Update: Recent BIPA Cases And “Standing” To Sue In Federal Court
By Brian J. Riordan, Mindy M. Medley and Alexander J. Brinson
Clausen Miller’s Technology & Cyber Group provides the following update to keep you informed on recent important cases adjudicating Illinois’ Biometric Information Privacy Act (“BIPA”). BIPA regulates the collection, use, safeguarding, handling, storage, retention, and destruction of individuals’ biometric information, such as fingerprints.
To bring BIPA claims in federal court, plaintiffs must establish “standing,” or the right to bring their claims given plaintiffs’ alleged damages (or lack thereof). Four recent decisions have analyzed the issue of standing with respect to claims under BIPA: Miller, Patel, Bryant, and Fox.
In Miller v. Southwest Airlines Co., 926 F.3d 898, 901 (7th Cir. 2019), the Seventh Circuit analyzed two class actions by unionized airline employees who were required to clock in and out of their shifts by scanning their fingerprints. Despite the absence of financial harm to these employees, the Seventh Circuit held that they had standing to sue. Specifically, the Court held that the “prospect of a material change in the workers’ terms and conditions of employment gives these suits a concrete dimension” sufficient to establish standing. The Court, however, ended up dismissing these claims as preempted by the Railway Labor Act governing bargaining between unions and management.
In Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019), plaintiffs sued Facebook and alleged BIPA violations stemming from Facebook’s “Tag Suggestions” feature, which uses facial-recognition technology to identify users. The Ninth Circuit held that the users’ alleged injuries were sufficiently concrete and particularized to establish standing to sue.
In Bryant v. Compass Grp. USA, Inc., 958 F.3d 617 (7th Cir. 2020), the Seventh Circuit examined a BIPA lawsuit filed by a vending-machine customer who set up payment links with her fingerprints. Consistent with the above rulings, the Court held that the customer had Article III standing to bring a claim alleging her lack of consent. The Court reasoned that those allegations involved “an invasion of her private domain, much like an act of trespass would be.” However, the Court held that the customer did not have standing to allege BIPA violations involving the alleged failure to publicly disclose data-retention and destruction protocols. Because those claims did not allege a particularized injury to the customer, the Court found that she lacked standing to assert them.
Most recently, in Fox v. Dakkota Integrated Systems, the Seventh Circuit went further than Bryant, and found standing to assert claims alleging violations of BIPA disclosure requirements. Unlike the Bryant plaintiff, the Fox plaintiff alleged more than a mere failure to publicly disclose a data-retention policy. Rather, the Fox plaintiff alleged an unlawful retention of her biometric data, which allegedly caused her to suffer particularized injury. As the Court held, “an unlawful retention of a person’s biometric data is as concrete and particularized an injury as an unlawful collection of a person’s biometric data.”
Learning Point: BIPA jurisprudence continues to develop, but there is a clear theme. Courts appear increasingly willing to permit plaintiffs to file BIPA claims in federal court, and to find standing for those claims, as long as plaintiffs craft allegations that BIPA violations caused personal and particularized harm. The inevitable result, as we are seeing already, is intensified BIPA litigation in federal court. That said, defendants still have substantial grounds on which to seek dismissal of these claims, on multiple grounds including standing, and Clausen Miller’s Technology & Cyber Group sees strong opportunities to defend these cases despite the increasingly challenging jurisprudential landscape.