On May 5, 2020, the Seventh Circuit Court of Appeals held that a plaintiff has standing to assert a claim under the Illinois Biometric Information Privacy Act (BIPA) even without alleging any economic loss or data breach.  The court’s decision in Bryant v. Compass Group USA, Inc.,[1] held that merely alleging a failure to receive adequate disclosure or provide informed consent is sufficient to state a claim, potentially establishing in the Seventh Circuit a low bar for making claims under BIPA and other state statutes modeled off of it.

Background

Bryant brought a class action suit in Illinois state court against her employer, Compass Group, alleging violation of sections 15(a) and 15(b) of BIPA, which require a written policy for retaining and destroying biometric information, and informed consent, respectively.  During her orientation, Bryant and other employees were instructed to scan their fingerprints into a system that would permit them to use those fingerprints to authorize purchases from the company’s vending machines.  Bryant did not allege that she was unaware that her fingerprints were being stored and collected.  Rather, she simply alleged that Compass’s failure to make disclosures regarding the use and retention of employees’ biometric data deprived them of their ability to give informed written consent, resulting in the loss of their right to control that data under BIPA.

In an unusual posture, Compass removed the action to federal court under the Class Action Fairness Act and argued that the employee had federal standing.  (In most cases, it is the company-defendant arguing that a plaintiff lacks Article III standing, but here it was the opposite since Compass sought federal jurisdiction).  Bryant moved to remand the case to state court, arguing that the district court lacked federal subject matter jurisdiction because her claims did not fulfill the Article III requirement for concrete injury-in-fact.  The district court agreed with Bryant, remanding the case to state court.  Compass’s appeal to the Seventh Circuit followed.

Analysis

In reviewing Compass’s argument that Bryant had Article III standing, the Seventh Circuit’s analysis focused on whether Bryant suffered concrete injury to an interest the legislature sought to protect, instead of simply a “bare procedural violation” under the Supreme Court’s precedent in Spokeo, Inc. v. Robins.[2]

Pointing to the Illinois Supreme Court’s 2019 decision in Rosenbach v. Six Flags Entm’t Corp.,[3] Compass argued that BIPA created an inherent and protectable right to control one’s biometric information.  In Rosenbach, the court characterized the harm caused by violation of an individual’s rights under BIPA as “real and significant,” rather than a “mere technicality,” and emphasized that the Illinois legislature sought to protect an individual’s right to privacy over their own biometric data in passing BIPA.

Acknowledging that the standard for “injury-in-fact” differed between federal courts and Illinois state courts, the Seventh Circuit’s analysis turned on its application of the Supreme Court’s decision in Spokeo.  Because Bryant was asserting her own rights, in the form of her fingerprints and private information, a “direct application of Spokeo,” the court concluded, “leads to the result that Bryant satisfied the injury-in-fact requirement of Article III.”  The court noted that Compass’s nondisclosure of information amounted to a concrete injury as it impaired Bryant’s ability to use the information as BIPA envisioned.

Takeaways

  • An emerging trend towards broad privacy rights even as circuit court split continues. Beyond the Illinois Supreme Court’s decision in Rosenbach, Illinois state courts have adopted a liberal application of privacy rights.  At the federal level, the Bryant decision stands in contrast not only with the bulk of district court decisions relating to BIPA in that circuit, but also the Second Circuit decision in Vigil v. Take-Two Interactive Software, Inc.,[4] in which the court affirmed the dismissal of a class action suit under BIPA for lack of standing.  More recently, the Supreme Court dashed hopes that it would clarify the dispute between circuit courts after it denied Facebook’s petition for a writ of certiorari to review a Ninth Circuit decision affirming class certification under BIPA absent financial loss.
  • Standing determinations will remain fact dependent. The Seventh Circuit noted that, had Bryant received adequate disclosure from her employer, she may have altered her behavior (by, for example, forgoing the vending machines).  In doing so, the court acknowledged that it is still possible “to plead oneself out of court” – as happened in an earlier case where the plaintiff “admitted that no amount of notice or information would have changed her behavior.”  This approach is reminiscent of the Second Circuit’s approach in Take-Two, in which the court rejected a bright-line rule requiring that there have been a data breach in order to find standing and stressed the multiple opportunities the plaintiffs had to cure the deficiencies in their pleading while instructing the district court to dismiss the case without prejudice.
  • Bryant’s impact on future biometrics legislation. As Congress and state legislatures increasingly consider new biometric privacy laws, and amend existing privacy laws to cover biometric information, the Seventh Circuit’s decision in Bryant may have downstream effects on other similar statutes.  For example, Bryant may impact the willingness of other states to adopt biometrics legislation, or encourage legislators to draft bills that explicitly address the types harms they are intended to cover and when private actions might be permissible.

[1] –– F.3d ––, 2020 WL 2121463 (7th Cir. 2020).

[2] –– U.S. ––, 136 S. Ct. 1540, (2016).

[3] 432 Ill. Dec. 654, 129 N.E.3d 1197 (Ill. 2019); see also https://www.clearycyberwatch.com/2019/02/illinois-supreme-court-rules-plaintiffs-not-required-allege-actual-injury-sue-biometric-information-privacy-act/.

[4] 2017 WL 5592589 (2d. Cir. Nov. 21 2017).