On May 5, 2020, the Seventh Circuit held that a plaintiff who brought claims under the Illinois Biometric Information Privacy Act (“BIPA”) had suffered an injury-in-fact sufficient to confer Article III standing, and therefore her case could be heard in federal court. In doing so, the Seventh Circuit reversed the District Court’s prior order remanding the case back to state court.
BIPA regulates private entities regarding the collection, retention, disclosure and destruction of biometric identifiers and biometric information. In Bryant v. Compass Group USA, Inc., the plaintiff alleged that the defendant violated BIPA when it collected her fingerprint without: (1) making available publicly a retention schedule for biometric information; (2) informing the plaintiff her biometric information was being collected or stored; (3) informing the plaintiff in writing of the specific purpose and length of time for which the biometric information was being collected, stored and used; and (4) obtaining the plaintiff’s written release to collect, store and use the biometric identifier.
The plaintiff brought claims under both section 15(a) and 15(b) of BIPA. Section 15(a) requires possessors of biometric identifiers or biometric information to develop a written retention schedule and guidelines for permanently destroying biometric identifiers or biometric information. Section 15(b) requires that, prior to collection, (a) a data subject be informed in writing that a biometric identifier or biometric information is being collected or stored; (b) a data subject be informed in writing of the specific purpose and length of term for which the biometric information or identifier is being collected, stored and used; and (c) the collecting entity receives a written release executed by the subject of the biometric information or identifier.
The plaintiff originally filed her class action complaint in Cook County, Illinois. The defendant removed the action to federal court. The plaintiff moved to remand the action to state court, arguing that the federal court lacked jurisdiction to hear the case because the plaintiff did not satisfy the injury-in-fact requirement for Article III standing. As we’ve noted, that determination would not have precluded the plaintiff from continuing her lawsuit in state court because the Illinois Supreme Court has previously ruled that plaintiffs alleging a bare violation of their rights under BIPA have standing to sue. The District Court agreed with the plaintiff and remanded the action back to state court.
The defendant then appealed to the Seventh Circuit. Because the defendant had removed to federal court, it bore the burden of establishing the plaintiff’s Article III standing. As the Seventh Circuit pointed out, “[t]his fact has occasioned a role reversal in the arguments we normally see in these cases, with the defendant insisting that Article III standing is solid, and the plaintiff casting doubt on it.”
In its opinion, the Seventh Circuit first recognized that Illinois courts and federal courts define “injury-in-fact” differently, and that Illinois’s standard is more lenient. But the Seventh Circuit then held the plaintiff had standing even under the more stringent federal standard with respect to her claims for violations of Section 15(b). Citing Justice Thomas’s concurrence in Spokeo, the Seventh Circuit stated that the plaintiff had not asserted a bare procedural violation, but rather “an invasion of her private domain, much like an act of trespass would be.”
The Seventh Circuit then analyzed the same issue as an informational injury. Typically, informational injuries arise where information required to be disclosed by statute is withheld. “The injury inflicted by non-disclosure is concrete if the plaintiff establishes that the withholding impaired her ability to use the information in a way the statute envisioned.” Applying that standard to BIPA, the Seventh Circuit noted that the “informed-consent regime laid out in section 15(b) is the heart of BIPA.” The Seventh Circuit further reasoned that the defendant’s failure deprived the plaintiff of a choice, which was a concrete injury-in-fact sufficient to support standing under Article III.
As to the plaintiff’s claim under section 15(a), the Seventh Circuit concluded the plaintiff had not suffered a concrete and particularized injury under Article III sufficient to confer standing. The Court contrasted section 15(a) with 15(b), noting that 15(a) required a duty to disclose to the public generally, not to a specific person from whom the entity is collecting biometric information. Because the plaintiff alleged no particular harm resulting from the defendant’s violation of section 15(a), the Court concluded that the plaintiff did not have standing for her 15(a) claim.
The case creates some interesting questions for plaintiffs and defendants litigating BIPA cases. Defendants who may prefer to be in federal court now have additional support for removal of 15(b) claims. At the same time, the case undermines federal motions to dismiss BIPA cases based on lack of Article III standing. Plaintiffs, on the other hand, who may prefer state court, may use the decision to try to plead around federal jurisdiction, possibly by bringing claims only under 15(a). It remains to be seen how the decision will affect the landscape of BIPA litigation in state and federal courts.
Jim Shreve is the chair of Thompson Coburn's Cybersecurity group and has advised clients on cybersecurity and privacy issues for over 20 years. Luke Sosnicki is a Los Angeles partner in Thompson Coburn’s Business Litigation group who has written and spoken extensively about data privacy litigation and regulatory risks. Libby Casale is an associate in Thompson Coburn’s Business Litigation group.