CHRISTINE BRYANT, Plaintiff-Appellee, v. COMPASS GROUP USA, INC., Defendant-Appellant.
No. 20-1443
United States Court of Appeals For the Seventh Circuit
ARGUED APRIL 24, 2020 — DECIDED MAY 5, 2020
Before WOOD, Chief Judge, and RIPPLE and ROVNER, Circuit Judges.
Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 19 C 6622 — Virginia M. Kendall, Judge.
WOOD, Chief Judge. Section 15(b) of Illinois’s Biometric Information Privacy Act (BIPA),
I
The underlying facts of the case are straightforward. Christine Bryant worked for a call center in Illinois. As a convenience for its employees, the center had a workplace cafeteria, in which it had installed Smart Market vending machines owned and operated by Compass Group USA, Inc. The machines did not accept cash; instead, a user had to establish an account using her fingerprint. Accordingly, during her orientation Bryant and her coworkers were instructed by their employer to scan their fingerprints into the Smart Market system and establish a payment link to create user accounts. Once their accounts were active, employees could purchase items and add money to their balance using just their fingerprints. Their fingerprints are “biometric identifiers” within the meaning of the Act.
In violation of section 15(a) of BIPA,
Bryant does not assert that she did not know that her fingerprint was being collected and stored, nor why this was happening. She voluntarily created a user account for the Smart Market vending machines and regularly made use of the fingerprint scanner to purchase items from the machines. She contends simply that Compass’s failure to make the requisite disclosures denied her the ability to give informed written consent as required by section 15(b). Compass’s failure to comply with the Act resulted, both for her and others similarly situated, in the loss of the right to control their biometric identifiers and information.
Seeking redress for that invasion of her personal data, on August 13, 2019, Bryant brought a putative class action against Compass in the Circuit Court of Cook County, pursuant to BIPA’s provision providing a private right of action in state court to persons “aggrieved” by a violation of the statute. See
Compass removed the action to federal court under the Class Action Fairness Act (CAFA),
Bryant moved to remand the action to the state court, claiming that the district court did not have subject-matter jurisdiction because she lacked the concrete injury-in-fact necessary to satisfy the federal requirement for Article III standing. (State law apparently poses no such problem, we note, as the Illinois Supreme Court pointed out in Rosenbach.)
The district court found that Compass’s alleged violations of sections 15(a) and (b) were bare procedural violations that caused no concrete harm to Bryant; accordingly, it remanded the action to the state court. Compass petitioned this court for permission to appeal the remand order under
A
As the party invoking federal jurisdiction, Compass bears the burden of establishing Bryant’s Article III standing. See Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th Cir. 2018) (per curiam). This fact has occasioned a role reversal in the arguments we normally see in these cases, with the defendant insisting that Article III standing is solid, and the plaintiff casting doubt on it.
For Bryant to have Article III standing, three requirements must be satisfied: (1) she must have suffered an actual or imminent, concrete and particularized injury-in-fact; (2) there must be a causal connection between her injury and the conduct complained of; and (3) there must be a likelihood that this injury will be redressed by a favorable decision. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992). Only the first of those criteria is at issue here: any injury she suffered was caused directly by Compass’s failure to comply with BIPA, and the prospect of statutory damages shows that such an injury is redressable.
In Spokeo, the Supreme Court explained that a “concrete” injury must actually exist but need not be tangible. 136 S. Ct. at 1548–49. A legislature may “elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.” Id. (quoting Lujan, 504 U.S. at 578). But “a bare procedural violation, divorced from any concrete harm,” does not “satisfy the injury-in-fact requirement of Article III.” Id. “Instead, the plaintiff must show that the statutory violation presented an ‘appreciable risk of harm’ to the underlying concrete interest that [the legislature] sought to
Compass urges that BIPA has elevated to protectible status a person’s inherent right to control her own body, including the associated biometric identifiers and information. The violation or trespass upon that right, it reasons, is a concrete injury-in-fact for standing purposes. Compass relies on the Illinois Supreme Court’s recent decision in Rosenbach, in which that court decided who qualifies as an “aggrieved” person for purposes of a state-court action pursuant to BIPA. The state supreme court had no cause to consider Article III standing requirements, but Compass argues that its conclusions about the interests BIPA was intended to protect nonetheless shed light on the question before us.
