In a decision issued on May 6, 2020, the U.S. Court of Appeals for the Seventh Circuit held that a plaintiff alleged a concrete injury sufficient to satisfy the Article III "injury-in-fact" requirement for standing when she claimed her employer failed to disclose how it intended to use biometric information it collected from her through a vending machine in violation of the Illinois Biometric Information Privacy Act (BIPA). The decision - Bryant v. Compass Group USA, Inc., No. 20-1443 2020 WL 2121463 (7th Cir. May 5, 2020) - deepens a circuit split on the issue of whether the collection of biometric information in violation of BIPA is sufficient to confer standing in federal court.

Christine Bryant worked for a call center that had vending machines owned by Compass Group USA, Inc. in its cafeteria. Instead of accepting cash, the vending machines required users to establish an account and make purchases using their fingerprints. Bryant alleged that Compass did not inform her in writing that her fingerprint was being collected, did not inform her of the specific purpose and length of time her biometric information would be stored and used, and did not obtain her permission to collect her fingerprint.

Section 15(a) of BIPA requires a collector of biometric information to disclose to the public a written retention schedule and destruction guidelines for the information collected. Section 15(b) of BIPA requires, among other things, that a collector of a person's biometric identifiers obtain the written informed consent of the person before collection. While the Seventh Circuit found that Bryant lacked standing to pursue her claim under Section 15(a), it held she sufficiently alleged injury-in-fact to pursue her Section 15(b) claim because Compass's failure to make these disclosures denied Bryant the ability to make informed consent about the use of her biometric information.

Looking to the standard set forth in the Supreme Court's decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), the Seventh Circuit explained that a legislature may "elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law" and that, while a concrete injury must exist, it need not be tangible. The plaintiff must show the violation presented an "appreciable risk of harm" to the underlying concrete interest the legislature sought to protect.

Applying the Spokeo standard, the court held that Bryant's assertion of the misuse of her private information, her fingerprints-was sufficient to establish injury-in-fact without additional tangible consequences. Reasoning that the informed consent requirement was the "heart of BIPA," the court found Compass's failure to follow that requirement deprived Bryant of the opportunity to actually consider the risks of giving away her biometric information. As the Seventh Circuit put it: "She did not realize that there was a choice to be made and what the costs and benefits were for each option. This deprivation is a concrete injury-in-fact that is particularized to Bryant."

The decision departs from the Second Circuit's approach in Santana v. Take-Two Interactive Software, Inc., 717 F. App'x 12 (2d Cir. 2017), which found that the collection of biometric data for use in a company's video games did not raise a material risk of harm to plaintiffs sufficient to confer standing, but comports with the Ninth Circuit's ruling in Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019), cert. denied, 140 S. Ct. 937 (2020), which found that Facebook's alleged BIPA violations through the use of its facial-recognition technology constituted an injury-in-fact.