On May 5, 2020, the United States Court of Appeals for the Seventh Circuit issued a decision that will have an immediate impact on litigation concerning Illinois’ Biometric Information Protection Act (“BIPA”). The decision in Bryant v. Compass Group USA, Inc., 2020 WL 2121463 (7^th Cir. 2020), puts to rest the question of whether a litigant can establish Article III standing in a federal court for BIPA claims.

Prior to the Bryant decision, a number of federal district courts found BIPA plaintiffs did not have standing to bring an action in federal court because they could not allege an “imminent, concrete and particularized injury-in-fact.” BIPA is a unique law to the extent Illinois state courts have found the failure to provide formal notice to a person before collecting and storing their biometric information is sufficient to establish standing in state court. The Bryant court held, in a decision that is more consistent with Illinois state court decisions, that alleged BIPA violations such as collecting fingerprints without formal notice are potentially “an invasion of…private domain, much like an act of trespass would be.” (“We conclude that a failure to follow section 15(b) of the law leads to an invasion of personal rights that is both concrete and particularized.”)  Even though there are different requirements for standing for federal and state courts, the Bryant decision allows BIPA plaintiffs back into federal courts.

The underlying facts in Bryant are similar to many of the BIPA claims currently working their way through state and federal courts around the country:

• The Plaintiff, Christine Bryant (“Bryant”), had access to a “workplace cafeteria” provided by her employer, Compass, with vending machines that accessed accounts through fingerprints rather than taking cash.

• Bryant claimed she and her coworkers were instructed to scan their fingerprints into the vending system in order to purchase food from the machines or access their accounts.

In her Complaint, Bryant claimed Compass violated BIPA when it “never made publicly available a retention schedule and guidelines for permanently destroying biometric identifiers and information it was collecting and storing.” While Bryant does not deny that she was aware that her biometric information was collected, Bryant claims the failure “to make the requisite disclosures denied her ability to give informed written consent as required by Section 15(b)” of BIPA.

Prior to the Seventh Circuit’s decision, the District Court for the Northern District of Illinois found Bryant’s alleged BIPA violations did not establish Article III standing as they “were bare procedural violations that caused no concrete harm to Bryant…[and] remanded the action to the state court.”  The Seventh Circuit reversed the District Court’s decision and found Bryant had sufficiently alleged concrete harm and had standing to bring the action in the District Court.

The initial analysis for any court to determine whether a litigant has Article III standing to bring an action in federal court begins with three requirements: (1) did the litigant suffer an “actual or imminent, concrete and particularized injury-in-fact; (2) there must be a causal connection between the injury and the conduct complained of; and (3) there must be a likelihood that the injury can be redressed by a favorable decision.” See e.g., Lujan v. Defs. Of Wildlife, 504 U.S. 555, 560-61 (1992). Since a number of district courts had found alleged BIPA violations did not confer standing in federal court, the Bryant court’s Article III standing analysis was limited to the first requirement, whether Bryant suffered an “actual or imminent, concrete and particularized injury-in-fact.”

As seen in many BIPA and other privacy cases, the Seventh Circuit closely examined the United States Supreme Court’s decision in Spokeo, Inc v. Robins, 136 S. Ct. 1540 (2016), where it was held “that a ‘concrete’ injury must actually exist but need not be tangible” in order to meet the first requirement for Article III standing. In building off the Spokio decision, the Bryant court further opined that to have standing, “the plaintiff must show that the statutory violation presented an ‘appreciable risk of harm’ to the underlying concrete interest that [the legislature] sought to protect by enacting the statute.” Groshek v. Time Warner Cable, Inc. 865 F.3d 884, 887 (7^th Cir. 2017). The federal district courts held this requirement was not met when it found allegations that formal notice of biometric information being collected caused a “concrete” injury.

