On May 5, 2020, the United States Court of Appeals for the Seventh Circuit issued a decision that will have an immediate impact on litigation concerning Illinois’ Biometric Information Protection Act (“BIPA”). The decision in Bryant v. Compass Group USA, Inc., 2020 WL 2121463 (7^th Cir. 2020), puts to rest the question of whether a litigant can establish Article III standing in a federal court for BIPA claims.

Prior to the Bryant decision, a number of federal district courts found BIPA plaintiffs did not have standing to bring an action in federal court because they could not allege an “imminent, concrete and particularized injury-in-fact.” BIPA is a unique law to the extent Illinois state courts have found the failure to provide formal notice to a person before collecting and storing their biometric information is sufficient to establish standing in state court. The Bryant court held, in a decision that is more consistent with Illinois state court decisions, that alleged BIPA violations such as collecting fingerprints without formal notice are potentially “an invasion of…private domain, much like an act of trespass would be.” (“We conclude that a failure to follow section 15(b) of the law leads to an invasion of personal rights that is both concrete and particularized.”)  Even though there are different requirements for standing for federal and state courts, the Bryant decision allows BIPA plaintiffs back into federal courts.

The underlying facts in Bryant are similar to many of the BIPA claims currently working their way through state and federal courts around the country:

• The Plaintiff, Christine Bryant (“Bryant”), had access to a “workplace cafeteria” provided by her employer, Compass, with vending machines that accessed accounts through fingerprints rather than taking cash.

• Bryant claimed she and her coworkers were instructed to scan their fingerprints into the vending system in order to purchase food from the machines or access their accounts.

In her Complaint, Bryant claimed Compass violated BIPA when it “never made publicly available a retention schedule and guidelines for permanently destroying biometric identifiers and information it was collecting and storing.” While Bryant does not deny that she was aware that her biometric information was collected, Bryant claims the failure “to make the requisite disclosures denied her ability to give informed written consent as required by Section 15(b)” of BIPA.

Prior to the Seventh Circuit’s decision, the District Court for the Northern District of Illinois found Bryant’s alleged BIPA violations did not establish Article III standing as they “were bare procedural violations that caused no concrete harm to Bryant…[and] remanded the action to the state court.”  The Seventh Circuit reversed the District Court’s decision and found Bryant had sufficiently alleged concrete harm and had standing to bring the action in the District Court.

The initial analysis for any court to determine whether a litigant has Article III standing to bring an action in federal court begins with three requirements: (1) did the litigant suffer an “actual or imminent, concrete and particularized injury-in-fact; (2) there must be a causal connection between the injury and the conduct complained of; and (3) there must be a likelihood that the injury can be redressed by a favorable decision.” See e.g., Lujan v. Defs. Of Wildlife, 504 U.S. 555, 560-61 (1992). Since a number of district courts had found alleged BIPA violations did not confer standing in federal court, the Bryant court’s Article III standing analysis was limited to the first requirement, whether Bryant suffered an “actual or imminent, concrete and particularized injury-in-fact.”

As seen in many BIPA and other privacy cases, the Seventh Circuit closely examined the United States Supreme Court’s decision in Spokeo, Inc v. Robins, 136 S. Ct. 1540 (2016), where it was held “that a ‘concrete’ injury must actually exist but need not be tangible” in order to meet the first requirement for Article III standing. In building off the Spokio decision, the Bryant court further opined that to have standing, “the plaintiff must show that the statutory violation presented an ‘appreciable risk of harm’ to the underlying concrete interest that [the legislature] sought to protect by enacting the statute.” Groshek v. Time Warner Cable, Inc. 865 F.3d 884, 887 (7^th Cir. 2017). The federal district courts held this requirement was not met when it found allegations that formal notice of biometric information being collected caused a “concrete” injury.

In determining whether this first requirement for Article III standing was met, the Bryant court analyzed the Illinois Supreme Court’s decision in Rosenbach v. Six Flags Entm’t Corp., 432 Ill. Dec. 654 (Ill. 2019).  In this oft-quoted decision, the Illinois Supreme Court in Rosenbach held “[b]ecause section 15(b) of BIPA confers a right to receive certain information from an entity that collects, stores, or uses a person’s biometric information, the violation of that right, standing alone, is an actionable grievance.” More specifically, the Bryant court considered the Illinois Supreme Court’s holding that “through the Act, our General Assembly has codified that individuals possess a right to privacy in and control over their biometric identifiers and biometric information.”  More simply, it is well-settled in Illinois law that “[a] key part of the right to control biometric information is ‘the power to say no by withholding consent.”  Given this reasoning, Illinois state courts found BIPA plaintiffs sufficiently alleged an injury and, therefore, had standing to bring suit in state court.

