identifiers, by failing to make such a written policy available to her or the other putative class members.
Following the filing of Bryant’s complaint in state court, Compass removed the action to federal court under the Class Action Fairness Act, 28 U.S.C. § 1332(d). In a somewhat unusual twist, it was the plaintiff who argued that she lacked Article III standing required to litigate her claims in federal court. Bryant argued that what she alleged in her complaint were bare procedural violations that did not constitute an injury-in-fact under Spokeo. The district court agreed with Bryant and remanded the action to state court. Compass appealed the district court’s ruling to the Seventh Circuit. This set up an odd dynamic on appeal where Compass, the defendant, argued that Bryant’s allegations did constitute an injury-in-fact sufficient to confer subject matter jurisdiction on the federal court.
Compass’s primary argument in favor of standing was that the Illinois legislature, bypassing BIPA, elevated to protectable status an individual’s right to control his or her own biometric identifiers and information. The Court agreed with Compass with regard to Bryant’s claims concerning violations of Section 15(b) of BIPA. Relying on Justice Thomas’s concurrence in Spokeo, the Court focused on whether Bryant’s claims sought to vindicate a private right or a public one, which the Court characterized as “a useful distinction.” The Court reasoned that the disclosure requirements in Section 15(b) of BIPA protect a private right by granting individuals a right to be fully informed as to how their biometric information will be used before deciding to disclose such information. By contrast, the Court held that the public disclosure requirements in Section 15(a) of BIPA protect a public right because Section 15(a) creates an obligation to the public generally. Consequently, the Court only found the injury-in-fact requirement satisfied with regard to Bryant’s Section 15(b) claims but not her Section 15(a) claims.