Seventh Circuit Holds Violation of BIPA’s Informed Consent Regime Confers Article III Standing

On May 5, 2020, the Seventh Circuit Court of Appeals held that a violation of the informed consent requirements of Illinois’ Biometric Information Privacy Act (BIPA) is sufficient to confer Article III standing.  Bryant v. Compass Group USA, Inc., No. 20-1443.  With this decision, the Seventh Circuit joins the Ninth Circuit in allowing such claims to proceed in federal court without a plaintiff needing to show further harm.

Background on BIPA

BIPA regulates the collection, use, and retention of biometric identifiers or information and imposes a number of requirements on covered entities.  Section 15(b) of BIPA requires that companies engaging in the collection, use, and retention of biometric identifiers obtain informed, written consent of any person whose data they obtain before acquiring it.  BIPA permits a private right of action for any person “aggrieved” by a violation of the Act, allowing a plaintiff potential recovery of the greater of actual damages or liquidated damages (ranging from $1,000 for each negligent violation to $5,000 for each reckless or intentional violation), attorneys’ fees and costs, and injunctive relief.  Section 15(a) of BIPA, which was also at issue in the Bryant case, requires covered entities to develop and make publicly available a written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and information—here, fingerprints.

The Landscape Before Bryant

The Bryant decision is the latest decision addressing Article III standing for BIPA claims.

In 2019, The Illinois Supreme Court held in Rosenbach v. Six Flags Entm’t Corp., 129 N.E.3d 1197, 1203 (2019) that a plaintiff could qualify as an “aggrieved” person and therefore have standing to bring a BIPA claim without alleging harm beyond a violation of the statute. 

After Rosenbach, federal courts have considered whether such an “aggrieved” person would also have standing under Article III to bring such a claim in federal court.  In Patel v. Facebook, 932 F.3d 1264 (9th Cir. 2019), the Ninth Circuit held that plaintiffs alleged a concrete injury sufficient to satisfy Article III in claiming that Facebook used facial-recognition technology without obtaining informed written consent and without maintaining required retention schedules or destruction guidelines.  In contrast, most federal district courts in Illinois had found no Article III standing for plaintiffs alleging BIPA violations without a showing of further harm.  Until now, at least for some BIPA-based claims. 

The Seventh Circuit’s Decision in Bryant

In Bryant v. Compass Group USA, Inc., No. 20-1443, the plaintiff alleged a violation of Section 15(b) of BIPA arising from defendant’s failure to obtain informed, written consent for collection and use of her fingerprint in connection with vending machines owned and operated by defendant and installed at her workplace.  The plaintiff also alleged that the defendant had violated section 15(a) of BIPA by failing to make publicly available a retention schedule and guidelines for permanently destroying the fingerprints it was collecting and storing.  Plaintiff did not allege that she suffered further harm from these alleged BIPA violations.

The court held that plaintiff’s allegation that the defendant failed to follow BIPA’s informed consent requirements under section 15(b) lead to “an invasion of personal rights that is both concrete and particularized,” and therefore sufficient to establish Article III standing.  In reaching this conclusion, the court reasoned that plaintiff was “asserting a violation of her own rights – her fingerprints, her private information – and that this is enough to show injury-in-fact without further tangible consequences.”  Opinion at 12.  The court further reasoned that “the informed-consent regime laid out in section 15(b) is the heart of BIPA,” concluding that the defendant’s alleged failure to follow those requirements deprived the plaintiff of the ability to give informed consent and establishing a concrete injury-in-fact particularized to her.  Opinion at 15–16.

In contrast, the court held that plaintiff lacked Article III standing as to her BIPA claim under section 15(a) because “the duty to disclose” retention schedules and destruction guidelines “is not part of the informed-consent regime” and “is owed to the public generally, not to particular persons whose biometric information the entity collects.”  Opinion at 16–17. Plaintiff thus had alleged no particularized harm sufficient to sustain her section 15(a) claim in federal court.  This latter determination differs from the Patel v. Facebook decision, where the Ninth Circuit found Article III standing existed for plaintiff’s 15(a) and 15(b) claims.

Takeaways

The Seventh Circuit’s decision in Bryant, like the Ninth Circuit’s in Patel, lowers the standing bar to bring BIPA claims in federal court and is likely to lead to wave of BIPA litigation, specifically in Illinois federal courts.  The Seventh Circuit’s decision reinforces how important it is for companies to determine whether they are covered by BIPA and, if so, make efforts to comply with it; or risk being hauled into federal court for technical violations of BIPA even when there is no further harm.