Seventh Circuit Finds Grounds for Standing in BIPA Case

Recently, in Bryant v. Compass Group U.S.A. Inc., the Seventh Circuit diverged from a string of decisions in the Northern District of Illinois by finding that a plaintiff sufficiently pled a concrete and particularized injury by alleging that an employer failed to get requisite consent under Illinois’ Biometric Information Protection Act (BIPA). The complaint was originally brought in state court alleging that Compass failed to comply with BIPA’s notice and consent requirements under Section 15(b) of the statute, and did not make a biometric data retention schedule publicly available as required by Section 15(a). Compass initially succeeded in removing the suit to the Northern District before the plaintiff attempted to remand the case back down to state court, arguing that she could not demonstrate a sufficiently concrete injury to establish the standing necessary to bring suit in federal court under Article III of the Constitution. The Northern District agreed and remanded the suit back to state court, but Compass petitioned the Seventh Circuit for review of the remand order.

In its opinion, the Seventh Circuit panel disagreed with the prevailing view in the Northern District of Illinois, holding that the plaintiff had suffered a concrete and particularized injury when Compass allegedly deprived her of the information it was required to disclose under Section 15(b) of BIPA. Citing the Illinois Supreme Court’s Rosenbach v. Six Flags decision, the court conceived of the plaintiff’s injury as a violation of her right to informed consent. The Seventh Circuit found the alleged violation of the plaintiff’s right to informed consent under Section 15(b) was “an invasion of her private domain, much like an act of trespass would be.” Separate from that, the panel also grounded its decision in cases involving “informational injury,” where a plaintiff’s harm stems from its inability to use information the defendant was required by law to disclose.

Notably, the panel drew a distinction between the plaintiff’s claim under Section 15(b), which related to the defendant’s obligation to make disclosures to her about its use of her fingerprint, and the claim brought under Section 15(a), alleging that the defendant failed to make available to the public a retention schedule and guidelines about its collection of fingerprints. The panel found that the plaintiff had not suffered a particularized injury from the defendant’s failure to make required disclosures under Section 15(a), as that duty “is owed to the public generally, not to particular persons whose biometric information the entity collects,” and is thus “not part of the informed-consent regime.” Therefore, the panel found that the plaintiff lacked Article III standing to pursue claims under Section 15(a).

For more information, please review our full briefing, available here.

TIP: The courts’ treatment and interpretation of BIPA continues to develop, which impacts both pending BIPA litigation and compliance efforts. In addition, states continue to propose laws regulating the collection and use of biometric information, some of which mimic BIPA. Any entities processing biometric information should continue to monitor these developments.