BIPA in Review: Recapping the Seventh Circuit’s Article III Standing Decisions

Last Thursday, the Seventh Circuit issued its fourth opinion in two years addressing Article III standing in the context of Illinois’s Biometric Information Privacy Act (BIPA). The court handed the plaintiff in Thornley v. Clearview AI, Inc. a “win,” concluding she lacked Article III standing to pursue her BIPA claims in federal court and, therefore, affirming the district court’s decision to grant her motion to remand the case back to state court. Given the recurring nature of the topic, the evolving standards and strategies at issue in BIPA cases, and the potentially broader implications in consumer protection litigation in the circuit, a brief recap is in order.

Background

Adopted in 2008, BIPA regulates “the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information” (i.e., fingerprints, iris scans, voiceprints). BIPA prohibits private parties both from collecting biometric identifiers and generating individual “profile” information derived from biometric identifiers without first notifying the individuals whose information is being collected, obtaining their consent, and making specific disclosures to them. The statute also requires private parties to publish detailed information regarding their data-retention and -destruction policies, and it prohibits them from selling biometric identifiers collected.

About two years ago, the Illinois Supreme Court issued a critical ruling in Rosenbach v. Six Flags Entm’t Corp. In Rosenbach, the court held that a plaintiff who alleges a technical violation of BIPA’s requirements, without otherwise alleging actual injury or harm, constitutes an “aggrieved person” authorized to bring a private right of action under the statute. The Illinois Supreme Court concluded that a statutory violation that “constitutes an invasion, impairment, or denial of the statutory rights” of the person whose biometric information is collected is “sufficient to support the individual’s or customer’s statutory cause of action.”

Two other states, Texas and Washington, have since enacted their own biometric privacy laws, albeit without statutory private rights of action available to consumers. And the New York legislature introduced Assembly Bill 27, a biometric privacy law modeled on Illinois’s BIPA that would include a private right of action if enacted and generate the potential for a significant amount of new litigation.

Recent Seventh Circuit Decisions

A rash of novel BIPA class actions filed in state court followed the Rosenbach decision, typically arising from an employer’s use of finger- and hand-scan time clocks or a business’s use of similar point-of-sale technology, which defendants began removing to federal court. Several of those actions have percolated up to the Seventh Circuit to address questions of Article III standing and federal subject matter jurisdiction. The bullets below summarize the four resulting decisions from the Seventh Circuit:

• Miller v. Southwest Airlines Co., 926 F.3d 898 (7th Cir. 2019): Unionized airline workers were required to scan their fingerprints when clocking in and out of work each day. The employees alleged that the defendant employer failed to comply with Section 15(a) and 15(b) of BIPA by failing to publish its data-retention protocols and obtain employees’ consent to the collection of their biometric identifiers.

  The Seventh Circuit held that, because the plaintiffs in question were all unionized employees, they had alleged an Article III injury, as the BIPA violations created a prospect of a material change in the workers’ terms and conditions of employment. According to the court, this gave the suit “a concrete dimension” that was more than a “bare procedural dispute.” Nevertheless, the Seventh Circuit ruled that the claims were preempted by the Railway Labor Act, as they addressed topics that were the subject of collective bargaining between the union and the defendant employer. The decision obviously placed significant weight on the case’s origin in a unionized employment setting.
  
  

• Bryant v. Compass Grp. USA, Inc., 958 F.3d 617 (7th Cir. 2020): We covered this decision here shortly after its publication. The plaintiff’s employer installed vending machines that relied on fingerprint identification technology to execute purchases. The plaintiff alleged the defendant employer violated Section 15(a) of BIPA by failing to publicly publish its data retention and destruction policies, and Section 15(b) by failing to make the statutorily required disclosures or obtain her consent to the collection of biometric identifiers.

  The Seventh Circuit held that the plaintiff’s complaint articulated an Article III injury with respect to her Section 15(b) claim, reasoning that the defendant’s collection of the plaintiff’s biometric identifiers without complying with BIPA’s statutory disclosure and consent requirements invaded the plaintiff’s “private domain” and denied her the informational rights that the Illinois legislature intended to afford citizens. With respect to the plaintiff’s Section 15(a) claim, however, the Seventh Circuit held that the defendant’s mere failure to publish its data retention and destruction policies violated a duty “owed to the public generally,” and it concluded that the plaintiff’s failure to plead any particularized harm arising out of that violation deprived the federal courts of subject matter jurisdiction.

