On May 5, the Seventh Circuit held that an employer’s collection of employee biometric data without first making certain disclosures and obtaining written informed consent, as required by the Illinois Biometric Information Privacy Act (“BIPA”), constituted a concrete “injury in fact” sufficient to confer Article III standing.

• The Illinois legislature passed the BIPA in 2008 to “protect consumers against the threat of irreparable privacy harms, identity theft, and other economic injuries arising from the increasing use of biometric identifiers and information by private entities.” Accordingly, the BIPA requires biometric-information collectors to provide certain disclosures and obtain written informed consent before acquiring biometric data. Any person “aggrieved” by a violation of the BIPA is entitled to bring a private action.
• The named plaintiff, Christine Bryant, filed a class action lawsuit in state court alleging that her employer, Compass Group USA, Inc. (“Compass”), violated the BIPA by instructing employees to provide fingerprints for vending machine purchases without providing information about collection and storage of those fingerprints—and without obtaining their consent. Bryant did not claim that she was unaware that her fingerprint was being collected and stored. Rather, she simply alleged that Compass failed to make the required disclosures and denied her the ability to give informed consent.
• Compass removed the action to federal court under the Class Action Fairness Act. The district court subsequently held that Compass’s alleged violations caused no concrete harm as required for Article III standing and remanded the action to the state court. In what the Seventh Circuit characterized as a “role reversal,” Compass petitioned for permission to appeal under 28 U.S.C. § 1453(c) in an attempt to remain in federal court, arguing that Article III standing existed (whereas plaintiff argued it did not).
• On appeal, the Seventh Circuit held that violation of the informed consent provisions constituted a concrete injury sufficient to give rise to Article III standing because it “denied Bryant and others like her the opportunity to consider whether the terms of that collection and usage were acceptable given the attendant risks.” The court explained that this was, in fact, “the concrete injury BIPA intended to protect against, i.e. a consumer’s loss of the power and ability to make informed decisions about the collection, storage, and use of her biometric information.”
  • The court noted that Bryant, equipped with the missing information, might have chosen to bring her own lunch—or might have continued using the machines just the same. Nevertheless, the deprivation of the choice to consider the costs and benefits of each option constituted a concrete and particularized injury, not a bare procedural violation.
  • However, the Seventh Circuit held that Bryant lacked standing to bring claims related to Compass’s duty to publicly disclose its biometric data retention schedule and destruction guidelines because that duty “is owed to the public generally, not to particular persons whose biometric information the entity collects.” Thus, Bryant did not suffer a concrete and particularized injury with respect to those public-disclosure claims.
• This opinion furthers a circuit split that has developed concerning what injury is required under Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), to allege standing in cases involving alleged violations of the BIPA. Given the proliferation of biometric privacy laws across the nation, these issues are likely to become fertile sources of litigation in the coming years.
• Read the Seventh Circuit’s opinion in Bryant v. Compass Group USA, Inc., No. 20-1443 (7th Cir.), here.