On May 5, 2020, the United States Court of Appeals for the Seventh Circuit issued a decision that will have an immediate impact on litigation concerning Illinois’ Biometric Information Protection Act (“BIPA”). The decision in Bryant v. Compass Group USA, Inc., 2020 WL 2121463 (7th Cir. 2020), puts to rest the question of whether a litigant can establish Article III standing in a federal court for BIPA claims.
Prior to the Bryant decision, a number of federal district courts found BIPA plaintiffs did not have standing to bring an action in federal court because they could not allege an “imminent, concrete and particularized injury-in-fact.” BIPA is a unique law to the extent Illinois state courts have found the failure to provide formal notice to a person before collecting and storing their biometric information is sufficient to establish standing in state court. The Bryant court held, in a decision that is more consistent with Illinois state court decisions, that alleged BIPA violations such as collecting fingerprints without formal notice are potentially “an invasion of…private domain, much like an act of trespass would be.” (“We conclude that a failure to follow section 15(b) of the law leads to an invasion of personal rights that is both concrete and particularized.”) Even though there are different requirements for standing for federal and state courts, the Bryant decision allows BIPA plaintiffs back into federal courts.
The underlying facts in Bryant are similar to many of the BIPA claims currently working their way through state and federal courts around the country:
- The Plaintiff, Christine Bryant (“Bryant”), had access to a “workplace cafeteria” provided by her employer, Compass, with vending machines that accessed accounts through fingerprints rather than taking cash.
- Bryant claimed she and her coworkers were instructed to scan their fingerprints into the vending system in order to purchase food from the machines or access their accounts.
In her Complaint, Bryant claimed Compass violated BIPA when it “never made publicly available a retention schedule and guidelines for permanently destroying biometric identifiers and information it was collecting and storing.” While Bryant does not deny that she was aware that her biometric information was collected, Bryant claims the failure “to make the requisite disclosures denied her ability to give informed written consent as required by Section 15(b)” of BIPA.
Prior to the Seventh Circuit’s decision, the District Court for the Northern District of Illinois found Bryant’s alleged BIPA violations did not establish Article III standing as they “were bare procedural violations that caused no concrete harm to Bryant…[and] remanded the action to the state court.” The Seventh Circuit reversed the District Court’s decision and found Bryant had sufficiently alleged concrete harm and had standing to bring the action in the District Court.
The initial analysis for any court to determine whether a litigant has Article III standing to bring an action in federal court begins with three requirements: (1) did the litigant suffer an “actual or imminent, concrete and particularized injury-in-fact; (2) there must be a causal connection between the injury and the conduct complained of; and (3) there must be a likelihood that the injury can be redressed by a favorable decision.” See e.g., Lujan v. Defs. Of Wildlife, 504 U.S. 555, 560-61 (1992). Since a number of district courts had found alleged BIPA violations did not confer standing in federal court, the Bryant court’s Article III standing analysis was limited to the first requirement, whether Bryant suffered an “actual or imminent, concrete and particularized injury-in-fact.”
As seen in many BIPA and other privacy cases, the Seventh Circuit closely examined the United States Supreme Court’s decision in Spokeo, Inc v. Robins, 136 S. Ct. 1540 (2016), where it was held “that a ‘concrete’ injury must actually exist but need not be tangible” in order to meet the first requirement for Article III standing. In building off the Spokio decision, the Bryant court further opined that to have standing, “the plaintiff must show that the statutory violation presented an ‘appreciable risk of harm’ to the underlying concrete interest that [the legislature] sought to protect by enacting the statute.” Groshek v. Time Warner Cable, Inc. 865 F.3d 884, 887 (7th Cir. 2017). The federal district courts held this requirement was not met when it found allegations that formal notice of biometric information being collected caused a “concrete” injury.
In determining whether this first requirement for Article III standing was met, the Bryant court analyzed the Illinois Supreme Court’s decision in Rosenbach v. Six Flags Entm’t Corp., 432 Ill. Dec. 654 (Ill. 2019). In this oft-quoted decision, the Illinois Supreme Court in Rosenbach held “[b]ecause section 15(b) of BIPA confers a right to receive certain information from an entity that collects, stores, or uses a person’s biometric information, the violation of that right, standing alone, is an actionable grievance.” More specifically, the Bryant court considered the Illinois Supreme Court’s holding that “through the Act, our General Assembly has codified that individuals possess a right to privacy in and control over their biometric identifiers and biometric information.” More simply, it is well-settled in Illinois law that “[a] key part of the right to control biometric information is ‘the power to say no by withholding consent.” Given this reasoning, Illinois state courts found BIPA plaintiffs sufficiently alleged an injury and, therefore, had standing to bring suit in state court.
The Bryant court provided the following analysis to support its holding that the alleged lack of formal notice that biometric data will be collected and stored is sufficient to confer Article III standing in federal court:
When an entity fails to adhere to the statutory procedures and thereby denies someone the ability to make an informed decision about whether to provide her biometric identifier, “the right of the individual to maintain his or her biometric privacy vanishes into thin air” and “[t]he precise harm the Illinois legislature sought to prevent is then realized.” Id. (internal citation and quotation marks omitted). And as Compass emphasizes, the court declared that such a violation “is no mere ‘technicality.’ The injury is real and significant.” Id. In Compass’s view, the Illinois Supreme Court’s characterization of BIPA’s purpose and the nature of the injury is dispositive.
However, the Bryant court also had to address the fact “federal courts and Illinois courts define ‘injury-in-fact’ differently.” Therefore, the Bryant court had to “independently determine whether BIPA violations Bryant alleges suffice to support Article III standing.” In reversing the District Court in the Bryant matter and a majority of other district courts in the Seventh Circuit, the Bryant court finds Bryant’s alleged BIPA violations sufficient to trigger Article III standing in federal courts. More particularly, the Bryant court held the following concerning the failure to allow a plaintiff to give informed consent as mandated by BIPA:
As the Illinois Supreme Court recognized in Rosenbach, the informed-consent regime laid out in section 15(b) is the heart of BIPA. The text of the statute demonstrates that its purpose is to ensure that consumers understand, before providing their biometric data, how that information will be used, who will have access to it, and for how long it will be retained. The judgment of Illinois’s General Assembly is that the sensitivity of biometric information and the risk of identity theft or other privacy or economic harm that may result from its dissemination necessitates that people be given the opportunity to make informed choices about to whom and for what purpose they will relinquish control of that information. Compass’s failure to abide by the requirements of section 15(b) before it collected Smart Market users’ fingerprints denied Bryant and others like her the opportunity to consider whether the terms of that collection and us-age were acceptable given the attendant risks.
BIPA is a unique law to the extent it does not require allegations that personal or biometric information was misused or breached. The Bryant decision makes the federal court a viable option for BIPA plaintiffs by making standing requirements for federal courts consistent with Illinois state court requirements.