Seventh Circuit Paves the Way for Illinois Biometric Law Suits in Federal Courts

ABSTRACT: The Seventh Circuit has sided with the Ninth Circuit in holding alleged BIPA violations constitute an injury-in-fact sufficient to confer standing to bring the action in federal court.

In Bryant v. Compass Grp. USA, Inc., 958 F.3d 617 (7th Cir. 2020), the federal court of appeals for the Seventh Circuit answered in the affirmative the question of whether, for federal-court purposes, a person aggrieved by a violation of Illinois’ Biometric Information Privacy Act (BIPA) has suffered the kind of injury-in-fact that supports Article III standing.

Plaintiff Christine Bryant’s workplace installed “Smart Market” vending machines owned and operated by the defendant Compass Group U.S.A., Inc. Rather than accept cash, users had to establish an account using a fingerprint. During orientation, plaintiff’s employer instructed her and others to scan their fingerprints into the Smart Market system to establish a payment link to create user accounts. In violation of section 15(a) of BIPA, Compass never made publicly available a retention schedule and guidelines for permanently destroying the biometric identifiers and information it was collecting and storing. In addition, in violation of section 15(b) of BIPA, Compass (1) never informed Bryant in writing that her biometric identifier was being collected or stored, (2) never informed Bryant in writing of the specific purpose and length of time for which her fingerprint was being collected, stored, and used, and (3) never obtained Bryant’s written release to collect, store, and use her fingerprint. Plaintiff asserted that Compass’s failure to make the requisite disclosures denied her the ability to give informed written consent as required by BIPA, leading to the loss of the right to control her biometric identifiers and information. Seeking redress for this alleged invasion of her personal data, Bryant brought a putative class action against Compass pursuant to BIPA’s provision providing a private right of action in state court to persons “aggrieved” by a violation of the statue.

Compass removed the case to federal court on the basis of diversity of citizenship. Plaintiff Bryant moved to remand to state court, claiming that the federal district court did not have subject-matter jurisdiction because she lacked the concrete injury-in-fact necessary to satisfy the federal requirement for Article III standing. The district court agreed with plaintiff and remanded to the state court.

On appeal, the Seventh Circuit noted that for Bryant to have Article III standing, she must satisfy three requirements: (1) she must have suffered an actual or imminent, concrete and particularized injury-in-fact; (2) there must be a causal connection between her injury and the conduct complained of; and (3) there must be a likelihood that this injury will be redressed by a favorable decision. Only the first of these requirements was at issue in the case in that the second and third requirements were clearly satisfied.

The appellate court ultimately concluded that Bryant has Article III standing as to her action for violations of section 15(b), but not for violations of section 15(a). Compass’s failure to abide by the requirements of section 15(b) before it collected users’ fingerprints denied Bryant and others like her the opportunity to consider whether the terms of that collection and usage were acceptable given the attendant risks. Going beyond a failure to satisfy a purely procedural requirement, Compass withheld substantive information to which Bryant was entitled and thereby deprived her of the ability to give informed consent as mandated by section 15(b). The appellate court found this deprivation is a concrete injury-in-fact that is particularized to Bryant and others like her, thereby meeting the Article III requirement for standing.

In contrast, the section 15(a) claim involves a duty owed to the public generally: the duty to make publicly available a data retention schedule and guidelines for permanently destroying collected biometric identifiers and information. This provision is not part of the informed consent regime of the statute, and Bryant alleges no particularized harm to herself or others that resulted from the alleged violation of section 15(a). Thus, she lacks standing to pursue that claim in federal court.