Seventh Circuit Finds Violation of BIPA Informed-Consent Requirements Establishes Sufficiently Concrete Injury to Allow Federal Jurisdiction

Key Takeaways:

• A Seventh Circuit holding has made it easier to litigate Illinois’ Biometric Information Privacy Act (BIPA) claims in federal court, particularly in the Northern District of Illinois.
• Federal district court decisions have been inconsistent about whether the failure to provide notice and obtain consent as required by BIPA were mere procedural violations of the law or caused “injury in fact” sufficient to establish federal jurisdiction.
• However, the Seventh Circuit held in Bryant v. Compass Group U.S.A. Inc., that the defendant’s failure to comply with BIPA’s notice-and-consent requirements was enough to establish a sufficiently concrete and particularized injury to meet Article III standing requirements, even though the plaintiff had not suffered any economic harm in connection with the alleged violation of law.

Analysis:

Recently, the Seventh Circuit diverged from a string of decisions in the Northern District of Illinois by finding that a plaintiff sufficiently pled a concrete and particularized injury by alleging that an employer failed to get requisite consent under Illinois’ Biometric Information Protection Act (BIPA). In Bryant v. Compass Group U.S.A. Inc., the defendant owned and operated a vending machine located in plaintiff Bryant’s workplace. The vending machine did not accept cash and required users to create an account that allowed them to make purchases using a fingerprint scanner. Bryant brought suit in the Circuit Court of Cook County, claiming that the defendant violated her rights under Section 15(b) of BIPA by collecting her fingerprint without (1) informing her that it was being stored; (2) informing her in writing of the purpose and length of term for which her fingerprint was being collected, stored, and used; and (3) obtaining from her a written release to collect, store, and use her fingerprint. Bryant further alleged a claim under Section 15(a) of BIPA because the defendant had never made publicly available a retention schedule and guidelines for destroying the fingerprints it collects.

The defendant removed the suit to the Northern District of Illinois under the Class Action Fairness Act. Following a common script for other fingerprint-scan BIPA cases, Bryant moved to remand the case, arguing she lacked a sufficiently concrete injury to have standing to bring suit in federal court. Judge Virginia Kendall agreed, joining the vast majority of Northern District of Illinois courts, which have held a defendant’s failure to comply with BIPA’s requirements amounts to a bare procedural violation of the law that does not cause harm sufficiently concrete or particularized to establish Article III standing under the Supreme Court’s Spokeo v. Robins decision and its Seventh Circuit progeny.

The defendant petitioned the Seventh Circuit for review of the remand order, which was granted. In an opinion penned by Chief Judge Diane Wood, a Seventh Circuit panel disagreed with the prevailing view in the Northern District of Illinois, holding that Bryant had suffered a concrete and particularized injury when the defendant deprived her of the information it was required to disclose under Section 15(b) of BIPA. Citing the Illinois Supreme Court’s Rosenbach v. Six Flags decision, the court conceived of Bryant’s injury as a violation of her right to informed consent, i.e., “loss of the power and ability to make informed decisions about the collection, storage, and use of her biometric information.” The court grounded its decision in two sources. The first was Spokeo itself, citing Justice Thomas’s concurrence, which drew a distinction between plaintiffs that assert violations of their own private rights (such as trespass) versus plaintiffs that seek to vindicate public rights (such as disputes over the use of public land). The panel found Bryant squarely within the former category, as the violation of her right to informed consent under Section 15(b) was “an invasion of her private domain, much like an act of trespass would be.” Separate from that, the panel also grounded its decision in cases involving “informational injury” (including Seventh Circuit precedent applying Spokeo to that issue), where a plaintiff’s harm stems from its inability to use information the defendant was required by law to disclose.

Notably, the panel drew a distinction between Bryant’s claim under Section 15(b), which related to the defendant’s obligation to make disclosures to her about its use of her fingerprint, and her claim brought under Section 15(a), alleging that the defendant failed to make available to the public a retention schedule and guidelines about its collection of fingerprints. The panel found that Bryant had not suffered a particularized injury from the defendant’s failure to make required disclosures under Section 15(a), as that duty “is owed to the public generally, not to particular persons whose biometric information the entity collects,” and is thus “not part of the informed-consent regime.” Therefore, the panel found that Bryant lacked Article III standing to pursue claims under Section 15(a).

Bryant is notable because federal district court decisions have been inconsistent in their application of Spokeo to BIPA claims, an area lacking much circuit precedent. While it is arguably an unfavorable development for the defense bar in the broader law of federal standing, as it holds a plaintiff that has suffered no economic injuries has injury-in-fact, it is no doubt a welcome development for BIPA defendants, many of whom have been stuck litigating these claims in Illinois state courts without the option of removing them to federal court.

While the case law interpreting BIPA continues to rapidly develop, Winston’s Regulated Personal Information (RPI) practice is available to provide strategic counsel on BIPA matters by defending class action claims and helping clients understand their compliance obligations while proactively taking steps to mitigate potential liability. The RPI team is led by a former federal privacy regulator and a seasoned privacy class action defense attorney, and includes several former Assistant U.S. Attorneys, and other counselors and litigators who have deep experience in advising clients in complicated privacy matters.