The law related to Illinois Biometric Information Protection Act (“BIPA”) came to a halt over the last year or so while the Illinois Supreme Court analyzed what constitutes an injury under the Act. As expected, courts have started to once again visit the various legal issues related to biometric data now that the Rosenbach decision has been issued. Now that BIPA cases are moving through the courts again, one major issue will be what is the proper venue for these cases as many BIPA claims intertwine state and federal laws.

The Seventh Circuit recently undertook an analysis of the Illinois Biometric Information Protection Act (“BIPA”) by consolidating two cases involving claims by employees of two separate airlines. In Miller v. Southwest Airlines Co./Johnson v. United Airlines, Inc., 2019 WL 2462664 (June 13, 2019), the Seventh Circuit analyzed a number of procedural and statutory requirements involved in filing a BIPA claim. At first blush, the question presented by the Seventh Circuit appears to be narrow:  “whether persons who contend that air carriers have violated state law by using biometric identification in the workplace must present these contentions to an adjustment board under the Railway Labor Act (RLA), 45 U.S.C. §§ 151–88, which applies to air carriers as well as railroads. 45 U.S.C. § 181?”  However, while the analysis of these cases may be driven by the RLA–an act that applies only to unions–the Seventh Circuit decision provides insight on many procedural aspects related to alleged biometric violations.

The facts giving rise to the two lawsuits were similar to Southwest Airlines and United Airlines maintained timekeeping systems that requiring workers to clock in and out with their fingerprints. The class action plaintiffs in both cases claimed the airlines implemented biometric systems without proper consent, failed to publish protocols related to use of the systems and improperly disclosed their information when the airlines used a third-party vendor to oversee the system.

• Southwest Airlines Case

District Judge Marvin E. Aspen in the District Court for the Northern District of Illinois held the class action plaintiffs had standing under Article III but still dismissed the suit against Southwest Airlines for improper venue. Specifically, Judge Aspen found the matter should be litigated before an adjustment board under the Railway Act rather than in state or federal court in order to give the class action plaintiff’s union the opportunity to address the alleged BIPA violations.

• United Airlines Case

The litigation against United Airlines originated in state court but was removed by United Airlines to federal court based on United Airlines’ claim that there was a federal-question presented by the Railway Labor Act and the Class Action Fairness Act.  District Judge Virginia Kendall reached the same conclusion as Judge Aspen in the Southwest Airlines case but dismissed the United Airlines Case based on a finding that the complaint failed to present an actionable case or controversy.

• Standing And Damages

After consolidating these cases and reviewing the issues, the Seventh Circuit held the airline employees had standing to sue and, while United’s motion to remove was granted based on federal question jurisdiction, the cases should be litigated before an adjustment board governed by the Railway Labor Act.

In short, the Seventh Circuit found the involvement of unions required the analysis of whether the plaintiffs have standing to be slightly different from most data breach or privacy cases:

The prospect of a material change in workers’ terms and conditions of employment gives these suits a concrete dimension that Spokeo, Groshek, and Casillas lacked. Either the discontinuation of the practice, or the need for the air carriers to agree to higher wages to induce unions to consent, presents more than a bare procedural dispute. See Robertson v. Allied Solutions, LLC, 902 F.3d 690, 697 (7th Cir. 2018). (“Article III’s strictures are met not only when a plaintiff complains of being deprived of some benefit, but also when a plaintiff complains that she was deprived of a chance to obtain a benefit.”)

With the Seventh Circuit’s reference to Spokeo and similar cases we can expect defendants to argue that the Seventh Circuit was not convinced that BIPA claimants can survive motions to dismiss without injuries that are “particular and concrete.”

On the other hand, we can expect plaintiffs to argue the Spokeo analysis has no relevance because lack of proper consent is a violation under BIPA and, therefore, employees and customer are “aggrieved” within the meaning of the Act. Many of the BIPA cases have not progressed far enough through the courts to allow a full analysis of whether class action plaintiffs need to show independent injury beyond improper notification.

• Notice To Union Representatives

In addressing whether the airlines gave proper notice as required by BIPA, the Seventh Circuit examined whether the unions were provided with sufficient information to consent to “how workers clock in and out.” The Seventh Circuit provided the following analysis concerning notification for union members:

BIPA “provides that a worker or an authorized agent may receive necessary notices and consent to the collection of biometric information.” 740 ILCS 14/15(b). Based on this statutory language, the Seventh Circuit states “We reject plaintiffs’ contention that a union is not a ‘legally authorized representative’ for this purpose. Neither the statutory text nor any decision by a state court suggests that Illinois wants to exclude a collective-bargaining representative from the category of authorized agents.

