On May 5, the Seventh Circuit decided in Bryant v. Compass Group USA, Inc., 2020 WL 2121463 (7th Cir. May 5, 2020), that a plaintiff who alleges a procedural violation of the Illinois Biometric Information Privacy Act (“BIPA”) without a showing of actual injury has standing to maintain suit in federal court under Article III of the U.S. Constitution. This opinion addresses an issue of first impression with great importance to the developing area of BIPA case law.
The Underlying Lawsuit
Plaintiff Christine Bryant brought a purported class action lawsuit against Compass Group USA, Inc., a vending machine company, in the Circuit Court of Cook County, Illinois. She alleged that Compass violated BIPA by collecting her fingerprint scan in order to purchase items from vending machines at her place of work. The vending machines, which did not accept cash, allowed her to purchase goods by creating a charge account when she began her employment that was accessible through scanning her fingerprint into the machine. She alleged that Compass violated section 15(a) of BIPA because Compass did not maintain a publicly available retention policy for the biometric identifying information it collected, and that it violated section 15(b) because it provided no written statement that her fingerprints were being collected and stored, it did not state the purpose for their collection or the length of time they would be stored, and it did not obtain her written consent to the collection.
Procedural History and Issue Presented
Compass removed the case to federal court pursuant to the Class Action Fairness Act. The plaintiff moved to remand the case back to state court, arguing that she had not alleged the requisite “concrete injury-in-fact” to maintain Article III standing to support federal subject matter jurisdiction. The District Court for the Northern District of Illinois agreed with her and ordered that the case be sent back to state court. Compass appealed.
The issue before the Seventh Circuit was whether the plaintiff had alleged claims establishing Article III standing in federal court. While it is typically a plaintiff’s burden to meet this threshold, Compass, as the party invoking federal jurisdiction, had the burden of establishing the plaintiff’s Article III standing in this case because it was the party that had invoked federal jurisdiction through its removal petition. The court noted this unusual circumstance, remarking that “[t]his fact has occasioned a role reversal in the arguments we normally see in these cases, with the defendant insisting that Article III standing is solid, and the plaintiff casting doubt on it.” The court framed the issue as whether “any injury Bryant suffered was caused directly by Compass’s failure to comply with BIPA, and the prospect of statutory damages shows that such an injury is compensable.”
The Seventh Circuit’s Analysis
The Seventh Circuit held that in order to maintain Article III standing, the plaintiff’s claims must satisfy three requirements: (1) she must have suffered an actual or imminent, concrete and particularized injury-in-fact; (2) there must be a causal connection between her injury and the conduct complained of; and (3) there must be a likelihood that this injury will be redressed by a favorable decision. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61 (1992). Only the first of these requirements was at issue. The court explained that under Robins v Spokeo, Inc., 136 S. Ct. 1540, 1548-49 (2016), “a ‘concrete injury must actually exist but need not be tangible.” In addition, “[a] legislature may ‘elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.” Id. A merely procedural violation without any concrete harm, however, does not suffice. Rather, a plaintiff “must show that the statutory violation presented an appreciable risk of harm to the underlying concrete interest that [the legislature] sought to protect by enacting the statute.” Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 887 (7th Cir. 2017).
The Bryant court distinguished several cases addressing similar Article III standing issues. It distinguished its decision in Miller v. Southwest Airlines Co., 929 F.3d 898, 902 (7th Cir. 2019), because the plaintiffs there had faced the “prospect of a material change in [their] terms and conditions of employment,” which alleged the “concrete dimension” of injury necessary to demonstrate Article III standing. It also distinguished the Ninth Circuit’s recent BIPA decision in Patel v Facebook, Inc., 932 F.3d 1264, 1273 (9th Cir. 2019), which concluded that the common-law right to privacy supplied a concrete interest that was infringed by the defendant’s “invasion of an individual’s biometric privacy rights.” Finally, it distinguished the Second Circuit’s BIPA decision in Santana v. Take-Two Interactive Software, Inc., 717 F.App’x 12, 15 (2d Cir. 2017), because the Santana court concluded that where the plaintiff had voluntarily sat still for fifteen minutes while a computer created a scan of his face to create a video game character, he had given as much consent as one could imagine, leaving only a procedural BIPA violation incapable of establishing Article III standing.
The Bryant court held that the plaintiff had alleged a concrete injury-in-fact establishing Article III standing and therefore reversed the district court’s decision. Particularly instructive to the court’s decision was Justice Thomas’s concurring opinion Spokeo. In Spokeo, Justice Thomas drew a “helpful distinction” between two types of injuries. The first type of injury arises when a plaintiff asserts a violation of her own rights, and the second occurs when a private plaintiff seeks to vindicate public rights. Applying Justice Thomas’s rubric, the Bryant court held:
[W]e have no trouble concluding that Bryant was asserting a violation of her own rights—her fingerprints, her private information—and that is enough to show injury-in-fact without further tangible consequences. This was no bare procedural violation; it was an invasion of her private domain, much like an act of trespass would be. Each individual person has distinct biometric identifiers. The common interest in robust protections of personal privacy, however, is the same as the shared support for the types of laws Justice Thomas mentioned.
The court accordingly concluded that Compass’s failure to issue the required disclosures and obtain the plaintiff’s informed consent prior to collecting her fingerprint scan was more than a bare procedural BIPA violation and satisfied the concrete injury-in-fact requirement for Article III standing. It noted that the purpose of BIPA is to “ensure that consumers understand, before providing their biometric data, how that information will be used, who will have access to it, and for how long it will be retained,” and as the Illinois Supreme Court held in Rosenbach v. Six Flags Entertainment Corp., 129 N.E.3d 1197 (2019), this informed consent regime sits at the heart of BIPA. Deprived of the ability to give informed consent prior to scanning her fingerprint, the plaintiff “did not realize there was a choice to be made and what the costs and benefits were for each option.” This deprivation amounted to a concrete injury-in-fact establishing Article III standing. On the other hand, her section 15(a) claim was a public injury type of claim that fell outside of the informed consent regime for which she had not sufficiently alleged standing to sue.
The Seventh Circuit’s holding in Bryant represents a significant decision in an evolving area of privacy law in the federal courts. State and federal courts have been inundated with BIPA claims related to the collection and storage of biometric information without complying with BIPA’s notice and consent requirements since the Illinois Supreme Court held in Rosenbach that a plaintiff need not show actual injury to bring a BIPA claim in state court. Bryant confirms that the federal courts also have jurisdiction to hear such informational injury claims where the plaintiff has not alleged that any actual injury arises from the BIPA violation.