In Rosenbach, the plaintiff alleged that defendant Six Flags violated the procedures spelled out in section 15(b). 432 Ill. Dec. at 658–59. Six Flags argued that the plaintiff had to allege more in order to pursue her action—some tangible injury or harm. Id. at 659. The Illinois appellate court agreed with that contention, but the Illinois Supreme Court reversed, explaining that it is the well-established understanding in Illinois that “a person is prejudiced or aggrieved, in the legal sense, when a legal right is invaded by the act complained of or his pecuniary interest is directly affected by the decree or judgment.” Id. at 662 (internal citation and quotation marks omitted). Because section 15(b) of BIPA confers a right to receive certain information from an entity that collects, stores, or uses a person’s biometric information, the violation of that right, standing alone, is an actionable grievance. Id. at 663.
Helpful though Rosenbach may be, however, we cannot uncritically assume perfect overlap between the question before the state court and the one before us. As we alluded to earlier, standing requirements in Illinois courts are more lenient than those imposed by Article III. See Greer v. Illinois Hous. Dev. Auth., 122 Ill. 2d 462, 491 (1988) (“We are not, of course, required to follow the Federal law on issues of justiciability and standing.”); Duncan v. FedEx Office and Print Servs., Inc., 429 Ill. Dec. 190, 197 (Ill. App. Ct. 2019) (“Illinois courts generally are not as restrictive as federal courts in recognizing the standing of a plaintiff to bring a claim. Although federal law and Illinois law both require an ‘injury in fact’ to find standing, it does not necessarily mean that both forums define that
In short, federal courts and Illinois courts define “injury-in-fact” differently. With this in mind, we must independently determine whether the BIPA violations Bryant alleges suffice to support Article III standing.
B
There have been only a few BIPA cases in federal circuit courts; none has decided the precise standing question presented here. We describe them briefly in order to show how far they did, or did not, go.
In Miller v. Southwest Airlines Co., 926 F.3d 898 (7th Cir. 2019), we held that union airline workers had standing to bring claims of violations of sections 15(a) and (b) of BIPA in federal court. We found that the workers had alleged the “concrete dimension” necessary to establish Article III injury-in-fact because they faced the “prospect of a material change in [their] terms and conditions of employment,” if the employer, in light of the Act, had to bargain with the employee union to obtain employees’ consent or change how employees clocked in. Id. at 902. Additionally, the employees alleged a heightened risk of improper dissemination of biometric information if the employers were “not following the statutory data-retention limit and … used outside parties to administer their timekeeping systems.” Id.
In contrast, in a nonprecedential disposition the Second Circuit concluded that a plaintiff bringing Illinois BIPA claims against a video-game company lacked Article III standing because none of the alleged procedural violations raised “a material risk of harm” to a plaintiff’s interest in “prevent[ing] the unauthorized use, collection, or disclosure of an individual’s biometric data.” Santana v. Take-Two Interactive Software, Inc., 717 F. App’x 12, 15 (2d Cir. 2017) (summary order). The allegations showed that the plaintiff had already given as much consent as one could imagine, by agreeing to the scan of his face, sitting still for fifteen minutes while the scan took place, and creating his game avatar for use in online games. All that was left was a bare procedural violation.
