In general, the Illinois Biometric Information Privacy Act (“BIPA”) seeks to regulate “the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” Under BIPA, biometric identifiers include “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” Among other things, BIPA requires a “private entity” (e.g., “any individual, partnership, corporation, limited liability company, association, or other group, however organized,” excluding state and local governmental agencies) to develop and follow written guidelines regarding the retention and destruction of biometric identifiers. BIPA also requires a private entity to provide written disclosures and obtain a written release before acquiring biometric information. BIPA creates a private right of action to aggrieved individuals against a private entity that violates the statute.
In Rosenbach v. Six Flags Entertainment Corporation, the Illinois Supreme Court held that a plaintiff does not have to “plead and prove that they sustained some actual injury or damage beyond infringement of the rights afforded them to have standing to sue” under the Biometric Information Privacy Act (“BIPA”). Accordingly, a mere violation of the statute is all that is required for a plaintiff to maintain an action under BIPA.
Since Rosenbach, litigants seeking to file or remove actions in or to federal court in which the complaint alleges BIPA violations are being turned away by federal judges finding that even if they have a viable claim in state court, they cannot demonstrate the requisite concrete and particularized injury necessary to satisfy the requirements of Article III standing (subject matter jurisdiction) under U.S. Constitution to allow the action to be heard in federal court. In that regard, an increasing number of federal courts are remanding to Illinois state court BIPA claims filed or removed to federal court. The District Court’s decision Hunter v. Automated Health Systems Inc.(subscription may be required), provides the latest example of the stiff headwinds BIPA litigants face in federal court.
In Hunter, the plaintiff filed her complaint in Illinois state court, alleging that, in violation of BIPA, the defendant employer required its employees, including the plaintiff, to “scan their fingerprints in defendant’s biometric time tracking system.” Plaintiff did not allege that any of her biometric information was collected without her knowledge or misused or disclosed to any third party or there was a risk that that her data would be disclosed to any unauthorized third party. The claim was predicated solely on the alleged statutory violations under BIPA. Defendant removed the action to federal court. After reviewing the defendant’s motion to dismiss on statute of limitations grounds, the District Court, on its own, raised the issue of whether it had subject matter jurisdiction over plaintiff’s claim. Following additional briefing by the parties, the District Court concluded it did not and remanded the case to state court.
In doing so, the District Court set forth the well-recognized standard governing Article III standing, stating: “To qualify as an injury-in-fact, the alleged injury must be “concrete and particularized” and “actual and imminent and not conjectural or hypothetical.” [Citing to Spokeo Inc. v. Robbins, To be concrete, the injury must be de facto, or actually exist. A ‘bare procedural violation divorced from any concrete harm’ does not qualify as an injury in fact. [Spokeo] A procedural statutory violation may constitute an injury-in-fact on its own if the legislature has elevated a de facto injury that ‘was previously inadequate in law” to the statues of illegally cognizable injury.’ But a statutory violation causes a concrete injury for Article III standing only if it presents an “appreciable risk of harm to the underlying interest the [legislature] sought to protect by enacting the statute.”
In finding that Plaintiff did not alleged Article III standing, the District Court relied on a string of recent district court cases that have found “that allegations of violation of BIPA’s procedural requirements absent allegations of dissemination, or at least an appreciable risk of dissemination, do not suffice to support Article III standing.” See Hunter. It further rejected the argument that the Illinois Supreme Court’s decision in Rosenbach required a finding of Article III standing, noting that while a Plaintiff need not allege any injury independent of a statutory violation to maintain a viable claim under BIPA, the holding was limited to establishing the policy of the “Illinois courts to allow parties to sue under BIPA,” even if they cannot demonstrate any other compensable injury beyond a violation of the statute. While such allegations may be sufficient to maintain a BIPA claim in Illinois state court, they are insufficient to satisfy the stringent requirements of Article III that a plaintiff demonstrate an actual or imminent injury. It further noted that the Illinois Supreme Court specifically stated that “BIPA procedural violations are not themselves actual injuries,” requiring a finding that such claims in federal court could not be deemed an “actual injury.”
Lastly, the court in Hunter distinguished the Ninth Circuit’s decision in Patel v. Facebook, 932 F.3d 1264 (9th Cir. 2019), where it held that that procedural violations of BIPA can constitute concrete injuries, noting that, in Patel, “plaintiffs posted images of themselves on Facebook, and Facebook used those images to create user face templates which it then used to suggest ‘tagging.’ Facebook created those templates without the users’ written consent, and thus used the plaintiffs’ images in ways that the plaintiffs had no reason to anticipate. In the instant case, plaintiff does not allege that defendant did anything with her data of which she was unaware, and there is no claim of dissemination to any third party.”
In view of the trend by district courts in the Seventh Circuit to find that mere allegations of BIPA statutory violations is insufficient to establish Article III standing in federal court, litigants hoping to commence or defend their actions in that forum should be mindful of the legal hurdles they will need to overcome to be able to litigate in their preferred forum.