The Bryant court provided the following analysis to support its holding that the alleged lack of formal notice that biometric data will be collected and stored is sufficient to confer Article III standing in federal court:

When an entity fails to adhere to the statutory procedures and thereby denies someone the ability to make an informed decision about whether to provide her biometric identifier, “the right of the individual to maintain his or her biometric privacy vanishes into thin air” and “[t]he precise harm the Illinois legislature sought to prevent is then realized.” Id. (internal citation and quotation marks omitted). And as Compass emphasizes, the court declared that such a violation “is no mere ‘technicality.’ The injury is real and significant.” Id. In Compass’s view, the Illinois Supreme Court’s characterization of BIPA’s purpose and the nature of the injury is dispositive.

However, the Bryant court also had to address the fact “federal courts and Illinois courts define ‘injury-in-fact’ differently.”  Therefore, the Bryant court had to “independently determine whether BIPA violations Bryant alleges suffice to support Article III standing.”  In reversing the District Court in the Bryant matter and a majority of other district courts in the Seventh Circuit, the Bryant court finds Bryant’s alleged BIPA violations sufficient to trigger Article III standing in federal courts.  More particularly, the Bryant court held the following concerning the failure to allow a plaintiff to give informed consent as mandated by BIPA:

As the Illinois Supreme Court recognized in Rosenbach, the informed-consent regime laid out in section 15(b) is the heart of BIPA. The text of the statute demonstrates that its purpose is to ensure that consumers understand, before providing their biometric data, how that information will be used, who will have access to it, and for how long it will be retained. The judgment of Illinois’s General Assembly is that the sensitivity of biometric information and the risk of identity theft or other privacy or economic harm that may result from its dissemination necessitates that people be given the opportunity to make informed choices about to whom and for what purpose they will relinquish control of that information. Compass’s failure to abide by the requirements of section 15(b) before it collected Smart Market users’ fingerprints denied Bryant and others like her the opportunity to consider whether the terms of that collection and us-age were acceptable given the attendant risks.

BIPA is a unique law to the extent it does not require allegations that personal or biometric information was misused or breached.  The Bryant decision makes the federal court a viable option for BIPA plaintiffs by making standing requirements for federal courts consistent with Illinois state court requirements.

For more information, contact Tressler attorney Todd Rowe at trowe@tresslerllp.com.

The post Seventh Circuit Court Of Appeals Reopens Doors To Federal Courts For BIPA Plaintiffs appeared first on Privacy Risk Report.

Biometric data is playing a larger role in employment law as more employers begin using equipment to scan employees’ fingerprints to clock in for work. Each week more employers are defending themselves against claims by the employees such as the class action lawsuit filed against Patriot Medical Transport in Cook County Circuit Court last month. The employees in the Patriot Medical litigation claim they “have suffered injury from the unlawful collection and storage of their fingerprints, hand geometry or other biometric data.” We can expect these class actions to continue to increase with the increased use of equipment that collects and stores biometric data.

While many of these cases are still in their early stages, the parties in Miller v. Southwest Airlines Co., 18-3476 (7^th Circ. 2018) have already had a decision and are in the midst of an appeal related to equipment used to track employees through biometric data. In their brief submitted to the Seventh Circuit Court of Appeals, the Class Action Plaintiffs, who are “ramp and operations agents who worked and/or work for Southwest at Chicago’s Midway International Airport,” claim Southwest Airline’s timekeeping system violates the Illinois Biometric Information Protection Act (“BIPA”).

Southwest adopted a timekeeping system that uses biometric identifiers and biometric information (fingerprints) to track their employees’ time at work. The Class Action Plaintiffs claim Southwest’s timekeeping system requires them to scan their biometric data into the system even though Southwest “did not obtain the requisite written consent, and did not publish a publicly available retention and destruction schedule.” In addition to claiming injuries from the alleged BIPA violation, the Class Action Plaintiffs “also alleged that they lost compensation as a result of Southwest’s actions as they ‘would not have agreed to work for [Southwest], at least not for the compensation they received, had they been informed pursuant to BIPA of the nature of Defendant’s biometric timekeeping system.’”

