Law360 | May 6, 2020 | Celeste Bolt
The Seventh Circuit significantly changed the landscape of biometric privacy litigation Tuesday when it held that federal courts can hear claims over whether defendants violated Illinois’ landmark biometric law by collecting such data without informed consent.
Its ruling answered a question that had loomed large over the booming crop of Illinois Biometric Information Privacy Act lawsuits — and come out differently than many federal district courts that have booted BIPA suits as alleging mere procedural violations without harm.
Attorneys from both the plaintiff and defense bars say they’re relieved to have an answer to a standing fight that forced them into what Chief Judge Diane Wood referred to as a “role reversal,” with companies accused of violating the law arguing federal standing existed when plaintiffs said otherwise.
The “bombshell” decision could even prompt input from the nation’s top court as the Seventh Circuit’s ruling deepens a circuit split on the issue, said John M. Fitzgerald, a Chicago-based partner at Tabet DiVitto & Rothstein LLC and author of a recently published book on BIPA.
A panel of the appellate court held Tuesday that former Compass Group USA Inc. employee Christine Bryant alleged more than a mere procedural violation when she claimed the company failed to disclose its intentions before collecting her biometric information through a vending machine at work.
Compass’ alleged failure to disclose deprived Bryant of substantive information that she was legally entitled to, and prevented her from giving Compass the type of informed consent BIPA requires, which is a concrete and particularized injury that establishes standing, the panel said.
That finding is in line with the Ninth Circuit’s similar ruling in Patel v. Facebook Inc, in which it found Facebook’s alleged BIPA violations constituted an injury-in-fact, but marks a departure from the Second Circuit’s conclusion in Santana v. Take-Two interactive Software Inc, in which the court held that plaintiffs lacked Article III standing without alleging private data could be disseminated or misused.
“If I was Ms. Bryant, I’d file a certiorari petition on this issue,” Fitzgerald told Law360. “It affects a very large number of lawsuits all across the country, and we hav ea clear circuit split of Article III standing.”
Much-Needed Clarity
The Bryant ruling makes BIPA standing requirements for federal court consistent with those for Illinois state court, and the Seventh Circuit’s reasoning is sound give that the BIPA law is somewhat unorthodox, said Todd Rowe, a partner at Tressler LLP.
“Fundamentally, because this statute is so unique, [that is] why we’re seeing this struggle,” Rowe said. “ultimately, I think the Seventh Circuit had to go there.”
Most privacy laws require some sort of breach, or real-world harm, and BIPA is unique to the extent you don’t need that breach, Rowe said.
The Illinois Supreme Court in 2019 determined that a mere violation of the state’s biometric privacy law is enough to confer standing without proof of actual harm in Rosenbach v. Six Flags.
“The failure to give notifications is the damages. The damages are almost built in,” he said. “State courts had it right from the start.”
Through the ruling may seem like more of a victory for defense attorneys who would prefer to litigate these cases in federal court, it also comes as a relief to plaintiffs’ attorneys like Lynch Carpenter LLP partner Katrina Carroll, who has feared the suits could go on for months in one forum only to have a judge decide it’s not the right court to hear the case.
“We’re thrilled we have clarity now and know where we can proceed with these cases,” she told Law360. “Federal court is the place to be, and we’re comfortable litigating there.”
Before the Seventh Circuit weighed in, plaintiffs were finding themselves in a “very precarious situation,” Caroll said.
“As [a plaintiff], I’m not going to stand up in front of a federal court and argue that I don’t have the standing to be there,” she said.
Fitzgerald agreed that it feels “counterintuitive” to describe Tuesday’s ruling as a win for the defense bar, even though they’re been in a position where they must argue their opponents’ claims have standing to stay in or move to federal court.
“it’s interesting that this victory for the defense bar occurs in the context of a court saying that violations fo BIPA do create injuries-in-fact that are sufficiently concrete to create Article III standing,” Fitzgerald said.
A ‘Strategic Option’ for Defense Attorneys
To Benesch Friedlander Coplan & Aronoff LLP defense attorney Mark Eisen, the Bryant decision was somewhat unexpected, given that district courts have by and large found similar claims lacked Article III standing and, based on prior Seventh Circuit authority, related to the collection of personal information.
“This decision did not really make an effort to separate those decisions from the district courts or the decision from the Second Circuit with any significant analysis, maybe because the Seventh Circuit views biometrics being treated somewhat differently,” Wisen said.
As a practical matter, plaintiffs in BIPA cases aren’t alleging something wrong was done, he said.
“They’re saying, ‘I knew what I was doing, but you should have given me certain information before I did that,” Eisen said. “To find that was enough under [Spokeo Inc. v. Robins], I think is fairly unexpected. But we’ll take it.”
The decision subjects BIPA cases— which are often brought on behalf of a putative class — to a more stringent analysis under Federal Rule of Civil Procedure 23, which governs class actions, and brings a strategic option to the table that many plaintiffs’ lawyers may have been looking to avoid, he said.
For example, the Seventh Circuit has taken a more defense-friendly view of union issues in the BIPA context, where some state authority hasn’t, Eisen said.
“It seems to be one of those relatively rare circumstances where the defense is certainly benefiting from the Seventh Circuit’s guidance on this, which has not always been defense-friendly,” he said.
Duty to Public Vs. Individuals
While the Seventh Circuit found Bryant’s proposed class claim under Section 15(b) of BIPA — which requires, among other things, a written release before biometric information is collected — shouldn’t have been sent back to state court, it found she lacked standing to pursue her claims under Section 15 (b) of the statute, which requires a publicly available data public retention schedule and guidelines for permanently destroying biometric information.
The court held Compass’ duty under that section of the statue is to the public generally, not the specific individuals whose biometric information it collects, and Bryant alleged no particularized harm for the violation of that aspect of BIPA, the panel said.
But it was a distinction Fitzgerald found surprising, given the purpose of the laws as a whole, he said.
“15(b) and 15(b) were generally intended to protect the same rights. It’s certainly a surprising element of the ruling,” he said.
Rowe, however, said it makes sense given that the opinion was largely driven by the need to get Bryant’s consent or the opportunity to consent.
Carroll agreed, saying the court concluded that if Bryant had all the relevant information, she might have chosen to buy snacks from Compass’ biometric vending machines.
“That to me is what swayed them… as opposed to the general injury to the public at large,” she said.
And while the distinction does raise the question of whether to pursue an alleged Section 15(a) violation separately in Illinois state court, where a crafty plaintiff could attempt to make a “removal proof” claim, it’s not something Carroll said she would explore.
“If there’s now a recognition that the injuries under 15(b) are concrete and particularized… and plaintiffs can seek redress for them, that’s what we’re more interested in,” she said.