Chicago, Ill. (May 6, 2020) - On May 5, 2020, the Seventh Circuit joined the Ninth Circuit in ruling that a plaintiff alleging violations of the informed consent provisions of the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/15(b) has Article III standing to sue in federal court.
The defendant in Bryant v. Compass Group USA, Inc. manufactures Smart Market vending machines. The machines do not collect cash. Instead, users must create a Smart Market account that is linked to their fingerprints. Once an account is active, a user could purchase items and add money to the balance using just their fingerprints. The plaintiff in Bryant worked for a call center that had installed Smart Market machines, owned and operated by Compass Group USA, Inc., in its company cafeteria. During onboarding, the plaintiff and her co-workers were instructed by the employer to scan their fingerprints into the Smart Market sys¬tem and establish a payment link to create user accounts. The plaintiff frequently used the Smart Market machines throughout her employment. Fingerprints are "biometric identifiers" under BIPA. 740 ILCS 14/10.
The Bryant plaintiff filed suit in Illinois state court on behalf of a class of Illinois citizens that used the Smart Market machines, alleging violations of sections 15(a) (for failure to post publicly available retention schedule) and 15(b) (for failure to obtain informed consent) of BIPA. The defendant removed the case to the Northern District of Illinois under the Class Action Fairness Act (CAFA), and the plaintiff moved the district court for remand, arguing that she did not have standing to sue under Article III; therefore, the federal court did not have jurisdiction. The district court granted the motion to remand, holding that the plaintiff merely alleged a "bare procedural" violation of the statute that did not cause her any harm and thus lacked Article III standing. An interlocutory appeal followed.
In handing down its opinion, a unanimous panel of the Seventh Circuit had "no trouble concluding" that the plaintiff in Bryant alleged a concrete and particularized Article III injury-in-fact by asserting that Compass Group USA violated section 15(b) of BIPA when it failed to obtain informed consent before collecting her fingerprints. The panel first recounted the Article III standing analysis outlined by the United States Supreme Court in Spokeo v. Robins and placed particular emphasis on Justice Thomas's concurring opinion that drew a "useful distinction" between two types of injuries: the first type arises when a private plaintiff asserts violations of her own rights and the second when a private plaintiff seeks to vindicate public rights.
The Seventh Circuit reasoned that the Bryant plaintiff satisfied Article III under either analysis. As for asserting her private rights, the plaintiff alleged an injury-in-fact "without further tangible consequence" because collecting her fingerprints without obtaining consent was "no bare procedural violation; it was an invasion of her private domain, much like an act of trespass." As for vindicating public rights, the court analogized the rights secured by BIPA to those of the Fair Credit Reporting Act's mandate that prospective employees be given a copy of their background reports, and that when employers fail to do so, the plaintiff-employee suffers a concrete and particularized "informational injury" sufficient to confer Article III standing. The critical inquiry for standing purposes is whether "the plaintiff is entitled to review substantive information" before having the opportunity to respond or take action accordingly. When a plaintiff is "wholly deprived of the information necessary to respond," he or she has Article III standing to sue. Turning back to BIPA, the Seventh Circuit reasoned that "Compass's failure to abide by the requirements of section 15(b) [of BIPA] before it collected Smart Market users' fingerprints denied [the plaintiff] and others like her the opportunity to consider whether the terms of that collection and usage were acceptable given the attendant risks."
Finally, the court turned – in a brief, two paragraph analysis – to the plaintiff's allegation that Compass violated section 15(a) of BIPA by failing to post a publicly available retention schedule and guidelines for destroying biometric information. The panel held that, unlike section 15(b), the duty to disclose under section 15(a) is "owed to the public generally, not to particular persons whose biometric information the entity collects" and that the "provision is not part of the informed-consent regime," which the court previously stated was "the heart" of the statute. Thus the plaintiff did not allege a particularized injury-in-fact under Article III for her claims under section 15(a).
The Seventh Circuit's decision with respect to section 15(a) leaves open the question of whether the standing analysis under Illinois state law for section 15(a) claims will differ from the federal analysis. As for the informed consent provision in section 15(b) of BIPA, the Seventh Circuit has confirmed that the door is open for removal to federal court provided other jurisdictional requirements are met.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