The Class Action Plaintiffs stated the question for the Seventh Circuit Court of Appeals as follows:

Did the district court err when it ruled that Plaintiffs-Appellants’ claims under the Illinois Biometric Privacy Information Act, 740 ILCS 14/1, et seq., were preempted by the Railway Labor Act, 45 U.S.C. § 151, et seq., because they constitute a “minor” dispute?

While this litigation is primarily based on employment law and related to issues between Southwest and its employees, there are a number of points where the Seventh Circuit will conceivably need to consider the reach of BIPA. Specifically, this litigation ended up before the Seventh Circuit when the U.S. District Court for the Northern District of Illinois held the Class Action Plaintiffs’ BIPA claim was preempted as a minor dispute under the Railway Labor Act (“RLA”).The RLA is intended “to promote stability in labor-management relations by providing a comprehensive framework for resolving labor disputes” by establishing a “mandatory arbitral mechanism for the ‘prompt and orderly settlement’ of two classes of disputes, characterized as ‘major’ and ‘minor’ disputes.’”

Specifically, the District Court reasoned that the Class Action Plaintiff’s Collective Bargaining Agreement (“CBA”) would govern whether the Class Action Plaintiffs were injured by the alleged BIPA violation:

…Plaintiffs further allege they ‘would not have agreed to work for Defendant, at least not for the compensation they received, had they been informed pursuant to BIPA of the nature of Defendant’s biometric timekeeping system.’ (Id.) Among the relief Plaintiffs seek is compensation for the commercial value of their biometric information. 

Because the CBAs govern the rates of pay, rules, and working conditions of Plaintiffs’ employment, Plaintiffs’ BIPA claim ‘requires interpretation of the CBA to determine whether [Defendant] has the authority to use a particular timekeeping system for employees.’ Johnson, 2018 WL 3636556, at *2. Specifically, the CBAs dictate employees’ wage rules, rates of pay, and bonuses. (See CBA, Jordan Decl. Ex. A (Dkt. No. 281) at Art. 28.) Defendant and TWU 555 negotiated the wage scales applicable to Plaintiffs, as well as other pay provisions relating to premium pay. (Jordan Decl. Ex. A (Dkt. No. 28-1) ¶ 8.) 

***

Plaintiffs’ BIPA claim cannot be resolved without interpreting the wage provisions of the CBAs and the relevant bargaining history to determine whether the wages TWU 555 and Defendant negotiated were intended to compensate employees for all conditions of their employment, including use of the biometric timekeeping system. Likewise Plaintiffs’ challenge to Defendant’s decision to implement the biometric timekeeping system requires an interpretation as to whether the decision falls within the scope of Defendant’s right to ‘manage and direct the work force.’”…

In short, the District Court ruled the Class Action Plaintiffs’ BIPA claim was a “minor dispute” under the RLA and dismissed their claim.

While there are a number of points where BIPA and employment intersect in this litigation, the Class Action Plaintiffs take positions that will undoubtedly test the reach of BIPA. For example, in addressing whether Southwest gave proper notice of the new timekeeping system, the Class Action Plaintiffs argue:

First, Southwest’s alleged notice was given in 2005, three years before BIPA had even been enacted into law, and therefore had nothing to do with BIPA (or with the information required to be disclosed under BIPA). Second, Southwest produced no evidence that such notice was given in writing as required under BIPA. See 740 ILCS 14/15. Third, when it notes merely that the Union “did not object or seek an amendment” to the CBA in response (ECF No. 28-3 ¶ 10), Southwest conceded that it did not obtain written consent under BIPA to collect biometrics. In short, Southwest provided no evidence whatsoever of BIPA-compliant notice to, or BIPA compliant consent from, anyone—be it the Union or otherwise. As such, interpretation of the CBAs is not required to resolve Appellants’ BIPA claim. The District Court erred when it found otherwise. 

The use of biometric data by employers is one of the first areas we can expect to see BIPA be tested by litigants. We have already seen a number of developments in 2019 related to BIPA when the Illinois Supreme Court in Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186 (Jan. 25, 2019). The scheduling order in Southwest Airlines indicates the briefing should be complete by April 11, 2019.  Business owners and their insurers will need to watch the progression of this litigation in this decision and many other lawsuits in Illinois in order to fully access whether their use of biometric data exposes them to liability from customers and employees.

The post Illinois’ Biometric Information Protection Act Gets More Tangled With Employment Law appeared first on Privacy Risk Report.