The majority of the district courts in this circuit have rejected standing for plaintiffs alleging only violations of sections 15(a) and (b), without some further harm. See Hunter v. Automated Health Sys., Inc., 2020 WL 833180 (N.D. Ill. Feb. 20, 2020); Colon v. Dynacast, LLC, 2019 WL 5536834 (N.D. Ill. Oct. 17, 2019); McGinnis v. United States Cold Storage, Inc., 382 F. Supp. 3d 813 (N.D. Ill. 2019); Aguilar v. Rexnord LLC, 2018 WL 3239715 (N.D. Ill. July 3, 2018); Goings v. UGN, Inc., 2018 WL 2966970 (N.D. Ill. June 13, 2018); Howe v. Speedway LLC, 2018 WL 2445541 (N.D. Ill. May 31, 2018); McCollough v. Smarte Carte, Inc., 2016 WL 4077108 (N.D. Ill. Aug. 1, 2016); but see Figueroa v. Kronos Inc., 2020 WL 1848206 (N.D. Ill. Apr. 13, 2020). These decisions are not binding on us, however, and they did not rest on the nature of the interest BIPA seeks to protect—personal or public (see Spokeo, Thomas, J., concurring), informational, or formal. We consider this a question of first impression.
C
Our starting point is Spokeo itself, which provides substantial guidance about cases alleging the kind of intangible harm to personal interests that Bryant asserts. In addition, her right-to-control claim is fundamentally about the informed consent requirement in section 15(b); this gives rise to a question about informational injury, and more broadly about how Compass’s collection, storage, and use of Bryant’s fingerprint, even for purposes of which she was fully aware, might be a concrete injury either because it is closely analogous to historical claims for invasion of privacy or because she lost her right to control her own biometric information and effectively yielded it to Compass. We begin with a closer look at Spokeo, and we then look at other examples of the harm (or lack thereof) from a company’s failure to disclose information it was obligated by law to provide to a consumer.
The statute at issue in Spokeo was the Fair Credit Reporting Act (FCRA).
In the end, it did not rule one way or the other on Robins’s standing. It found instead that the Ninth Circuit had used the wrong test for injury-in-fact. That court had focused exclusively on the question whether Robins had alleged a particularized harm, which the Supreme Court was willing to assume that he had. But, while necessary, the Court held that this was not sufficient. 136 S. Ct. at 1548. Article III also requires an injury that is concrete. Explaining, the Court said that “[a] ‘concrete’ injury must be ‘de facto’; that is, it must actually exist.” Id. But, it added, “‘[c]oncrete’ is not, however, necessarily synonymous with ‘tangible.’ Although tangible injuries are perhaps easier to recognize, we have confirmed in many of our previous cases that intangible injuries can nevertheless be concrete.” Id. at 1549. In addition, the risk of real harm can suffice, id., and injury-in-fact is not defeated just because the injury is “difficult to prove or measure,” id.
Because the court of appeals failed to address the concreteness criterion, the Supreme Court thought it best to remand for application of the proper test. In essence, the task was to decide whether, in the relevant part of FCRA, Congress had identified a concrete injury that met Article III minima and
Justice Thomas joined the majority’s opinion, but he added a concurrence that drew a useful distinction between two types of injuries. The first, he said, arises when a private plaintiff asserts a violation of her own rights; the second occurs when a private plaintiff seeks to vindicate public rights. As examples of the first, he mentioned actions for trespass, infringement of intellectual property rights, and unjust enrichment, id. at 1551; as examples of the second, he pointed to actions seeking to abate a public nuisance, or disputes over the use of public land, id. at 1551–52.
Applying Justice Thomas’s rubric, we have no trouble concluding that Bryant was asserting a violation of her own rights—her fingerprints, her private information—and that this is enough to show injury-in-fact without further tangible consequences. This was no bare procedural violation; it was an invasion of her private domain, much like an act of trespass would be. Each individual person has distinct biometric identifiers. The common interest in robust protections of personal privacy, however, is the same as the shared support for the types of laws Justice Thomas mentioned. A direct application of Spokeo, in our view, leads to the result that Bryant satisfied the injury-in-fact requirement of Article III.
