Seventh Circuit Holds Alleged Violation of Illinois Biometric Information Privacy Act Confers Article III Standing

The U.S. Court of Appeals for the Seventh Circuit recently rejected a rather unusual argument for a plaintiff in federal court. The plaintiff asserted she lacked Article III standing to pursue her claim, and did so as a basis for remanding the case to state court. In Bryant v. Compass Group USA, Inc., the Seventh Circuit held that a procedural violation of Illinois’ Biometric Information Privacy Act (BIPA), 740 ILCS 14, satisfies the injury-in-fact requirement for Article III standing, and thus the defendant properly removed the case to federal court.

Plaintiff Christine Bryant’s employer installed vending machines, owned and operated by defendant Compass Group USA, Inc., that required a user to establish an account using her fingerprint to make purchases. Fingerprints are “biometric identifiers” within the meaning of BIPA. In her complaint, Bryant alleged that Compass Group violated BIPA Section 15(a) by not making publicly available its retention schedule and guidelines for permanently destroying stored biometric identifiers. Additionally, Bryant claimed that Compass Group violated Section 15(b) of BIPA by (1) not informing her in writing that her biometric identifier was being collected or stored, (2) not informing her in writing of the specific purpose and length of the term for which her fingerprint was being collected, stored, and used, and (3) not obtaining her written release to collect, store, and use her fingerprint.

When Compass Group removed the case to federal court, Bryant, in a bid to remand the case back to state court, argued that she did not have Article III standing because the BIPA Section 15(a) and (b) violations she alleged were bare procedural violations that did not constitute injury-in-fact under Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016). As the Seventh Circuit noted, “Bryant does not assert that she did not know that her fingerprint was being collected and stored, nor why this was happening. She voluntarily created a user account for the Smart Market vending machines and regularly made use of the fingerprint scanner to purchase items from the machines. She contends simply that Compass’ failure to make the requisite disclosures denied her the ability to give informed written consent as required by 15(b). Compass’ failure to comply with the Act resulted, both for her and others similarly situated, in the loss of the right to control their biometric identifiers and information.”

Compass Group argued that, through BIPA, the Illinois legislature elevated to protectable status a person’s right to control her own biometric identifiers and information. Because Section 15(b) of BIPA confers a right to receive certain information from an entity that collects, stores, or uses a person’s biometric information, and to make an informed decision based on that information, Compass Group asserted that violations of 15(b) are actionable intrusions upon the right of control protected by BIPA. This position, albeit an uncommon one for a defendant in a federal lawsuit, is in line with the Illinois Supreme Court’s previous rulings that a person harmed by procedural violations of BIPA is an “aggrieved person” for the purposes of the statute.

The Seventh Circuit agreed with Compass Group. Applying Justice Thomas’ analysis from his Spokeo concurrence, the court considered whether Bryant sought to vindicate a private right, or a public one. The court reasoned that the disclosure requirements in Section 15(b) of BIPA grant individuals a right to be fully informed as to how their biometric information will be used before deciding to disclose such information, and thus found that Section 15(b) protects a private right. Therefore, the court held that Compass Group’s failure to provide the 15(b) disclosures constitutes “a concrete injury-in-fact that is particularized to Bryant.” By contrast, the court held that violations of the public disclosure requirements in Section 15(a) of BIPA do not confer Article III standing because Section 15(a) creates an obligation to the public generally, and is not particularized to specific individuals. Unlike her Section 15(b) claim, Bryant’s Section 15(a) claims vindicated only a public right.

On May 19, 2020, Compass Group moved for a rehearing en banc, arguing that the court had mistakenly created a circuit split by holding that Section 15(a) protects only public interests and therefore cannot give rise to Article III standing. Alternatively, Compass Group requested limited rehearing by the panel on the Section 15(a) issue. Compass Group pointed to the Ninth Circuit’s holding in Nimesh Patel et al. v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019), which found Article III standing for Section 15(a) claims without drawing a distinction between public and private interests. Compass Group also argued that the court failed to consider Section 15(a) in its entirety, asserting that the public disclosure requirements under that section are central to the right to informed consent protected by Section 15(b).

While the Article III standing landscape continues to evolve post-Spokeo (see other blog posts addressing Spokeo issues here, here, and here), litigants should expect to see the Seventh Circuit’s analysis applied to claims for procedural violations of other consumer protection statutes.