Two significant decisions on the issue of standing to sue were handed down by the Illinois courts on January 25, 2019. Both of them offer significant assistance to the plaintiff’s class action bar by easing the requirements for alleging standing, thereby encouraging the filing of more cases against consumer financial institutions.
In the first case, Rosenbach v. Six Flags Entertainment Corp., 2019 WL 323902 (Ill. Jan. 25, 2019), the Illinois Supreme Court held that no actual injury needs to be pleaded or proven to provide standing to sue for violation of the Illinois Biometric Information Privacy Act (BIPA) (discussed in a recent Cybersecurity and Privacy alert here). The BIPA, which is the most restrictive biometric privacy statute in the country, has been the subject of numerous cases in Illinois and across the nation where Illinois residents’ biometric information recorded by financial institutions and other corporations may be involved.
In the second case, Dunkin v. FedEx Office & Print Services, Inc., 2019 WL 346593 (Ill. App. 1st Dist. Jan. 25, 2019), the Illinois Appellate Court held that under Illinois precedent, no actual injury was necessary to provide standing to sue for violation of the federal Fair and Accurate Credit Transactions Act (FACTA) for failure to properly truncate credit card information. This case enlarges the number of forums in which an expansive view on standing has been taken.
Rosenbach v. Six Flags Entertainment Corp.
In Rosenbach, the Illinois Supreme Court resolved a split between two districts of the Illinois Appellate Court, ruling that no allegation of actual injury is required in order to state a cause of action for violation of the BIPA, 740 ILCS 14/1 et seq. The court noted that its ruling rejecting such a requirement was the same result that was “correctly reasoned” by a California federal court in In re Facebook Biometric Information Privacy Litigation, 326 F.R.D. 535, 545-47 (N.D. Cal. 2018), a decision that is currently on appeal to the Ninth Circuit.
The BIPA protects “biometric information” that consists of stored “biometric identifiers,” identified as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10. The Act does so by requiring that certain disclosures be made and that a written consent be obtained before such information can be collected. 740 ILCS 14/15. Violations are subject to statutory damages plus attorney’s fees, and injunctive relief.
The Rosenbach case, previously described in our Workplace Initiatives and Strategies for Employers (WISE) blog, involved a 14-year-old boy who was directed by Six Flags Great America amusement park to go to a security checkpoint where he had to have his thumbprint scanned in order to get his season pass. No disclosures were made about the thumbprint or what would be done with it, nor was any consent obtained for taking the thumbprint. A class action was brought seeking statutory damages and injunctive relief for this violation of the BIPA.
The circuit court denied a motion to dismiss the case but on an interlocutory appeal, the Illinois Appellate Court reversed, finding that an action cannot be brought for statutory damages under the Act if no actual injury is alleged, and that a person is not “aggrieved” for purposes of seeking injunctive relief within the meaning of the Act when the only injury alleged is failure to make the required disclosures and failure to obtain a written consent. Another district of the Illinois Appellate Court reached the opposite conclusion in Sekura v. Krishna Schaumburg Tan, Inc., 2018 WL 4699213 (2d Dist. Sept. 28, 2018).
The Illinois Supreme Court found that the BIPA was not like the Illinois Consumer Fraud and Deceptive Business Practices Act, which requires actual damage in order to bring a private right of action. Instead, it held that the language of section 20 of the BIPA “provides merely that ‘[a]ny person aggrieved by a violation of this Act shall have a right of action in a state circuit court or as a supplemental claim in federal district court against an offending party.’” The court found that the BIPA provision was quite similar to the provisions of the AIDS Confidentiality Act, where all that is necessary to be “aggrieved” for purposes of standing to bring a suit is a violation of the statute.
The Rosenbach court found that its holding was consistent with more than a century of Illinois jurisprudence on the meaning of “aggrieved.” It rejected the appellate court’s ruling that no cause of action can be pursued for a merely “technical” violation of the statute, stating that:
This construction of the law is supported by the General Assembly’s stated assessment of the risks posed by the growing use of biometrics by businesses and the difficulty in providing meaningful recourse once a person’s biometric identifiers or biometric information has been comprised . . . . The situation is particularly concerning, in the legislature’s judgment, because “[t]he for ramifications of biometric technology are not fully known.” (citing 740 ILCS 14/5(f)).
The court found that the statutory scheme of the BIPA is one that tries “to head off such problems before they occur,” by imposing safeguards through required disclosures and the obtaining of consent, and “by subjecting private entities who fail to follow the statute’s requirements to substantial potential liability, including liquidated damages, injunctions, attorney’s fees, and litigation expenses ‘for each violation’ of the law . . . whether or not actual damages, beyond violation of the law’s provisions, can be shown.
This unanimous pronouncement by the Illinois Supreme Court will no doubt add fuel to the fire in pending and future BIPA cases around the country. Notably, the court did not discuss any question of standing to sue that might have arisen by application of the U.S. Supreme Court’s decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), which held that a concrete and particularized harm must be alleged as an injury-in-fact and that a “bare procedural violation” of a federal consumer protection statute not tied to a concrete harm will not suffice to provide standing to sue.
Dunkin v. FedEx Office & Print Services, Inc.
In Dunkin, the Illinois Appellate Court dealt with the question of whether a plaintiff whose credit card information was not properly truncated under the FACTA has standing to sue for violation of the Act without alleging any further actual injury. In this case, unlike in Rosenbach, the court dealt directly with the question of whether it should apply the Spokeo ruling that the constitutional requirement of an injury-in-fact requires more than a mere violation of a federal statute, so that a plaintiff must plead the existence of some concrete injury “fairly traceable” to the defendant’s conduct that is likely to be redressed by a favorable court decision.
The appellate court noted that a number of federal courts had applied Spokeo in FACTA cases to find that plaintiffs lacked standing to sue if all they allege is that their credit card information was not properly truncated, while other federal courts have reached the opposite conclusion. The appellate court distinguished Spokeo on two bases. First, it found that the Spokeo Court “did not consider the fact of the statute’s clear prohibition against the printing of more than the last five digits of a consumer’s card number,” which made the holding inapposite.
Second, the Dunkin court held that “Illinois courts are not required to follow federal law on issues of justiciability and standing,” citing Greer v. Illinois Housing Development Authority, 122 Ill. 2d 462, 491 (1988). It found that the Illinois Supreme Court’s ruling on standing in Glisson v. City of Marion, 188 Ill. 2d 211, 221 (1999), correctly stated the law that it must follow, that an injury-in-fact “be (1) distinct and palpable; (2) fairly traceable to the defendant’s actions; and (3) substantially likely to be prevented or redressed by the granting of the requested relief.” It further found, in particular, “under Illinois law, where plaintiff alleges a statutory violation, no ‘additional requirements’ are needed for standing,” citing Glisson, 188 Ill. 2d at 222. Thus, it found that the plaintiff had standing to bring a FACTA credit card truncation claim in Illinois state courts under Illinois law on standing to sue, even if the same plaintiff might not be found to have standing to sue for that violation in a federal court.
