Since the Illinois Supreme Court held in Rosenbach v. Six Flags Entertainment Corp. in 2019 that a plaintiff need not show actual injury to bring an Illinois Biometric Information Privacy Act (“BIPA”) claim in state court, courts have seen a barrage of BIPA lawsuits alleging violations of the statute’s informed consent and notice provisions. This blog post addresses two recent decisions impacting BIPA claims: the Illinois Supreme Court’s decision to take up a case which may definitively decide whether certain BIPA claims are preempted by the Illinois Workers’ Compensation Act (“IWCA”); and the Seventh Circuit’s January 2021 decision on federal standing requirements with regard to BIPA cases that merely allege procedural injuries.

     1. McDonald v. Symphony Bronzeville Park, 2020 IL App (1st) 192398

In McDonald, the plaintiff filed a class action lawsuit against her employer, Symphony of Bronzeville, a nursing home, alleging that during her employment she was required to provide biometric information by scanning her fingerprint into Bronzeville’s time keeping system. McDonald further alleged that Symphony collected this information from McDonald and other employees without properly “(1) informing the employees in advance and in writing of the specific purpose and length of time for which their fingerprints were being collected, stored, and used; (2) providing a publicly available retention schedule and guidelines for permanently destroying the scanned fingerprints; and (3) obtaining a written release from the employees prior to the collection of their fingerprints” as BIPA requires. McDonald sought injunctive relief as well as liquidated damages and attorneys’ fees under BIPA. McDonald alleged in each count that she had suffered and continued to suffer “mental anguish and mental injury” in that she “experience[d] mental anguish when thinking about what would happen to her biometric identifiers or information if Defendants went bankrupt, whether Defendant will ever delete her biometric identifiers or information, and whether (and to whom) Defendants share her biometric identifiers or information.”

Bronzeville moved to dismiss McDonald’s complaint. Among the arguments that Bronzeville raised was an assertion that McDonald’s BIPA claims were barred by the exclusivity provisions of the IWCA. In response, McDonald filed an amended complaint that removed the allegations of mental anguish. Symphony thereafter renewed its motion to dismiss.

The Circuit Court of Cook County denied Bronzeville’s motion to dismiss. In doing so, the circuit court rejected Bronzeville’s argument that the IWCA preempted any claims available to an employee against an employer pursuant to BIPA. Bronzeville moved for reconsideration or, alternatively, certification for appeal. While the circuit court rejected Bronzeville’s motion to reconsider, it certified the following question for interlocutory appeal: “Do[ ] the exclusivity provisions of the [IWCA] bar a claim for statutory damages under [BIPA] where an employer is alleged to have violated an employee's statutory privacy rights under [BIPA]?”

On appeal, the Illinois Appellate Court for the First District closely examined the interplay between BIPA and the IWCA. The court noted that the IWCA generally “substitutes an entirely new system of rights, remedies, and procedure for all previously existing common law rights and liabilities between employers and employees subject to the [IWCA] for accidental injuries or death of employees arising out of and in the course of the employment.” To that end, the IWCA specifically states that:

• No common law or statutory right to recover damages from the employer . . . is available to any employee who is covered by the provisions of this Act, to any one wholly or partially dependent upon him, the legal representatives of his estate, or any one otherwise entitled to recover damages for such injury.

820 ILCS 305/5(a). The IWCA further provides that “[t]he compensation herein provided, together with the provisions of this Act, shall be the measure of the responsibility of any employer engaged in any of the enterprises or businesses enumerated in Section 3 of this Act.” Id., at § 11.

These provisions, taken together, are generally construed to render the IWCA the exclusive means by which an employee can recover against an employer for a workplace-related injury. The only way that an employee can escape the exclusivity provisions of the IWCA is if the employee establishes that the injury (1) was not accidental; (2) did not arise from his employment; (3) was not received during the course of employment; or (4) was not compensable under the IWCA. With respect to the fourth option for avoiding the exclusivity of the IWCA, the court stated that it is only where “the injury is the type of work-related injury within the purview of the [IWCA]” that the employer’s liability is governed exclusively by the IWCA.

