In a prior blog post, we discussed the Illinois Supreme Court case, Rosenbach v. Six Flags Entertainment Corp., 129 N.E.3d 1197 (Ill. 2019), in which the Illinois Supreme Court held that an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Illinois Biometric Information Privacy Act (the “BIPA”), in order to qualify as an “aggrieved” person and be entitled to seek liquidated damages and injunctive relief.
Most recently, on February 20, 2020, in the Illinois federal court case Hunter v. Automated Health Systems, Inc., 2020 WL 833180 (N.D. Ill. Feb. 20, 2020), U.S. District Judge Robert Gettlemen joined several other district judges who have held that plaintiffs don’t have federal standing without allegation that protected private data could be disseminated.
By way of background, the Illinois BIPA imposes numerous restrictions on how private entities collect, retain, disclose and destroy biometric identifiers, including retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, or biometric information. Under the BIPA, any person “aggrieved” by a violation of its provisions “shall have a right of action…against an offending party” and “may recover for each violation” the greater of liquidated damages or actual damages, reasonable attorney fees and costs, and any other relief, including an injunction, that the court deems appropriate.
In Hunter, the named Plaintiff, Evelyn Hunter, sued Automated Health Systems (“AHS”) in Illinois state court for violations of the Illinois BIPA based on AHS having required its employees to scan their fingerprints for AHS’s biometric time tracking system. AHS removed the proposed class action to Illinois federal court. Plaintiff subsequently asked the court to remand the case to Cook County Circuit Court. In her brief on standing, Plaintiff asserted that she was not aware of any data breach and was not alleging that disclosure of the private data had occurred. Instead, Plaintiff contended that she was alleging AHS had made numerous violations of the Act’s procedural requirements, but that this was not enough to support Article III standing. In opposition, AHS argued that jurisdiction was proper based on the Illinois Supreme Court’s decision in Rosenbach.
The court sided with Plaintiff, holding that she had not alleged an injury-in-fact in order to establish Article III standing. In other words, the court found that AHS had not demonstrated that Plaintiff had alleged an injury-in-fact that was caused by AHS and was redressable by the federal court. In order to qualify as an injury-in-fact, the alleged injury must be “concrete and particularized” and “actual and imminent and not conjectural or hypothetical.”
In its finding that no injury-in-fact had been alleged, the court relied upon decisions from other Seventh Circuit district courts that concluded an alleged “bare procedural violation” of the BIPA is not enough to support standing in federal court. Rather, there must be an allegation that the private data has been disseminated or “at least an appreciable risk” that it might be disseminated. The court noted that Plaintiff made no allegations that AHS collected her biometric data without her knowledge or that AHS created a risk that Plaintiff’s data would fall into the hands of an unauthorized third party.
The court also rejected AHS’s contention that Rosenbach supported jurisdiction, reasoning that “Rosenbach established only that it is the policy of the Illinois courts to allow parties to sue under BIPA even if they cannot demonstrate that ‘they have sustained some compensable injury beyond violation of their statutory rights before they may seek recourse.’” (quoting Bryant v. Compass Group USA, Inc., 2020 WL 433868 (N.D. Ill. Jan. 28 2020)). The court also noted that the Illinois Supreme Court explicitly indicated that procedural violations of the BIPA are not themselves actual injuries.
