On November 17, 2020, the Seventh Circuit addressed what constitutes an injury-in-fact for standing purposes under Illinois’s privacy law, the Biometric Information Privacy Act (“BIPA”). This is the latest in a series of federal court decisions defining the state privacy law’s injury requirement under Spokeo, Inc. v. Robins following the Illinois Supreme Court’s ruling that actual injury was not required to bring a claim for violation of BIPA in state court in Rosenbach v. Six Flags Entertainment Corp. The ruling addresses a question left open by the Seventh Circuit’s prior ruling in Bryant v Compass Group USA Inc., a case Predominant Issues reported on in May 2020, and broadens the types of BIPA claims that can be brought in, or removed to, federal court.

• Section 15(a) of the Act requires an employer that collects biometric information—including fingerprints, retina and iris scans, hand scans, and facial geometry—from its employees to develop, publicly disclose, and comply with a data-retention schedule and guidelines for permanent destruction of the biometric information.
• Plaintiff Raven Fox, a former employee of Dakkota Integrated Systems, LLC, brought a putative class action in state court alleging that the company violated Section 15(a) by collecting her handprint in the use of its timekeeping technology but failing to develop, publicly disclose, and comply with a policy for the retention and destruction of the handprint.
• This lawsuit came on the heels of Bryant, in which the Seventh Circuit ruled that while a plaintiff employee could proceed under BIPA’s Section 15(b) (relating to the collection of biometric information), she lacked Article III standing to do so with respect to her former employer’s alleged failure to develop a publicly available data-retention policy. In Bryant, the Seventh Circuit reasoned that an employer’s duties under Section 15(a) are “owed to the public generally, not to the particular persons whose biometric information the entity collects.”
• Courts had interpreted the Bryant decision to hold that all Section 15(a) plaintiffs lack standing to sue in federal court. In line with these decisions, when Dakkota removed the case to federal court, the district court held, sua sponte, that the plaintiff lacked Article III standing under Bryant.
• On appeal, however, the Seventh Circuit ruled that the district court “made a mistake” when it remanded Fox’s Section 15(a) claim to state court.
• Specifically, the Seventh Circuit found an injury-in-fact because, unlike the plaintiff in Bryant (who alleged a mere procedural failure), Fox alleged that Dakkota not only failed to develop and publicly disclose a data collection policy, but also unlawfully retained her biometric information after she was no longer employed there. The court held that this retention, in and of itself, is a sufficient injury.
  • In particular, the court distinguished the case from Gubala v. Time Warner Cable, Inc., 846 F.3d 909 (7th Cir. 2017), which dealt with the allegedly unlawful retention of a former cable customer’s account information (including credit card and social security numbers). The Seventh Circuit determined that biometric identifiers are “meaningfully different because they are immutable, and once compromised, are compromised forever—as the legislative findings in BIPA reflect.”
• The Fox v. Dakkota Integrated Systems, LLC decision, which can be read here, opens the door to federal courts for BIPA actions under section 15(a) if the plaintiff alleges a failure to comply with its required privacy policies concerning protected information.