Skip to Content
In Bryant v. Compass Grp. USA, Inc.,[1] plaintiff Christine Bryant provided her fingerprint data to Compass Group USA in order to use vending machines in the workplace. Section 15(b) of BIPA provides that a person must knowingly provide consent for a party to collect and use biometric identifiers and information[2]. The Seventh Circuit held that plaintiff’s informed consent claim alleged more than a mere procedural violation against the defendant, who allegedly collected and distributed plaintiff’s biometric information in violation of Section 15(b). The Seventh Circuit explained that the defendant’s deprivation of plaintiff’s ability to choose whether or not to consent to this use of her biometric information constituted a “particularized and concrete injury-in-fact” that was sufficient to confer Article III standing for the Section 15(b) claim. The Seventh Circuit maintained, however, that the plaintiff did not have Article III standing to pursue her claim under Section 15(a),[3] which requires a private entity to develop a written policy concerning the retention and destruction of biometric data and identifiers.
In its recent June 30th clarification, the Seventh Circuit acknowledged that plaintiff’s Section 15(a) claim “is a separate matter” because plaintiff only alleged a violation of that section’s written policy requirement. The Seventh Circuit explained that its earlier opinion was limited to the specific Section 15(a) claim advanced by plaintiff.[4] It appears that the Seventh Circuit’s analysis may not apply to claims requiring compliance with retention schedules or guidelines. Indeed, the Seventh Circuit’s clarification confirms that its opinion is limited in scope.
Notably, Bryant did not reach as far as Patel v. Facebook,[5] a case in which the Ninth Circuit concluded that Article III standing existed for Sections 15(a) as well as 15(b) claims. In Patel, plaintiffs posted images of themselves to Facebook, which were then used to create user face templates. These templates allow Facebook to suggest "tagging" individuals in photos when photographs are posted that include a matching template image, thereby providing an opportunity for Facebook users to freely and publicly display others without permission. However, Facebook failed to obtain the written consent required by Section 15(b) and also failed to develop the written policy required by Section 15(a). The Ninth Circuit explained that BIPA protects “plaintiffs' concrete privacy interests” and that the Sections 15(a) and (b) violations “actually harm or pose a material risk of harm to those privacy interests. . . .” Accordingly, the Patel court concluded that “plaintiffs have alleged a concrete and particularized harm, sufficient to confer Article III standing.” As of the time of this article, California U.S. District Judge James Donato is evaluating a potential $650 million settlement of this case after having rejected an earlier proposed $550 million settlement.
Another case of interest is Figueroa v. Kronos Inc. in which plaintiffs alleged violations of both Sections 15(a) and (b).[6] The Northern District of Illinois concluded that plaintiffs did, in fact, have standing to pursue the Section 15(b) claim given that the defendant allegedly obtained biometric data without consent. Plaintiffs were injured, the court explained, because they were denied the opportunity to withhold their consent, which constituted a sufficiently concrete injury to confer standing. However, the court was unable to ascertain whether plaintiffs had standing to proceed with their Section 15(a) claim because it was unclear whether plaintiffs suffered a sufficient injury as a result of defendant’s failure to develop and publish a biometric data policy. The Bryant opinion partially answers a question left unresolved by Figueroa when it comes to Section 15(a) claims.
Although the court’s ruling in Bryant undoubtedly carves a more defined path for BIPA claims in the Seventh Circuit, the defendant Compass fired back with warnings about what it believes to be a dangerous new federal landscape and requested a rehearing. Compass points, first, to the fact that Bryant has caused a circuit spit between the Seventh and Ninth Circuit, given the ruling in Patel, thereby creating an uneven jurisdictional playing field. Compass further argued that the Seventh Circuit misinterpreted the relationship between and combined function of Sections 15(a) and (b) of BIPA. According to Compass, a violation of Section 15(a), which limits the length of time a private entity may retain an individual's data, results in the same purported injury-in-fact for Article III standing purposes as a violation of Section 15(b)’s requirement that parties consent to the collection of their biometric information. This, defendant maintains, is because both sections convey private - and not public - rights. However, the Seventh Circuit has denied Compass’ petition for rehearing and rehearing en banc.
At least for now, the Bryant opinion represents the final word on Article III standing in the Seventh Circuit, although litigants will no doubt continue to argue over the full scope and meaning of that opinion. When compared to, Patel, the Bryant opinion underscores the importance of jurisdiction in BIPA cases and will encourage forum shopping when possible. It is absolutely critical that any party litigating a BIPA claim understand the scope and nuances of Article III jurisprudence when evaluating jurisdiction in these cases.
[1] 2020 U.S. App. LEXIS 14256 (7th Cir. May 5, 2020).
[2] 740 ILCS 14/15(b).
[3] 740 ILCS 14/15(a).
[4] 2020 U.S. App. LEXIS 20468 (7th Cir. June 30, 2020).
[5] Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019).
[6] 2020 U.S. Dist. LEXIS 64131 (N.D. Ill. 2020). Plaintiffs also alleged a violation of Section 15(d), which requires consent before a private entity can disclose or disseminate biometric data.