The U.S. Court of Appeals for the Seventh Circuit recently reversed a trial court's order remanding a plaintiff's claims under the Illinois Biometric Information Privacy Act (BIPA) back to state court for lack of subject-matter jurisdiction because she lacked standing under Article III.
In so ruling, the Seventh Circuit concluded that the plaintiff's claims that a vending machine operator's collection and retention of her fingerprints without obtaining written release or proper written disclosure in violation of section 15(b) of BIPA established an invasion of personal rights both concrete and particularized to establish a concrete injury-in-fact necessary to confer standing under Article III.
However, because the plaintiff's claims under section 15(a) for failure to provide a retention schedule and guidelines for permanently destroying the stored biometric information constituted a duty owed to the public generally, no particularized harm resulted to establish standing for this claim under Article III.
A copy of the opinion is available at: Link to Opinion
A call center employee ("Consumer") utilized a vending machine at her place of employment that did not accept cash, instead requiring users to establish an account to accept payment using fingerprints. Fingerprints are "biometric identifiers" under the Illinois Biometric Information Privacy Act, 740 ILCS 14 (BIPA), which requires collectors of this material to obtain the written informed consent of any person whose data is acquired.
The Consumer filed a putative class action complaint in state court against the owner and operator of the vending machines ("Vendor") alleging violations of section 15(a) of the BIPA for never making a retention schedule and guidelines for permanently destroying the biometric identifiers and stored information publicly available, and; section 15(b) of the BIPA for never informing Plaintiff in writing that her biometric identifier (fingerprint) was being collected or stored, the specific purpose and length of term for which it was being collected, stored, and used, or obtaining a written release to collect, store, and use her fingerprint.
Although the Consumer did not assert that she did not know that her fingerprint was being collected and stored, as she voluntarily created an account and regularly used the vending machines, she alleged that failure to make the requisite disclosures denied her the ability to give informed written consent as required by section 15(b) and resulted in the loss of the right for her, and others similarly situated, to control their biometric identifiers and information.
The Vendor removed the action to federal court under the Class Action Fairness Act (CAFA), 28 U.S.C. § 1332(d), on the basis of diversity of citizenship and an amount in controversy exceeding $5 million. The Consumer moved to remand the action back to state court on the basis that the trial court did not have subject-matter jurisdiction because she lacked the concrete injury-in-fact necessary to satisfy the federal requirement for Article III standing, but not required under Illinois state law. Rosenbach v. Six Flags Entm't Corp., 432 Ill. Dec. 654 (Ill. 2019).
The trial court found that Vendor's alleged violations of sections 15(a) and (b) of the BIPA were bare procedural violations that caused the Consumer no concrete harm, and remanded the action to the state court for lack of standing. The Vendor's petition to appeal the remand order was accepted by the Seventh Circuit and the instant appeal ensued.
In a role reversal from arguments typically seen in such statutory violation cases, the Vendor assumed the burden of establishing the Consumer's Article III standing as the party invoking federal jurisdiction.
As you may recall, to confer federal standing under Article III, a plaintiff must satisfy three requirements: (1) she must have suffered an actual or imminent, concrete and particularized injury-in-fact; (2) there must be a causal connection between her injury and the conduct complained of; and (3) there must be a likelihood that this injury will be redressed by a favorable decision. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992).
Here, only the first element was at issue on appeal. As the Supreme Court explained in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), a "concrete" injury must actually exist but need not be tangible. Spokeo at 1548-49. While a legislature may "elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law," "a bare procedural violation, divorced from any concrete harm," does not "satisfy the injury-in-fact requirement of Article III." Id.
The Vendor argued that the BIPA elevated a person's inherent right to control their body, including associated biometric identifiers and information, and that a violation or trespass upon this right is a concrete injury-in-fact for standing persons. Although the Illinois Supreme Court did not consider federal Article III standing requirements, the Vendor argued that its analysis and holding in Rosenbach – that section 15(b) of BIPA confers a right to receive certain information from an entity that collects, stores, or uses a person's biometric information, and the violation of that right is a "real and significant" injury – also constitutes a "concrete" injury to confer federal standing under Article III here. Rosenbach, 432 Ill. Dec. at 663.
Considering the Consumer's Article III standing under BIPA as a question of first impression, the Seventh Circuit looked to Spokeo, where the Supreme Court of the United States examined Article III standing for claims raised under the federal Fair Credit Reporting Act. Although the SCOTUS in Spokeo did not rule one way or the other on the plaintiff's standing, instead finding that the Ninth Circuit used the wrong test for injury-in-fact and remanding for application for the proper test (Spokeo at 1548), Justice Thomas's concurrence drew a useful distinction between two types of injuries: the first arising when a private plaintiff asserts a violation of her own rights, and the second when a private plaintiff seeks to vindicate public rights. Spokeo at 1551-52.
Applying this rubric, the Seventh Circuit found that the Consumer's claims that the Vendor's failure to comply with section 15(b) violated her personal privacy and rights was sufficient to show injury-in-fact without further tangible consequences, and confer Article III standing.
Moreover, in analyzing the Consumer's section 15(b) claims as a type of "informational injury" — where information required by statute to be disclosed to the public is withheld — the Seventh Circuit reached the same result.
Because the Vendor's alleged failure to provide obligatory Section 15(b) disclosures "deprived [Consumer] of the ability to give the informed consent section 15(b) mandates" this deprivation was a concrete injury. See Bensman v. U.S. Forest Serv., 408 F.3d 945, 955–56 (7th Cir. 2005) (injury inflicted by nondisclosure is concrete if the plaintiff establishes that the withholding impaired her ability to use the information in a way the statute envisioned).
However, the Seventh Circuit reached a different conclusion as to the Consumer's claims under section 15(a), which obligates private entities that collect biometric information to make publicly available a data retention schedule and guidelines for permanently destroying collected biometric identifiers and information. Because this duty is owed to the public generally, the Seventh Circuit concluded that the Consumer suffered no concrete and particularized injury as a result of the violation, and therefore lacked standing under Article III to pursue her section 15(a) claim in federal court.
Accordingly, the Seventh Circuit reversed the judgment of the trial court remanding the action to state court, and remanded the case to federal trial court for the Consumer's claim under section 15(b) of BIPA to proceed consistent with its opinion.
Ralph T. Wutscher
Maurice Wutscher LLP
The Loop Center Building
105 W. Madison Street, 18th Floor
Chicago, Illinois 60602
Direct: (312) 551-9320
Fax: (312) 284-4751
Mobile: (312) 493-0874
Email: rwutscher@MauriceWutscher.com
Admitted to practice law in Illinois
Alabama | California | Florida | Georgia | Illinois | Massachusetts | New Jersey | New York | Ohio | Pennsylvania | Texas | Washington, DC
NOTICE: We do not send unsolicited emails. If you received this email in error, or if you wish to be removed from our update distribution list, please simply reply to this email and state your intention. Thank you.
Our updates and webinar presentations are available on the internet, in searchable format, at:
Financial Services Law Updates
and
The Consumer Financial Services Blog™
and
and
California Finance Law Developments
