The Seventh Circuit court in the U.S. has weighed in on Illinois’ Biometric Information Privacy Act (BIPA), and determined that the act of collecting and storing someone’s biometric information without proper consent is inherently harmful to that individual. The ruling defines the collection of biometric data as an “injury in fact,” which confers Article III standing and allows defendants to try BIPA cases in federal court instead of state court in Illinois.
The case at the heart of the decision is Bryant v. Compass Group USA, Inc. Compass operates biometric machines that force users to make purchases with a fingerprint scan instead of cash, which were installed in the cafeteria at the call center where the plaintiff worked. The plaintiff alleged that Compass violated BIPA because it stored her fingerprint without first obtaining written consent, and had in fact failed to inform her that her fingerprint would be stored at all. The company also failed to disclose how long biometric data would be stored, and what provisions were in place to destroy that information at the end of that term.
Despite ruling that Compass had caused injury in fact, the Seventh Circuit did not reward any damages to the plaintiff, and instead concluded that the company’s actions had not caused any particular harm to the individual. Rather, the Court reasoned that the harm was to the general public, and not to the individuals whose information is collected.
That is most likely why Compass tried to get the case moved to Federal Court, even going so far as to argue that their own actions were injury in fact. Though it seems counterintuitive, Federal Courts have stricter class certifications, so the Seventh Circuit decision could paradoxically make it more difficult for plaintiffs to prove concrete damages in BIPA lawsuits moving forward.
The ruling breaks from the conclusions of other Illinois district courts, which have remanded most BIPA cases to state courts that have lighter class standing requirements and have generally treated BIPA lawsuits more favorably.
It’s not yet clear how the Seventh Circuit’s decision will affect the BIPA lawsuits currently making their way through the legal system. Google, TikTok, and Clearview AI are only a handful of the companies that have been accused of BIPA violations. Facebook has already settled its own BIPA lawsuit for $550 million, although similar settlements could be less likely in the future if the new ruling proves to be better for employers.
May 12, 2020 – by Eric Weiss