Seventh Circuit Joins Ninth Circuit in Allowing Privacy Suit to Proceed Without Showing of Tangible Harm

Earlier this month, the Seventh Circuit issued its decision in Bryant v. Compass Group USA, Inc., holding that certain procedural violations of the Illinois Biometric Information Privacy Act (BIPA) are sufficient to establish Article III standing.  The Seventh Circuit’s decision further entrenches an existing circuit split between the Second and Ninth Circuits on whether procedural violations of BIPA may satisfy standing in federal court.  The decision will likely make it easier to bring BIPA suits—and other privacy-based claims—in federal court and may ultimately trigger a fight at the Supreme Court.

In Bryant, a group of call center employees brought a class action suit against Compass Group, a vending machine manufacturer.  At the instruction of their employer, the employees created accounts through which they purchased items from the vending machines by scanning their fingerprints.  The employees sued Compass Group under BIPA, an Illinois law that requires entities collecting “biometric identifiers” to, inter alia, (1) create a publicly available “retention schedule and guidelines for permanently destroying” biometric information, (2) provide written disclosures relating to the collection of the biometric information, and (3) obtain “a written release” from the data subject prior to collection.

Compass Group removed the action to federal court, and the employees moved to remand for lack of jurisdiction on Article III standing grounds.  In order to bring a claim in federal court, Article III requires a showing of a concrete and particularized injury in fact.  The employees—who did not premise their standing argument on any tangible harm, such as monetary loss—argued that the case belonged in state court.  The employees contended that their theory of standing was premised on a “bare procedural violation,” which the Supreme Court in Spokeo v. Robins explained was insufficient to confer standing in federal courts.  The Seventh Circuit disagreed.

The Seventh Circuit found that some of the plaintiffs’ BIPA claims were sufficient to establish Article III standing.  The court applied the analysis employed by Justice Thomas’s concurring opinion in Spokeo, which distinguished between suits seeking vindication of (1) individual rights, such as trespass claims (generally sufficient for standing), and (2) “public” rights, such as nuisance claims (generally insufficient for standing).  The Seventh Circuit found that the allegations that Compass Group failed to provide written disclosures and obtain written releases for collecting fingerprints fell into the former category.  It found that the lead plaintiff “was asserting a violation of her own rights—her fingerprints, her private information” by alleging that Compass Group failed to provide her with information deemed necessary by the Illinois legislature to facilitate informed consent.  This allegation, the court found, was in line with private claims like trespass and thus “enough to show injury-in-fact without further tangible consequences.”

The Seventh Circuit alternatively found that the plaintiffs’ claims satisfied Article III standing because they constituted an “informational injury.”  In some cases, the Supreme Court has held that plaintiffs may adequately plead injury in fact where (1) a statute requires disclosure of certain information, and (2) an alleged nondisclosure results in the kind of injury the statute sought to address.  In Bryant, the court held that the plaintiffs were denied information required by the statute—i.e., mandated disclosures relating to the fact of collection, how the information will be used, how long it will be retained, etc.—which impaired their ability to consent to collection, the type of harm BIPA sought to remedy.  Accordingly, the Seventh Circuit found that standing was independently justified as an “informational injury.”

Finally, the Seventh Circuit found that plaintiffs’ BIPA claims based on the alleged failure of Compass Group to provide a “publicly available” “data retention schedule and guidelines for permanently destroying collected biometric identifiers and information” were insufficient to establish Article III standing.  The Seventh Circuit found that, unlike the disclosures owed to individuals from whom data is being collected, these disclosures were “owed to the public generally” and thus did not constitute the “particularized harm” required to establish injury-in-fact.

Moving forward, Bryant could have profound impacts on the potential for liability under BIPA and other privacy-related claims.  Article III standing is a crucial mechanism for defendants to resolve cases where plaintiffs have not alleged any tangible harm at the motion to dismiss stage.  The Seventh Circuit’s holding that certain BIPA violations—without more—are sufficient to establish standing means that future privacy cases may be more likely to survive a motion to dismiss and move into the costly discovery phase of litigation. 

In reality, this situation makes it much more likely that parties will settle to avoid years of protracted litigation.  Indeed, the only amicus activity in the case came from a class action plaintiff in a separate BIPA lawsuit, indicating that the Seventh Circuit’s opinion will be used as a cudgel by plaintiffs in future privacy cases.  And because Bryant follows a similar holding from the Ninth Circuit last year, this lenient Article III standing regime now carries the day in two circuits that collectively cover more than a quarter of the United States.

However, the Seventh Circuit’s opinion may not be the last we hear of Bryant.  Last week, Compass Group filed a petition for rehearing en banc with the court.  If the petition is granted, the full court will take another stab at the issues.  And regardless of whether the Seventh Circuit hears the case en banc, either party could petition the Supreme Court for review.  To be sure, the Supreme Court has been reluctant to address Article III standing cases.  Earlier this year, for example, the Court declined to hear another standing case related to BIPA, and last year it denied a petition for review of an Article III standing question related to an alleged cybersecurity vulnerability that did not result in any harm.[1]  But the Seventh Circuit further entrenches an existing circuit split on the sufficiency of BIPA claims to satisfy federal courts’ standing requirements—increasing the odds (but by no means guaranteeing) that the Supreme Court will hear the case. 

In the meantime, companies should carefully review their privacy practices, including those dealing with the collection of biometric information, and ensure that they are ready to defend those practices from judicial scrutiny in the event of a privacy lawsuit

[1] Wiley authored an amicus brief in the latter case, FCA US LLC v. Flynn.