Seventh Circuit Says Employers Can Be Sued in Federal Court for BIPA Violations

By William Pokorny and Caroline Kane - Franczek P.C.

May 19, 2020

In what some are calling a “bombshell” decision, the 7th Circuit Court of Appeals recently held in Bryant v. Compass Group USA, Inc. that federal courts can now hear cases involving alleged violations of the Illinois Biometric Information Privacy Act (“BIPA”) even where there is no allegation of actual harm to the plaintiff beyond a technical violation of the law. This is potentially significant because it may allow some defendants to remove BIPA cases from state court to federal court, which applies somewhat more stringent rules for certifying class action lawsuits and is often seen as a more favorable forum for defendant businesses than Illinois state courts.

Background on BIPA

BIPA is an expansive state law that applies to businesses that collect or obtain biometric information such as retina scans, fingerprints, voiceprints or scans of the hand or face.  BIPA regulates how these private entities collect, use, share, and retain biometric information and imposes certain security requirements. It generally requires private entities to maintain a publicly available retention and destruction policy and obtain a written release from employees prior to obtaining biometric information.  The law also requires private entities to maintain confidentiality and restricts disclosure of biometric information. Any “aggrieved” person may bring a private action and recover $1,000 for each violation or actual damages (whichever is higher) for negligent violations. If an aggrieved person can show that there was an intentional or reckless violation, they may recover $5,000 for each violation or actual damages (whichever is greater).  BIPA plaintiffs may also recover reasonable attorney’s fees and costs, often resulting in significant payouts.

Seventh Circuit Decision Allowing BIPA Litigants In Federal Court

The crux of the case before the 7th Circuit was whether the plaintiff’s injury based on a procedural violation was sufficient to give the plaintiff “standing” to sue in federal court. State and federal courts generally require that a party pursuing a claim in court have standing – that is, some interest in the case. Usually this requirement is satisfied by showing that the plaintiff is seeking a remedy for some legal harm. In Illinois state courts, defendants in BIPA lawsuits initially sought to have those lawsuits thrown out by arguing that plaintiffs had to show that they suffered some sort of personal harm, like losses from identity theft, as a result of the alleged BIPA violations. The Illinois Supreme Court rejected that reasoning in a landmark 2019 decision, Rosenbach v. Six Flags, holding that a business’s technical violation of BIPA with respect to an individual’s biometric information was enough to give them standing in state court.

While the issue of standing was resolved in plaintiffs’ favor in Illinois state courts, it remained an open issue in federal courts, where standing is governed by federal law. Some federal decisions suggested that technical violations of a statute would not create standing. However, the 7th Circuit has now rejected that view, opening the door to BIPA litigation in federal courts.

Plaintiff, Ms. Christine Bryant, filed suit against Compass Group USA Inc. in Illinois state court, alleging that the company, which operated vending machines at Ms. Bryant’s work, failed to provide her notice or obtain her consent before collecting her biometric information. She further alleged that Compass Group did not publish a retention schedule or guidelines for destroying biometric information as required under BIPA.  Defendant removed the case to federal court.  The plaintiff-employee tried to get the case back in state court, and, in a reversal of the usual roles, claimed that the federal district court could not hear the case because she lacked a “concrete injury-in-fact” that would give her standing to sue in federal court.  The lower court agreed, finding that the alleged BIPA violations were bare procedural violations that caused no concrete harm, and remanded action to state court.  The 7th Circuit, tasked with determining whether the alleged BIPA violations would suffice under federal standards, found that there was a concrete injury because Compass Group withheld substantive information and deprived the plaintiff of the ability to weigh her options and give informed consent.  According to the 7th Circuit, this satisfied the injury-in-fact requirement to allow BIPA cases in federal court.  

The impact of this decision on businesses operating in Illinois will be limited. Nothing in the court’s decision changes the substantive requirements of BIPA or outright prevents an employee or other individual from bringing BIPA claims. However, the ruling may afford an important tactical advantage to businesses facing significant liability from BIPA lawsuits by allowing them to move the litigation from state court to the somewhat more favorable forum offered by federal courts.