In determining whether this first requirement for Article III standing was met, the Bryant court analyzed the Illinois Supreme Court’s decision in Rosenbach v. Six Flags Entm’t Corp., 432 Ill. Dec. 654 (Ill. 2019).  In this oft-quoted decision, the Illinois Supreme Court in Rosenbach held “[b]ecause section 15(b) of BIPA confers a right to receive certain information from an entity that collects, stores, or uses a person’s biometric information, the violation of that right, standing alone, is an actionable grievance.” More specifically, the Bryant court considered the Illinois Supreme Court’s holding that “through the Act, our General Assembly has codified that individuals possess a right to privacy in and control over their biometric identifiers and biometric information.”  More simply, it is well-settled in Illinois law that “[a] key part of the right to control biometric information is ‘the power to say no by withholding consent.”  Given this reasoning, Illinois state courts found BIPA plaintiffs sufficiently alleged an injury and, therefore, had standing to bring suit in state court.

The Bryant court provided the following analysis to support its holding that the alleged lack of formal notice that biometric data will be collected and stored is sufficient to confer Article III standing in federal court:

When an entity fails to adhere to the statutory procedures and thereby denies someone the ability to make an informed decision about whether to provide her biometric identifier, “the right of the individual to maintain his or her biometric privacy vanishes into thin air” and “[t]he precise harm the Illinois legislature sought to prevent is then realized.” Id. (internal citation and quotation marks omitted). And as Compass emphasizes, the court declared that such a violation “is no mere ‘technicality.’ The injury is real and significant.” Id. In Compass’s view, the Illinois Supreme Court’s characterization of BIPA’s purpose and the nature of the injury is dispositive.

However, the Bryant court also had to address the fact “federal courts and Illinois courts define ‘injury-in-fact’ differently.”  Therefore, the Bryant court had to “independently determine whether BIPA violations Bryant alleges suffice to support Article III standing.”  In reversing the District Court in the Bryant matter and a majority of other district courts in the Seventh Circuit, the Bryant court finds Bryant’s alleged BIPA violations sufficient to trigger Article III standing in federal courts.  More particularly, the Bryant court held the following concerning the failure to allow a plaintiff to give informed consent as mandated by BIPA:

As the Illinois Supreme Court recognized in Rosenbach, the informed-consent regime laid out in section 15(b) is the heart of BIPA. The text of the statute demonstrates that its purpose is to ensure that consumers understand, before providing their biometric data, how that information will be used, who will have access to it, and for how long it will be retained. The judgment of Illinois’s General Assembly is that the sensitivity of biometric information and the risk of identity theft or other privacy or economic harm that may result from its dissemination necessitates that people be given the opportunity to make informed choices about to whom and for what purpose they will relinquish control of that information. Compass’s failure to abide by the requirements of section 15(b) before it collected Smart Market users’ fingerprints denied Bryant and others like her the opportunity to consider whether the terms of that collection and us-age were acceptable given the attendant risks.

BIPA is a unique law to the extent it does not require allegations that personal or biometric information was misused or breached.  The Bryant decision makes the federal court a viable option for BIPA plaintiffs by making standing requirements for federal courts consistent with Illinois state court requirements.

For more information, contact Tressler attorney Todd Rowe at trowe@tresslerllp.com.

The post Seventh Circuit Court Of Appeals Reopens Doors To Federal Courts For BIPA Plaintiffs appeared first on Privacy Risk Report.

Despite having the potential to impact many data collectors, Illinois’ Biometric Information Protection Act (“BIPA”) has received surprisingly little analysis from state or federal courts. A decision issued on October 17, 2019, by the United States District Court for the Northern District of Illinois may limit the number of BIPA cases reaching the federal courts and, in turn, further, limit the development of law addressing BIPA claims.

In Colon v. Dynacast, LLC, 19-cv-4561 (N.D. Ill. Oct. 17, 2019), the Plaintiff, Colon, filed a motion to remand the matter from the Federal Court back to the Circuit Court of Cook County, Illinois. Next, the defendant, Dynacast filed a motion to dismiss. The motion to dismiss was denied as being moot to the extent Colon’s motion to remand was granted and the matter was moved back to state court. Even though this matter was sent back to the state court, the Colon court still provides an interesting analysis of whether a litigant has standing to bring a BIPA case in federal courts.