With this framework in mind, the court then proceeded to determine whether a BIPA violation caused the type of injury that was within the purview of the IWCA. The court analyzed the Illinois Supreme Court’s decision in Rosenbach, which held that a procedural BIPA violation may give rise to employer liability even in the absence of damages and that the reason such liability is imposed is to give preclusive effect to BIPA and incentivize employers to follow its provisions before actual damages are allowed to occur. The McDonald court found that unlike BIPA, the IWCA was drafted to provide recourse to employees for injuries which they have already incurred. Moreover, the IWCA was not enacted to apply to potential or even anticipated future injuries. In deciding this issue, the court held:

• In light of the above discussion, we fail to see how a claim by an employee against an employer for liquidated damages under the Privacy Act—available without any further compensable actual damages being alleged or sustained and designed in part to have a preventative and deterrent effect—represents the type of injury that categorically fits within the purview of the [IWCA], which is a remedial statute designed to provide financial protection for workers that have sustained an actual injury. As such, we conclude that the exclusivity provisions of the [IWCA] do not bar a claim for statutory, liquidated damages, where an employer is alleged to have violated an employee's statutory privacy rights under [BIPA], as such a claim is simply not compensable under the [IWCA].

While the court answered the certified question in the negative, it affirmed the circuit court’s denial of Bronzeville’s motion to dismiss, and remanded the matter back to the circuit court, so the issue was not definitively resolved. On January 27, 2021, the Illinois Supreme Court granted Bronzeville’s request for leave to appeal the appellate court’s ruling. The Supreme Court’s ultimate decision in this case may clarify what preemptive effect, if any, the IWCA has on BIPA class action claims.

        2. Thornley v. Clearview AI, Inc., 984 F.3d 1241 (7th Cir. 2021)

In Thornley, the plaintiff brought a class action suit against Clearview AI, a software company that uses a sophisticated algorithm to pull pictures from popular social media websites (Facebook, Instagram, LinkedIn, etc.) and stores them in a database for ultimate sale to private businesses and law enforcement agencies. Thornley filed her initial complaint against Clearview in the Circuit Court of Cook County, Illinois in March 2020, asserting violations of sections 15(a)-(c) of BIPA, which (a) requires private entities to maintain a written policy establishing a retention schedule and policies for destroying biometric information and identifiers, (b) requires private entities to obtain an individual’s written consent before collecting and/or storing their biometric information or identifiers, and (c) prohibits private entities from selling or otherwise profiting from an individual’s biometric information or identifiers.

Clearview removed the case to federal court pursuant to 28 U.S.C. § 1441. In response, Thornley dismissed her complaint without prejudice and refiled a second complaint in state court in May 2020. The second complaint narrowed the size of the purported class and also focused exclusively on section 15(c) of BIPA, which prohibits a private entity from profiting from the collection or sale of biometric identifiers. Clearview again removed the case to federal court. This time, Thornley filed a motion to remand the case back to state court, arguing that the BIPA violations that she alleged in the second complaint could not satisfy Article III standing to sue in federal court. The district court agreed with Thornley and ordered the case remanded to state court. Clearview timely appealed.

On appeal, the Seventh Circuit was tasked with deciding whether Thornley’s second complaint satisfied Article III standing, which is generally more stringent than Illinois’ state court standing requirements, and requires a plaintiff to demonstrate “(1) that he or she suffered an injury in fact that is concrete, particularized, and actual or imminent, (2) that the injury was caused by the defendant, and (3) that the injury would likely be redressed by the requested judicial relief.” Thole v. U.S. Bank N.A., 140 S. Ct. 1615 (2020). With no serious dispute as to the second and third standing factors, the court focused its inquiry on the first factor of whether Thornley had satisfied the injury-in-fact requirement.