  Yet, as emphasized in the court’s order denying en banc review, the holding regarding Section 15(a) was limited to the plaintiff’s specific allegations, which lacked any discussion of a concrete harm arising out of a failure to follow the statutory publication requirements. The Seventh Circuit expressly reserved judgment on the question of whether a defendant’s failure to comply with Section 15(a)’s data retention and destruction requirements (as opposed to merely failing to publish its policies) could give rise to a cognizable Article III injury under a different set of allegations.
  
  

• Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146 (7th Cir. 2020): Here again, the plaintiff’s employer used an electronic timekeeping system that required employees to scan their hands to clock in and out of work. Unlike in Bryant, the plaintiff in this case alleged that the defendant employer not only violated Section 15(a)’s publication requirements but also that it violated that section’s data-retention and -destruction provisions. In other words, the defendant was alleged to have not only failed to publish its data-retention schedule and -destruction policies but that it retained biometric identifiers beyond the time period permitted by statute and illegally disclosed them to a third party.

  As a result, the Seventh Circuit held that these allegations sufficiently stated a concrete and personalized injury that sufficed to give rise to an Article III injury supporting federal subject matter jurisdiction. The court concluded that “unlawful retention of biometric data inflicts a privacy injury” that is concrete and particularized, and it reversed the district court’s order remanding the case to state court.
  
  

• Thornley v. Clearview AI, Inc., No. 20-3249, — F.3d –, 2021 WL 128170 (7th Cir. Jan. 14, 2021): The defendant in Thornley collected the plaintiff’s biometric identifiers from photographs and metadata obtained through social media websites (e.g., Facebook, Venmo, and YouTube), which it then compiled in databases made available to third parties for a fee. The plaintiff filed suit, alleging that the defendant’s conduct violated Section 15(c) of BIPA, which prohibits private entities from selling, leasing, trading, or otherwise profiting from another person’s biometric identifiers.

The Seventh Circuit, giving substantial weight to the class definition plead in the complaint—which was expressly limited to individuals who had sustained “no injury” from the alleged Section 15(c) violation—concluded that the plaintiff had not sustained an Article III injury as a result of the defendant’s sale of her biometric identifiers. Drawing on constitutional decisions interpreting the federal legislature’s powers under Commerce Clause and the limitations imposed by the First Amendment, the court reasoned that Section 15(c) was designed to eliminate the market for biometric identifiers (by making the supply of such identifiers illegal). From there, the court analogized Section 15(c) to Section 15(a)’s prohibition on the collection of biometric identifiers without publishing data-retention and -destruction policies and (like Bryant) held that a violation of this section breached a duty owed to the public writ large, not the individual plaintiff (at least absent some affirmative allegation of particularized injury). As a result, the Seventh Circuit affirmed the district court’s order remanding the case to state court.

Takeaways

As highlighted by Judge Hamilton’s concurring opinion in Thornley, it is somewhat difficult to distill the Seventh Circuit’s recent BIPA decisions into a clear rule governing Article III standing in cases regarding alleged intangible harms arising from purported violations of consumer protection statutes. The decisions discussed above turn not only on the specific facts of each case but on technical interpretations of BIPA’s various provisions, and the results can appear to be almost counterintuitive. For example, federal courts in the Seventh Circuit have subject matter jurisdiction to hear claims that a plaintiff’s biometric identifiers were collected or retained without the disclosures or consent required by Section 15(b) (Bryant and Fox), although the courts cannot hear a claim that the same plaintiff’s biometric identifiers were sold to a third party in violation of Section 15(c) (Thornley).

The apparent incongruities are not limited to BIPA itself, as Judge Hamilton stressed in discussing the Seventh Circuit’s recent decisions rejecting Article III standing in cases alleging informational injuries under the Fair Debt Collection Practices Act (covered separately here). Post-Spokeo (the Supreme Court’s most recent high-profile ruling on the interplay between Article III and alleged violations of consumer protection statutes), the issue of how to handle Article III standing in cases involving consumer protection statutes remains hotly contested, and it may attract the Supreme Court’s attention again in the not-too-distant future.

At a more macro level, the Seventh Circuit’s recent standing decisions, and the lack of practical clarity one can pull from them, is indicative of just how underdeveloped the BIPA legal landscape remains and how many legal questions can be expected to continue surfacing in future litigation. Among such questions remain the applicable statute of limitations and what degree of actual harm a plaintiff must show to have a valid claim creating liability on the merits (as opposed to what a plaintiff must merely plead at the outset to avoid preemptive dismissal). Given that we can expect BIPA litigation to retain a “Wild West” character for years to come, the best practical advice available to any employer or business leveraging technology to identify employees or facilitate customer transactions remains to engage counsel to explore proactive risk management strategies, rather than ending up on the reactive side of allegations of BIPA violations.