As seen with many biometric data cases, the Colon matter arises out of allegations that Dynacast, Colon’s employer, used biometric data for their employee time-keeping system. That is, Colon alleges ‘that “each day’ of her employment (from 2013 until January 2018), she was ‘required to place her hand on a panel to be scanned in order to ‘clock in’ and ‘clock-out’ of work.”

Further, in order to support a class action claim, Colon asserted “[a]t least 200 of Defendant’s employees were required to use this biometric time-keeping system.” Colon also claimed that Dynacast failed to inform Colon, in writing, that her biometric data would be collected and did not provide “the specific purpose and length of term for which [her] biometric” information was collected, stored, and used; or “obtain written releases from Plaintiff…before it collected, used, and/or stored” her fingerprint data.” As typically seen in BIPA cases, Colon did not assert any damage beyond simply not receiving formal written notice that her biodata would be collected and stored.

The vast majority of breach cases involve a defendant arguing an action should be dismissed to the extent the plaintiff lacks standing while the plaintiff argues they have standing since they suffered a concrete injury. The roles were reversed in Colon. Here, while arguing this action should be moved back to the state court, Colon argued she lacked Article III standing to allow the matter to remain in federal court. On the other hand, Dynacast argued: “Plaintiff’s injury is sufficiently concrete to confer Article III standing.” Colon was able to take this position in the federal court because she will most likely argue that the BIPA violation alone gives her a viable cause of action in the state court. That is, Colon may not need to even show she suffered a concrete injury when this matter is litigated in state court.

In finding Colon lacked standing and that the case should be remanded back to the state court, the District Court did not appear to be impressed by a BIPA claim based merely on the alleged failure to provide written notice:

That is, the only purported ‘violation of privacy’ was the failure to explain in writing that biometric data was being collected—something that would have been obvious to any employee subject to a fingerprint or hand-scan. But even if this rhetoric referred to activities that could give rise to concrete injuries, “legal conclusions or bare and conclusory allegations…are insufficient” to plead concrete injury and thus confer Article III standing.

The Colon court takes some shots at Colon’s claims before sending it back to state court. One touchstone of BIPA is the requirement that a data collector provides notice, in writing, that biometric information is being collected and stored.  Even though the Colon court finds the failure to provide notice cannot alone give rise to Article III standing, the court does not hold back on Colon’s BIPA’s notification requirement:

The fact that this was not explained in writing does nothing to harm people’s privacy interests because they knew that the data was being collected and did not allege that their data was shared with third parties.

 So too here: Defendant obviously collected Plaintiff’s fingerprint when the fingerprint was taken. No one alleges that Defendant snooped around like Nicholas Cage in National Treasure, surreptitiously gathering Plaintiff’s biometric data off discarded goods. Likewise, Defendant obviously stored the prints—otherwise, the entire authentication system would make no sense. [Citation omitted] Defendant had to compare each print taken at the timecard station to a baseline in order to determine if the employee clocking in or out was in fact who they said they were. Because Plaintiff knew that her data was being collected, Defendant’s failure to go through each procedural formality outlined in BIPA did not present any “appreciable risk of harm to the underlying concrete interest” in privacy, and therefore Plaintiff has not suffered any injury in fact. [citation omitted] Similarly, because Plaintiff has not alleged that her data was given to third-parties, her right to privacy in her biometric data was not compromised.

This case indicates that the federal courts may not be friendly to BIPA plaintiffs and, therefore, we can expect more BIPA claims to end up in state courts. This decision is still worthy of consideration in state court actions since the Colon court goes out of its way to beat up Colon’s BIPA claim. While state courts may not need to consider whether a litigant can establish Article III standing, this decision highlights a fundamental flaw in BIPA. That is, where is the harm if a litigant allows an employer to take a template of their fingerprint but does not provide formal written notice?

For more information, contact Tressler attorney Todd Rowe at trowe@tresslerllp.com.

The post Federal Court Shreds Illinois’ Biometric Statute Before Remanding Case Back To State Court appeared first on Privacy Risk Report.