On May 5, 2020, the Seventh Circuit held that violations of the section 15(b) disclosure and informed consent provisions of the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (“BIPA”) constitute “an invasion of personal rights that is both concrete and particularized” for the purposes of establishing Article III standing to sue in federal courts.  However, the Seventh Circuit also held that the alleged harms associated with violations of section 15(a) of BIPA were insufficient to establish Article III standing.  Section 15(a) mandates public disclosure of a retention schedule and guidelines for permanent destruction of collected biometric information.

Covington has previously discussed developments in BIPA litigation, which has proliferated in recent years with the advancement of relevant technologies.  The increase in BIPA litigation has been accompanied by a rise in disputes over the nature of the harm required to sustain an action, both in state and federal courts.  Although this issue was seemingly resolved at the state-level by the Illinois Supreme Court’s 2019 Rosenbach decision, federal courts have continued to grapple with the issue for the purposes of Article III standing.

Case Background

Plaintiff, a call center employee, voluntarily provided her fingerprint data for the purpose of accessing onsite vending machines owned and operated by Compass.  She sued Compass for allegedly failing to fulfill the statutory requirements of disclosure and informed consent under BIPA.  Specifically, the plaintiff alleged that Compass had violated BIPA’s (i) section 15(a), by failing to make publicly available a retention schedule for the biometric data it collected, and (ii) section 15(b), by failing to provide the plaintiff with the requisite written disclosures stating the purpose of collecting her fingerprint and duration her print would be stored, and by failing to obtain her written consent for such collection.

The action was initially brought in Illinois state court.  Compass removed the case to federal court under the Class Action Fairness Act (“CAFA”), and the plaintiff sought to remand the action to state court.  The district court granted remand, holding that violations of sections 15(a) and 15(b) were merely “procedural violations” and insufficient as a matter of law to constitute the injury-in-fact required to have standing to sue in federal court.  Compass appealed the decision to the Seventh Circuit.

Seventh Circuit’s Holding

The Seventh Circuit considered the BIPA standing issue to be one of first impression in the Circuit.  Its decision focused on the nature of the harm necessary for Article III standing as outlined in the United States Supreme Court’s 2016 Spokeo, Inc. v. Robins decision.  Specifically, the Seventh Circuit panel focused on Justice Thomas’s concurrence in Spokeo, which “drew a useful distinction between two types of injuries”—(i) where private plaintiffs are asserting violations of their own rights versus (ii) where private plaintiffs are seeking vindication of public rights.

Distinguishing between the plaintiff’s claims under sections 15(a) and 15(b), the Court concluded that a section 15(b) claim asserts the violation of a person’s personal rights over his or her own, distinct biometric identifiers.  The Seventh Circuit held that “Compass withheld substantive information to which [plaintiff] was entitled and thereby deprived her of the ability to give the informed consent section 15(b) mandates.”  This harm, in the view of the Seventh Circuit, was sufficiently concrete and particularized for the purposes of establishing Article III standing.  Perhaps sensitive to possible challenge of its application of Spokeo, the Seventh Circuit separately held that section 15(b) claims also state a form of “informational injury” that is independently sufficient to establish federal standing under a different line of Supreme Court cases.

In contrast, the Seventh Circuit held that the duty to disclose required by BIPA section 15(a) is only “owed to the public generally, not to particular persons whose biometric information the entity collects.”  The Court thus held that section 15(a) claims fail to allege a sufficiently particularized harm for federal standing purposes.

What to Expect

Either party could appeal the Seventh Circuit’s split decision to the United States Supreme Court.  However, just last year, the Supreme Court denied cert in a Ninth Circuit case that had ruled BIPA section 15(b) claims could be brought in federal courts.

In any event, because the viability of BIPA claims already has a strong foothold in Illinois state courts, this decision could prove to be a boon for out-of-state defendants sued under BIPA for alleged violations of its informed consent requirements.  Defendants now can remove section 15(b) claims to federal court if the requirements for removal under CAFA are otherwise satisfied.  While this decision is unlikely to affect the number of plaintiffs filing suit under BIPA, it is likely to result in a greater number of section 15(b) disputes over informed consent being resolved by federal courts.