Key Points
- Section 15(b) of the Illinois Biometric Information Privacy Act (BIPA) protects personal legal rights in individuals’ unique biometric information and the right to give informed consent prior to relinquishing such rights.
- A claim of a violation of §15(b), which imposes a duty to provide to individuals written disclosure of the collection, use and storage of biometric information and to obtain a written a release from individuals documenting consent to collection of such information, asserts a violation of personal legal rights sufficient to establish the concrete-harm requirement under the Article III standing inquiry.
- Section 15(a) of BIPA imposes a duty to the general public to publish retention schedules and destruction guidelines. The court concluded that standing did not exist for claims made under §15(a) where the plaintiff alleged “no particularized harm.”
On May 5, 2020, in a case of first impression, a three-judge panel of the Seventh Circuit reversed and remanded a district court’s order and held that a violation of §15(b) of BIPA causes an “invasion of personal rights” that constitutes an actual, concrete, particularized injury and satisfies the constitutional requirement for Article III standing. In a surprising twist, however, the Seventh Circuit also held that the obligations imposed under §15(a) of BIPA are owed to the general public. As such, violations of the mandate to provide a retention schedule and destruction disclosures under §15(a) of BIPA did not result in a concrete, particularized injury and could not confer Article III standing.
Collection and use of biometric information
In Christine Bryant v. Compass Group USA, Inc., Bryant and her co-workers voluntarily scanned their fingerprints into vending machines that were owned and operated by Compass Group, USA, Inc. (Compass) to purchase items at her place of employment. The scanned fingerprints were used to create user accounts for payment purposes. Compass never made publicly available a retention schedule and guidelines for permanently destroying the biometric identifiers (fingerprints) it collected and stored as required under §15(a) of BIPA. Compass also never provided the required disclosures under §15(b) of BIPA that biometric information was being collected or stored; informed Bryant and her co-workers in writing of the specific purpose and length of term for which the biometric information was being collected, stored and used; or obtained written releases to collect, store and use the biometric information.
Bryant subsequently brought a putative class action against Compass under BIPA for violations of §§15(a) and (b) of BIPA. Compass removed the action to federal court under the Class Action Fairness Act (CAFA). Bryant moved to remand the action to state court claiming a lack of subject matter jurisdiction because she lacked the concrete injury-in-fact necessary to satisfy the federal requirement for Article III standing. The district court found that the alleged violations of §§15(a) and (b) were “bare procedural violations that caused no concrete harm to Bryant” and remanded the case to state court. Compass petitioned for appeal, which was granted.
Right of privacy and control over biometric information
One of the three required elements necessary to establish Article III standing to invoke the authority of the federal court is the existence of “an actual or imminent, concrete, particularized injury-in-fact.” Legislatures may “elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate at law.” Violations of a statute that protects the concrete interest a legislature sought to shield from concrete harm satisfies the injury-in-fact requirement.
The unanimous Illinois Supreme Court decision Rosenbach v. Six Flags Entertainment Corporation described the concrete interest the legislature sought to protect as an individual’s right to privacy and control over their biometric information. The court further defined that right as necessarily including the right of an individual to make informed decisions regarding the collection and use of their unique biometric information. A refusal to comply with the statutory notice and disclosure requirements mandated to protect the biometric information deprives an individual of the right to make such an informed decision about the biometric information. The inability to make an informed decision results in a loss of control and ability to maintain the privacy over the biometric information. The Illinois Supreme Court and the Illinois legislature concluded that such an injury was both “real and significant.”
Violation of §15(b) results in particularized, concrete injury-in-fact
The Seventh Circuit scrutinized the injury alleged by Bryant under §15(b) to determine whether it met the minimum requirements for establishing the right to sue in federal court under Article III of the Constitution. Similar to the court in Rosenbach, it recognized that Bryant’s claim was not a “bare procedural violation” but “asserted a violation of her own rights—her fingerprints, her private information.” Relying on Justice Thomas’s concurrence in the U.S. Supreme Court decision Spokeo Inc. v. Robbins the court explained that vindication of Bryant’s own personal legal rights in her biometric information is sufficient to show injury-in-fact.
Additionally, the Seventh Circuit characterized Bryant’s injury as an “informational injury” that occurs when information that is statutorily required to be disclosed is withheld, depriving a claimant of a benefit or a chance to obtain a benefit. By depriving Bryant of the disclosure regarding collection, use and storage of her biometric information, the court held that Compass deprived Bryant of her “ability to give the informed consent” as mandated by §15(b). The court concluded that the deprivation of such information precluded Bryant from realizing that her choice of scanning her fingerprints had risks and benefits. The deprivation of information establishes a concrete injury-in-fact, particularized to Bryant that confers Article III standing for the § 15(b) claim.
Violation of §15(a) lacks particularity
Unlike §15(b), however, the court construed §15(a) of BIPA to impose a duty to disclose retention schedules and guidelines for permanent destruction of the collected biometric information to “the public generally, not to particular persons whose biometric information the entity collects.” The court noted that Bryant alleged “no particularized harm” from the §15(a) violation. As such, the court concluded that Bryant does not have standing to pursue her claim under §15(a) in federal court.
What this means to you
The decision paves the way for BIPA claims to be pursued in either federal or state court. Doubtless, plaintiffs and defendants will plead their allegations of violations or file notices for removal depending on their evaluation of which forum better suits their interests. Businesses who collect, use or store biometric information, however, can avoid potentially costly BIPA litigation by complying with BIPA disclosure and notice mandates. The failure to comply violates a personal right, establishing an actual, concrete, particularized injury without further evidence of harm.
Contact us
If you have questions about your obligations under BIPA or other privacy-related issues, please contact Anne Mayette, Michael Hayes, or your Husch Blackwell attorney.