As we have noted in prior alerts,[1] the Illinois Biometric Information Privacy Act (“BIPA”) creates a substantial potential liability for businesses that interact with the biometric information of Illinois residents without complying with BIPA’s strict, but relatively straightforward, statutory requirements. BIPA has already resulted in hundreds of putative class action cases against businesses that use fingerprinting or facial scanning technology with Illinois employees or consumers. The Illinois Supreme Court’s 2019 decision in Rosenbach v. Six Flags provided no help to the business community, ruling that a plaintiff may pursue claims under BIPA as an “aggrieved” party even if no actual harm was done to the plaintiff.
On May 5, 2020, in Bryant v. Compass Group U.S.A., Inc., the Seventh Circuit Court of Appeals decided a related question under federal law, specifically, whether a BIPA plaintiff has Article III standing to pursue claims in federal court without alleging any harm beyond a statutory violation of BIPA. The Seventh Circuit’s answer: It depends on which provision of BIPA is at issue.
In Bryant, the plaintiff, Christine Bryant, alleged that her fingerprints were used for the purchase of items from a vending machine operated by the defendant, Compass Group USA, Inc. Bryant further alleged that she was not given a written notice that her fingerprints were being collected and did not sign a written consent to the collection, as required under Section 15(b) of BIPA. Bryant also alleged that Compass failed to make publicly available a policy regarding its retention guidelines for any biometric information collected, in violation of Section 15(a) of BIPA. While Bryant filed suit in the Circuit Court of Cook County, Compass removed the case to federal court under the Class Action Fairness Act, 28 U.S.C. § 1332(d), based on the parties’ diversity of citizenship and the amount in controversy. On Bryant’s motion, the district court remanded the case to state court, holding that Bryant had not alleged actual harm sufficient to confer standing under federal courts’ Article III standards. Compass appealed the district court’s remand order.
On appeal, the Seventh Circuit held that a violation of the notice-and-consent provisions of BIPA under Section 15(b) creates a sufficient injury for Article III standing purposes, whereas a violation of Section 15(a)’s requirement to post a publicly available BIPA policy does not give rise to an injury sufficient to confer Article III standing. The court reasoned that a violation of Section 15(b) was an “invasion of [Bryant’s] private domain” and created an informational injury because the informed consent requirements in Section 15(b) strike at “the heart of BIPA.” In contrast, the court ruled that Section 15(a)’s requirement that an entity collecting biometric information make publicly available its data retention and destruction guidelines was “owed to the public generally, not to particular persons whose biometric information the entity collects.” As a result, any injury resulting from the violation of Section 15(a) was not particularized to Bryant and, thus, was not cognizable under Article III.
Moving forward, the decision in Bryant raises the question of how the plaintiffs’ bar will proceed with cases pending in federal court that allege violations of both Section 15(a) and Section 15(b), as most BIPA cases do. Under existing precedent, it is likely that plaintiffs can pursue Section 15(a) claims in state court even as Section 15(b) claims proceed in federal court. See Wisconsin Dep’t of Corr. v. Schacht, 524 U.S. 381, 389–90 (1998) (holding that the presence of a claim barred under the Eleventh Amendment does not destroy jurisdiction over cases removed to federal court where some of the claims meet federal jurisdictional requirements); Lee v. American Nat’l Ins. Co., 260 F.3d 997, 1004 (9th Cir. 2001) (holding that, under Schacht, the remand statute does not provide for remand to state court where some, but not all, claims are barred by federal standing requirements); Shaw v. Marriott Int’l, Inc., 605 F.3d 1039, 1044 (D.C. Cir. 2010) (“Schacht held that § 1447(c) did not require a district court to relinquish its removal jurisdiction over a case with multiple claims once it determined that one of the claims was barred by the Eleventh Amendment”). While BIPA provides for statutory damages of $1,000 or $5,000 “for each violation,” the courts have not decided whether a plaintiff can obtain a double recovery if two statutory sections have been violated. From the plaintiffs’ perspective, having similar claims involving the same parties ruled on in two separate forums raises a number of issues regarding potentially inconsistent rulings and increased expense that could complicate pursuing multiple cases separately against the same defendant. Time will tell whether the plaintiffs’ bar assumes those risks by pursuing Section 15(a) claims in state court even as removed Section 15(b) claims are litigated in federal court.
- Prior Alerts: The Illinois Biometric Information Privacy Act: Don’t get “tagged” like Facebook; 9th Circuit upholds class certification against Facebook in Illinois Biometric Information Privacy Act lawsuit; Illinois Supreme Court decision allows for biometric privacy claims to proceed without a showing of actual harm; Second Circuit issues a leading decision on Article III standing requirements for claims filed under the Illinois Biometric Information Privacy Act; Using fingerprints for timekeeping purposes in Illinois — what you need to know about the Illinois Biometric Information Privacy Act
[Back to reference]