The Seventh Circuit discussed several of its prior BIPA decisions in analyzing whether Thornley had satisfied Article III standing. One of these decisions was Bryant v. Compass Group USA, Inc., 958 F.3d 617 (7th Cir. 2020). In Bryant, an employee alleged that a vending machine company that provided smart vending machines to plaintiff’s employer violated sections 15(a) and (b) of BIPA by requiring plaintiff and the purported class to scan a fingerprint to obtain items from the vending machines notwithstanding the fact that the vending machine company did not furnish the users a retention schedule or obtain their informed consent. Id. at 619. As in Thornley, the defendant removed the case to federal court, and the plaintiff was forced to argue that the claims did not meet Article III standing requirements, a twist on the typical scenario where a plaintiff must contend that standing does exist. In reaching its decision, the court differentiated between the 15(a) and 15(b) claims for standing purposes, finding that because Bryant’s 15(a) claim alleged the violation of a duty owed to the public generally, it did not demonstrate the requisite injury-in-fact for Article III standing purposes. Id. at 626. With respect to Bryant’s 15(b) claim, however, the court found that Bryant had established standing because the requirement to (i) inform those from whom it was collecting data that it was doing so and why, and (ii) to obtain their written consent, was sufficiently concrete and particularized to confer standing. Id. at 626-27.

The last case which the Seventh Circuit specifically analyzed was its November 2020 decision in Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146 (7th Cir. 2020). In Fox, the plaintiff contended that her former employer had violated section 15(a) of BIPA by failing to comply with its own data retention and destruction policies. As in Thornley and Bryant, Fox had initiated the action in state court and Dakkota removed it to federal court. The issue before the Seventh Circuit was whether the case had to be remanded to state court on Article III standing grounds. The court answered this inquiry in the negative, concluding that “[a]n unlawful retention of biometric data inflicts a privacy injury in the same sense that an unlawful collection does.” Id. at 1154. The court further held that “an unlawful retention of a person's biometric data is as concrete and particularized an injury as an unlawful collection of a person's biometric data. If the latter qualifies as an invasion of a ‘private domain, much like an act of trespass would be,’ Bryant, 958 F.3d at 624, then so does the former.” Id. at 1155.

Finally, and before addressing the specific facts of Thornley’s case, the court noted two additional considerations governing its decision. The first was the U.S. Supreme Court’s comment on Article III standing in Spokeo, Inc. v. Robbins, 136 S. Ct. 1540 (2016). The Spokeo court identified an important corollary to the rule that injury-in-fact must be both concrete and particularized as the requirement that “the plaintiff must clearly allege facts demonstrating each element.” Id. at 1547 (internal citations omitted). This is important, because it gives meaning to the facts of a plaintiff’s case and the allegations specifically included in their complaints. The second consideration was that for injury-in-fact purposes, there is no distinction between alleged procedural injuries and alleged substantive injuries, in that Article III standing may be satisfied regardless of the type of injury alleged.

With this framework in mind, the court examined the facts of Thornley’s case. The court concluded that Thornley’s claim did not rise to the requisite level to create Article III standing because it was confined to section 15(c) of BIPA, which prohibits a private entity from profiting from the sale or trade of an individual’s biometric information. Thornley’s allegations that Clearview had violated section 15(c), without alleging any damages specific to the named plaintiff resulting from the violation, “described only a general, regulatory violation, not something that is particularized to them and concrete.” The court therefore held that Article III standing was lacking and affirmed the trial court’s remand of the case back to state court.¹

On January 27, 2021, Clearview requested a panel rehearing or rehearing en banc before the Seventh Circuit challenging the Seventh Circuit’s holding that Thornley’s claim failed to meet the injury-in-fact requirement for establishing Article III standing in federal court. Clearview argued that the Seventh Circuit’s decision represents a departure from the U.S. Supreme Court’s precedent set forth in Spokeo, in that the statutory violation at-issue (i.e., the alleged violation of section 15(c) of BIPA) did in fact cause a concrete privacy interest injury to the named plaintiffs and purported class such that the federal courts could properly exercise jurisdiction over the matter. The petition seeks clarification from the court on what exactly constitutes an injury-in-fact for Article III standing purposes in the context of a mere procedural violation. This issue may provide guidance to courts all over the country adjudicating cases brought under BIPA.

¹The court also noted that Thornley had apparently intentionally limited the size of the class so as to avoid the possibility that the case might be successfully removed to federal court, but concluded that she was free to do so under the applicable rules.