Admittedly, the involvement of the airline unions pushes the Seventh Circuit to examine issues that may not impact the vast majority of BIPA cases where the class action plaintiffs may not belong to a union. However, many defendants will be able to take the position that their case is not over merely because the class action plaintiffs did not receive notification.

• Removal From State Court To Federal Court

The Seventh Circuit did not have to address whether these matters could be removed from state court to federal court. That is, the Seventh Circuit could have left its analysis at an adjustment board operating under the Railway Act should address the BIPA claims. The Court still addresses this question and allows for the inference that removal is appropriate in BIPA cases based on diversity of citizenship:

Given our conclusion that the federal-question jurisdiction supports removal, we need not remand for the district court to explore the question whether on the date the case was removed, one class member was a citizen of Wisconsin or Indiana, or conceivably some third state other than Illinois or Delaware—say, a citizen of California temporarily detailed to work at O’Hare.

While the Seventh Circuit did not have to address this question, the Court acknowledged the fact that many BIPA cases filed in state court may be removed to federal court because there are likely going to be employees that reside outside of Illinois. Therefore, removal may be an option in the vast majority of BIPA class actions when Illinois corporations have a large number of employees. Further, this question will become even more important as BIPA claims brought by customers become more routine.

• These Questions Are Not Going Away

Outside the procedural aspects of BIPA ligation, the full impact of the use of equipment to collect and store biometric data will be unclear until courts provide guidance on these issues.  Further, the bounds of biometric laws will be tested as this equipment begins to be increasingly used on the general public outside the context of employees. For example, just last week, there were a number of reports about the use of biometric equipment on air travelers:

TSA is testing a biometrics system, including at the busy Atlanta airport, that uses Customs and Border Protection databases to verify customers’ identities when they check in, pass through security and board their flights.The ultimate goal: Eliminate the need to carry a boarding pass, passport or other identification — with cameras and computers verifying travelers’ identities.

It will be interesting to see how biometric equipment will be received by air travelers.  Of course, air travel customers are different from employees as they can simply switch to a competitor that does not use biometric gathering equipment to register their opposition to the collection and use of their information. Therefore, if there is a true backlash against this equipment, we may see companies abandon the use of this equipment for customers.

The post Seventh Circuit’s Recent Decision Indicates Courts May Be Willing To Chip Away At BIPA appeared first on Privacy Risk Report.

The recent decision in Blue Book Serv., Inc. v. Amerihua Produce, Inc., 2018 WL 4181482 (Aug. 31, 2018) sheds light on how damages may be calculated in data breach cases.  After analyzing whether an accounting expert was qualified to offer his opinion on damages, the District Court for the Northern District of Illinois addressed accounting methods used by the expert to calculate damages related to a data breach. While courts have weighed expert witness credibility and methods in numerous cases before, this decision is the most thorough analysis of expert testimony in the context of a data breach case.

The plaintiff in Blue Book provided a subscription service offering proprietary information related to the produce industry. At some point, Blue Book’s proprietary information was posted on another website without its authorization.  After sending a cease and desist letter to the website displaying Blue Book’s information, Blue Book determined, the defendant, Amerihua was the source of the data breach. After following up on its investigation, Blue Book determined that Amerihua’s CEO provided his log-in credentials to three Amerihua employees without Blue Book’s authorization.  Amerihua denied it was behind the breach of Blue Book’s proprietary information. Blue Book filed suit seeking damages based on its claim that Amerihua breached its membership agreement with Blue Book and that it suffered damages related to the breach.

First, the District Court found there was sufficient evidence concerning the breach of the subscription agreement to leave the question of how the agreement should be enforced to the jury.

Next, the District Court addressed the question of whether Blue Book presented some evidence of damages, and, in particular, whether Blue Book’s expert was qualified to testify as an expert.  Amerihau asserted Blue Book’s expert, C. Kenneth White, calculated damages in a manner that “runs afoul of Daubert [v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579, 589 (1983)] and must be excluded under Federal Rule of Evidence 702.”  (“Federal Rule of Evidence 702 appoints district courts as gatekeepers of expert testimony based on scientific, technical, and other specialized knowledge.” Kumho Tire Co., Ltd. v. Carmichael, 526 U.S. 137, 147 (1999)).

