May.14.2020
On May 5, 2020, the Seventh Circuit held in Bryant v. Compass Group USA, Inc. that a plaintiff who asserted a violation of the Illinois Biometric Information Privacy Act’s (“BIPA’s”) notice and consent requirements had Article III standing to pursue her claim in federal court. With respect to BIPA’s retention schedule posting requirement, however, the Seventh Circuit found that allegations of a statutory violation did not, on their own, suffice to confer Article III standing. This decision will make it easier for defendants to keep BIPA claims in federal court, and its standing analysis has significant implications for BIPA cases, as well as other privacy and data security cases more broadly.
Background
The dispute in Bryant arises from vending machines in the plaintiff’s workplace cafeteria that accepted fingerprint scans (connected to payment accounts) rather than cash. The plaintiff alleged that she created an account for the machines, which were owned and operated by Compass, and that she regularly used the fingerprint scanner to purchase items from them.
The plaintiff, on behalf of herself and a putative class, asserted two BIPA violations in connection with these machines. First, she claimed that Compass had violated Section 15(a) by failing to make publicly available a retention schedule for the biometric data that Compass was collecting. Second, she alleged that Compass had violated Section 15(b) by failing to make the required written disclosures and obtain the required written consent prior to collecting her biometric data.
After Compass removed the action to federal court, the district court granted the plaintiff’s motion to remand. It found that both the alleged Sections 15(a) and 15(b) violations were mere procedural violations and, accordingly, did not establish the “concrete” harm required for Article III standing under the Supreme Court’s framework set forth in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016).
In order for a plaintiff to have Article III standing, she must have suffered an injury-in-fact that is actual or imminent, concrete, and particularized. In Spokeo, the Supreme Court explained that a “concrete” injury need not be “tangible,” but it “must actually exist.” Thus, “a bare procedural violation, divorced from any concrete harm” is an insufficient basis to proceed in federal court. The Supreme Court offered two guideposts for determining whether an intangible harm, such as a privacy violation, constitutes an injury-in-fact: (1) whether the “harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts”; and (2) whether Congress has elevated the harm to the status of a legally cognizable injury.
In a concurrence, Justice Thomas added that the concrete harm requirement is more difficult to satisfy when the plaintiff is seeking to vindicate a public right (involving a duty to the entire community, such as a public nuisance claim) rather than a private right (involving a right belonging to the individual, such as a trespass claim). According to Justice Thomas, while “a plaintiff seeking to vindicate a statutorily created private right need not allege actual harm beyond the invasion of that private right,” “[a] plaintiff seeking to vindicate a [statutorily created] public right . . . must demonstrate that the violation of that public right has caused him a concrete, individual harm distinct from the general population.”
Section 15(b)—Notice and Consent
To determine whether the alleged Section 15(b) violation in Bryant inflicted a concrete harm, the Seventh Circuit asked whether the “nature of the interest” that Section 15(b) seeks to protect is “personal or public” (citing Justice Thomas’s Spokeo concurrence) and whether it is “informational, or formal.” Applying “Justice Thomas’s rubric” first, the Seventh Circuit concluded that the plaintiff’s Section 15(b) claim asserted a violation of her private rights—“an invasion of her private domain”—and therefore was “no bare procedural violation” but a concrete injury conferring Article III standing.
The Seventh Circuit came to the same conclusion when analyzing the plaintiff’s Section 15(b) injury “as a type of informational injury.” Under the informational injury line of cases, which the Spokeo majority decision had cited favorably, the withholding of information required by statute to be disclosed creates a concrete injury “if the plaintiff establishes that the withholding impaired her ability to use the information in a way the statute envisioned.” Here, the Seventh Circuit found that Compass’s alleged failure to provide the plaintiff the obligatory Section 15(b) disclosures “deprived her of the ability to give the informed consent section 15(b) mandates.” The Seventh Circuit held this deprivation was a concrete injury.
Section 15(a)—Public Retention Schedule
As to Section 15(a), however, the Seventh Circuit held the plaintiff had failed to allege a concrete and particularized harm. Applying Justice Thomas’s public-versus-private-right analysis, it found that Section 15(a)’s duty to disclose retention information is “owed to the public generally” rather than to the individual whose biometric data is collected. Because this provision is “not part of the informed-consent regime” and because the plaintiff had not alleged a particularized harm resulting from Compass’s violation, the Seventh Circuit found the plaintiff lacked Article III standing to assert her Section 15(a) claim.
Implications
Bryant’s Section 15(b) holding will bolster defendants’ ability to litigate BIPA claims in federal court. Unlike in data breach cases, where the putative classes often are nationwide and defendants often argue against Article III standing, BIPA cases are limited to putative classes of Illinois residents and the trend has been for defendants to seek removal to federal court and argue that the plaintiff sufficiently alleged an injury-in-fact. In contrast to many of the claims asserted in data breach cases, moreover, there is no actual injury requirement in BIPA itself, per the Illinois Supreme Court’s Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186 (2019) ruling that we analyzed here.
Prior to Bryant, BIPA plaintiffs seeking to keep cases in Illinois state court had often successfully defeated removal by alleging that the plaintiffs were fully aware that their biometric data was being collected (such as when employees scanned their fingerprints to clock into work) and suffered no additional injury like disclosure of the biometric data to a third party. Bryant now makes it easier for defendants to remove in precisely those circumstances.
The development of this issue will be important to watch. Last year, the Ninth Circuit in Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019), concluded that the plaintiffs did have standing to pursue their claims under Section 15(a) and Section 15(b). In 2017, the Second Circuit in Santana v. Take-Two Interactive Software, Inc., 717 F. App’x 12 (2d Cir. 2017), held that the plaintiffs lacked Article III standing to assert either Section 15(a) or Section 15(b) claims because they had alleged procedural violations only.
Beyond BIPA actions, Bryant injects even greater uncertainty into the already uncertain field of standing for privacy and data breach actions. By focusing largely on the analysis in Spokeo’s concurrence by Justice Thomas, rather than the majority decision, the Seventh Circuit raises the question of when and how the distinction between public and private rights should affect the standing analysis in addition to the roles of tradition and legislative judgment.