Foodservice provider Compass Group will be headed back to Cook County court to defend itself against charges its vending machine fingerprint scanners violate an Illinois biometrics privacy law, after a federal judge agreed the fingerprint scans themselves caused no legal injury and the case doesn't belong in federal court.
Instead, the judge said this means the case should be heard in state court, where judges have ruled plaintiffs don’t need to prove any actual harm to potentially force companies, like Compass, to pay untold millions of dollars for such fingerprint scans.
On Jan. 28, U.S. District Judge Virginia M. Kendall ruled Charlotte, N.C.-based Compass Group can’t keep the biometric privacy lawsuits in federal court.
Douglas Werman
| Werman Salas P.C.
“… It is the State’s policy that ‘an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Act, in order to qualify as an ‘aggrieved’ person’ entitled to relief,” Judge Kendall wrote in her opinion. “But it is the policy of the federal courts, by contrast, that a plaintiff must allege an ‘actual or imminent’ injury in order to establish Article III standing.”
The case was first filed in Cook County Circuit Court in August 2019, when lawyers with the firm of Werman Salas P.C., of Chicago, introduced their complaint against Compass.
The lawsuit, on behalf of named plaintiff Christine Bryant, asserts Compass violated the Illinois Biometric Information Privacy Act by allegedly failing to obtain authorization from customers before requiring them to scan a fingerprint when using their vending machines. The lawsuit also accuses the company of violating the Illinois BIPA’s provisions requiring companies to provide written notice to customers concerning why the company was scanning and storing their fingerprints, how the fingerprint data would be saved, shared and used, and how the company ultimately planned to destroy the data.
Such lawsuits have been brought by the hundreds in Illinois courts in recent years, as plaintiffs lawyers have seized on the once-obscure Illinois data privacy law to sue nearly any company using tech designed to scan so-called biometric identifiers, typically fingerprints or facial geometry.
The lawsuits initially targeted social media and big tech giants, like Facebook, Google and Shutterfly.
However, in more recent years, businesses and employers of all sizes and types have been deluged with lawsuits by the score each month, primarily in Cook County’s courts. The new lawsuits have predominantly taken aim at companies utilizing fingerprint scanners to identify employees or customers, in certain situations.
Employers typically use such technology to more accurately track employee work hours or secure access to sensitive sites, such as drug storage closets at hospitals or rail yards required to be secured by federal law.
Retailers often use the technology to verify customer identity for rewards programs or to reduce the need for customers to pay by credit card or cash.
However, the lawsuits assert nearly any such use of biometric identification in Illinois could place businesses on the hook for huge, and potentially crippling damages, if they don’t strictly follow the provisions of BIPA. The law allows for damages of $1,000-$5,000 per violation. And lawyers have indicated each violation could be defined as each time a fingerprint is scanned.
Facebook, for instance, has agreed to pay $550 million to settle a class action dating back to 2015 asserting the photo tagging feature on the Facebook social media platform violates the Illinois BIPA law’s authorization and notification provisions.
Defendants initially attempted to defend themselves against the lawsuits by arguing so-called technical violations of the BIPA laws notice provisions alone – without any accompanying data breaches or identity theft - shouldn’t subject them to huge potential damages.
They pointed to decisions from the U.S. Supreme Court, such as the 2016 decision in Spokeo v Robins, which held plaintiffs can’t press claims unless they prove actual, or “concrete” injury from a defendant’s technical violation of a law.
In Illinois, however, the state’s Supreme Court cast such notions aside, finding in early 2019 in the case docketed as Rosenbach v Six Flags, that under Illinois’ BIPA law, plaintiffs need only prove the company violated the notice and authorization provisions within the law to press their huge dollar claims.
In the class action against Compass, the company initially sought to take the case to federal court.
However, the plaintiffs instead asked the judge to send the case back to Cook County court. They argued their plaintiff would have no standing to sue in federal court, because she has not and can not prove Compass’ fingerprint scans actually harmed her in any way.
Compass responded by arguing that, under the Illinois Supreme Court’s Rosenbach decision, she actually is claiming real injuries, so the case should remain in federal court.
Judge Kendall, however, said she believes that is a misreading of the decision.
“Had the Illinois Supreme Court instead characterized violations of (BIPA) as ‘actual injuries,’ then this Court would be obliged to construe the procedural violations alleged in the instant case accordingly,” Judge Kendall wrote. “However, the Illinois Supreme Court explicitly indicated that BIPA procedural violations are not themselves actual injuries. Because the authoritative interpreter of Illinois law has dictated that procedural violations of (BIPA) are not ‘actual injuries,’ Plaintiff has not alleged an injury with a ‘concrete dimension’…”
This, Judge Kendall said, means the case belongs back in Cook County Circuit Court, where the plaintiffs can resume their class action, despite the lack of any actual injuries, under the Rosenbach decision.
Bryant’s class action, however, is not the only one Compass Group will face in Cook County.
On Jan. 28, the same day as Judge Kendall’s decision was delivered, attorneys from the firm of Peiffer Rosca Wolf & Kane, of St Louis, filed a nearly identical class action complaint against Compass in Cook County Circuit Court. That lawsuit was filed on behalf of named plaintiff Jennifer Kessler.
Compass Group has been represented in the initial class action by attorney Molly K. McGinley and others with the firm of K&L Gates LLP, of Chicago and Los Angeles.