After conducting a Daubert analysis to weigh Mr. White’s credentials, the District Court found Mr. White was qualified on the following basis:

In order to win a damages award for the distribution’s impact on the company (as distinct from investigation costs) Blue Book will need to prove the damages to a reasonable certainty. Oakleaf, 527 N.E.2d at 295. It purports to do this through the expert report of White. Amerihua first challenges that White is not qualified to testify as an expert in this case, arguing that he does not meet any of the purported “Gold Standards” for expert testimony set forth by their own rebuttal expert, Stan Smith. Def. Br. at 14.¹² The argument goes that because White does not have a doctorate degree, has never taught a college course, and has not authored a university textbook, he is not a witness “qualified as an expert by knowledge, skill, experience, training, or education.” Def. Br. at 14; Fed. R. Civ. P. 702. But the list of factors picked by Amerihua are not conclusive and are most definitely not required by Daubert and Kumho Tire. And as the Seventh Circuit has explained, “[t]he notion that [Daubert] requires particular credentials for an expert witness is radically unsound.” Tuf Racing Prod., Inc. v. Am. Suzuki Motor Corp., 223 F.3d 585, 591 (7th Cir. 2000). Experts can take many forms, and Amerihua’s definition would essentially foreclose a wide swath of experts qualified by “skill, experience, [and] training.” Fed. R. Civ. P. 702. White has been an independent financial consultant since 2003, and before that, he held senior positions at Ernst & Young as a certified public accountant. R. 54, DSOF Sealed Exhibits Exh. V, White Report (sealed) at 36. More importantly, he has over 40 years of professional experience with specialization in valuation and damage analyses. Id. He has a bachelor’s degree in accounting and a master’s degree in business administration, on top of passing the CPA examination. Id. He has similarly served as an expert in myriad cases. Id. Just because White has focused his career on applying his skills to concrete cases rather than teaching courses or publishing articles does not disqualify him from expert analysis—nor does Rule 702 suggest as much. See Kumho Tire, 526 U.S. at 148-49; Tuf Racing, 223 F.3d at 591.

After finding White qualified to offer his expert opinion, the District Court next found White’s method used to calculate damages was sufficient to submit to the jury.  White used an “income approach” to calculate damages which “entails determining the present value of a business by discounting its future cash flows based on the costs of capital and underlying future risks entailed in continuing the company.”  The District Court also analyzed White’s use of an accounting principle referred to as “company-specific risk premium” in the following manner:

White’s use of a “company-specific risk premium,” Def. Br. at 16, which White used to determine Blue Book’s Weighted Average Cost of Capital (the discount rate) calculation both before and after the unauthorized download of data. White Report (sealed) at 21. So the company-specific risk premium (call it CSRP for short) purports to account for the difference in the pre- and post-unauthorized download discount rate calculations measuring Blue Book’s worth. Id. at 23. Put another way, it is meant to account for the incremental risks associated with Blue Book after the supposed breach. Id.

Amerihua claimed that White’s findings based on the “company-specific risk premium” method was unreliable because it relied on subjective factors that included: “operating history, barriers to entry, legal risk from a breach, product risk, brand name recognition, and costs of debt.”  Based on these factors, White concluded Blue Book sustained an increased company-specific risk premium between 1.25% and 2.5%.  Finally, White estimated Amerihua sustained damages in the range of $790,000 to $1,475,000.

While the District Court agreed to some extent with Amerihua that White’s factors were subjective, it further opined that “[t]here is no mathematical formula that another expert could plug data into to test the result (or generate a different one based on different data).”  Therefore, the District Court continues, “there is no simple (or even complex) equation that applies to all scenarios for valuing a company.”  Ultimately, the District Court concludes “[a]t some point, expertise has to be applied, and that expertise is based on training and expertise rather than invocation of a formula.  And, other courts have approved of this valuation method and allowed experts to rely on company-specific risk premiums in their calculations.”  White’s analysis was also based on valuations used in data breaches at other companies, “financial projections used by Blue Book, interviewed its management to discuss the company’s operation, analyzed publicly available data for Securities and Exchange Commission filings, and read deposition transcripts.”  Based on this reasoning, the District Court found “although a jury could reject the valuation method’s reliability, the method is reliable enough for the jury to consider.”

While this decision provides insight on the accounting behind a data breach, it should be cautioned that the District Court for the Northern District of Illinois finds “there is no one grand mathematical equation that generates a precise damages number in these situations” and “it might even be more suspicious if an expert purported to be able to pin down an exact damages figure for a data breach.”  We can expect this decision to be the first of many cases to address how damages should be calculated in data breach cases.

The post New Decision Takes “Accounting” of Expert Witness Findings Related to Data Breach Damages appeared first on Privacy Risk Report.