Plaintiffs seeking to lodge class actions against companies under an Illinois biometrics privacy law may not be able to exploit a divide between Illinois state courts and federal courts to keep their cases before more plaintiff friendly state courts in Cook County and elsewhere in Illinois, after a federal appeals panel said violations of the Illinois state law are, in fact, a real concrete injury under the law.
On May 5, a three-judge panel of the U.S. Seventh Circuit Court of Appeals overturned the decision of a Chicago federal judge on the question of whether class actions over fingerprint scans can actually be heard in federal court.
The decision lends a new wrinkle to the developing legal history over how to interpret the 2008 Illinois Biometric Information Privacy Act.
Molly McGinley
| K&L Gates
The case centered on a class action filed in Cook County court by lawyers with the firm of Werman Salas P.C., of Chicago, against Compass Group, a North Carolina-based foodservice provider that operates vending machines that utilize fingerprint scanners to process transactions.
In the lawsuit, named plaintiff Christine Bryant asserts Compass violated the Illinois BIPA law by allegedly failing to secure authorization from customers before requiring them to scan a fingerprint when using their vending machines. Bryant used Compass vending machines in her workplace, according to the appellate decision.
The lawsuit further accused the company of violating the BIPA’s provisions requiring companies to provide written notice to customers concerning why the company was scanning and storing their fingerprints, how the fingerprint data would be saved, shared and used, and how the company would ultimately destroy the data.
The lawsuit itself was very similar to hundreds of other class actions filed under the BIPA law by a number of plaintiffs’ law firms against companies of many kinds and sizes operating in Illinois in the past few years.
Plaintiffs’ lawyers have seized on the once-obscure provisions in the law to sue nearly any company using technology designed to scan so-called biometric identifiers. Typically, these have targeted the scanning of fingerprints or facial geometry.
Large targets have included Facebook, Google and Shutterfly.
But the vast majority of the lawsuits have targeted employers or companies like Compass, which use fingerprint scanners to verify identifies to track employee work hours or process consumer transactions.
Even amid the COVID-19 pandemic, class actions have continued to mount in Cook County Circuit Court, the central hub for most of the BIPA-related class action activity.
After Bryant and her attorneys with Werman Salas filed suit in Cook County, Compass sought to take the case to federal court.
Ordinarily, such a move would be a mere procedural step, as Compass is not based in Illinois and the financial stakes are potentially massive. Under the BIPA law, damages can amount to $1,000-$5,000 per violation. And each violation could be counted as each time a customer scanned a fingerprint. Such calculations meant there were likely many millions of dollars on the line.
However, in federal court, Bryant and her lawyers argued the case couldn’t go to federal court, because Bryant did not wish to claim she was ever really harmed by the law. Under the U.S. Supreme Court decision known as Spokeo v Robins, Bryant should have needed to prove she suffered some “concrete” injury to allow the lawsuit to proceed in federal court.
However, her refusal to identify a concrete injury would not have doomed her case. Rather, it would have meant the case would have been transferred back to Cook County and Illinois’ state courts. In that court system, an Illinois Supreme Court decision, known as Rosenbach v Six Flags, controlled. And under the Rosenbach decision, the plaintiffs don’t need to prove they were actually harmed in a concrete way by violations of the BIPA; they need only show the defendants violated the technical notice and authorization procedures to bring their lawsuit and cash in on a potential large judgment or settlement.
Compass responded by arguing the case actually belonged in federal court, because their alleged failure to provide the notices required by BIPA could be considered a concrete injury.
On appeal, however, the Seventh Circuit judges saw the matter differently.
Judge Wood noted the unusual nature of the arguments, pointing out how the case had flipped the usual positions of the parties. Typically, the plaintiff argues they have standing, and it is the defendant seeking to invalidate that position.
However, Wood said in this case, Compass held the correct position under the Spokeo precedent.
Wood noted the Illinois Supreme Court “recognized in Rosenbach, the informed-consent regime laid out in (the law) is the heart of BIPA.”
“The text of the statute demonstrates that its purpose is to ensure that consumers understand, before providing their biometric data, how that information will be used, who will have access to it, and for how long it will be retained,” Wood wrote.
Illinois state lawmakers, the judge said, passed the BIPA law to ensure Illinois residents could “make informed choices about to whom and for what purpose they will relinquish control of that information.”
When companies, like Compass, allegedly fail to provide the notices or secure consent required by BIPA’s technical provisions, it deprives people of the “ability to give the informed consent” the law “mandates,” Wood wrote.
“She (Bryant) did not realize that there was a choice to be made and what the costs and benefits were for each option,” Wood said. “This deprivation is a concrete injury-in-fact…”
That, the appellate panel said, means Bryant’s class action rightly belongs in federal court, and not Cook County Circuit Court.
Compass Group has been defended by attorneys Joseph C. Wylie II and Molly K. McGinley, of K&L Gates, of Chicago.
The decision could have implications for a number of other cases, involving class actions brought under BIPA by Illinois residents against companies from outside Illinois.
Other class actions under BIPA have also been sent back to Cook County court by other Chicago federal judges using Kendall’s reasoning.
In February, for instance, District Judge Robert Gettleman remanded to Cook County court a class action lawsuit brought by the Fish Law Firm, of Naperville, on behalf of named plaintiff Evelyn Hunter, against her employer, Pittsburgh-based Automated Health Systems. Hunter had accused AHS of violating BIPA in the manner in which it required its employees to scan fingerprints to verify their identities when punching in and out work shifts.