Our recent decisions on informational injuries are instructive. In Groshek v. Time Warner Cable, the plaintiff argued that his prospective employer violated FCRA’s requirement that an employer seeking to obtain a consumer report on a prospective employee had to give the applicant a stand-alone written disclosure stating that a consumer report may be obtained. 865 F.3d at 884–89. Instead of a stand-alone disclosure document, Time Warner provided Groshek with a document that contained the required disclosure as well as other information. Groshek signed the form, thereby authorizing Time Warner to obtain his consumer report. We concluded that Time Warner’s violation of the stand-alone disclosure requirement inflicted only “a statutory violation completely removed from any concrete harm or appreciable risk of harm.” Id. at 887.
In Robertson v. Allied Solutions, LLC, 902 F.3d 690 (7th Cir. 2018), in contrast, a company failed to provide a prospective employee with a copy of her background report before rescinding her employment offer on the basis of information contained in that report. We held that this omission constituted an injury-in-fact for a FCRA claim. Robertson’s informational injury was both particularized and concrete because she had a “substantive interest,” protected by FCRA, in being able to “review the reason for any adverse decision and to respond.” Id. at 696. The critical question, we said, is whether “the plaintiff is entitled to receive and review substantive information.” Id. at 697 (emphasis added). “Article III’s strictures are met not only when a plaintiff complains of being deprived of some benefit, but also when a plaintiff complains that she was deprived of a chance to obtain a benefit.” Id. Accordingly, it was “immaterial” that Robertson did not plead what she would have done if she had been given the chance to respond. Id. It was sufficient that Robertson, unlike Groshek, was wholly deprived of the information necessary to respond in the way FCRA contemplated.
Returning to the facts presented here, the substantive and personal nature of the information Compass was obligated under BIPA to disclose to consumers such as Bryant makes this case more like Robertson than Casillas for purposes of her claim under section 15(b). As the Illinois Supreme Court recognized in Rosenbach, the informed-consent regime laid out in section 15(b) is the heart of BIPA. The text of the statute demonstrates that its purpose is to ensure that consumers understand, before providing their biometric data, how that information will be used, who will have access to it, and for how long it will be retained. The judgment of Illinois’s General Assembly is that the sensitivity of biometric information and the risk of identity theft or other privacy or economic harm that may result from its dissemination, necessitates that people be given the opportunity to make informed choices about to whom and for what purpose they will relinquish control of
This was not a failure to satisfy a purely procedural requirement. Rather, as in Robertson, Compass withheld substantive information to which Bryant was entitled and thereby deprived her of the ability to give the informed consent section 15(b) mandates. Equipped with the missing information, she may have chosen not to use the vending machines and instead brought her own lunch or snacks. Or she may have opted for the convenience of the machines. She did not realize that there was a choice to be made and what the costs and benefits were for each option. This deprivation is a concrete injury-in-fact that is particularized to Bryant. She thus meets the requirements for Article III standing on her section 15(b) claim.
D
Bryant’s claim under section 15(a) is a separate matter. Section 15(a) obligates private entities that collect biometric information to make publicly available a data retention schedule and guidelines for permanently destroying collected biometric identifiers and information. In contrast to the obligations set forth under section 15(b), the duty to disclose under section 15(a) is owed to the public generally, not to particular persons whose biometric information the entity collects. This provision is not part of the informed-consent regime, and Bryant alleges no particularized harm that resulted from Compass’s violation of section 15(a).
III
Recognizing the privacy and economic risks involved in the wide use of biometric information, the Illinois General Assembly mandated in section 15(b) of BIPA that private entities make certain disclosures and receive informed consent from consumers before obtaining such information. As alleged, Compass did not make the requisite disclosures to Bryant or obtain her informed written consent before collecting her fingerprints. By failing to do so, Compass inflicted the concrete injury BIPA intended to protect against, i.e. a consumer’s loss of the power and ability to make informed decisions about the collection, storage, and use of her biometric information. This injury satisfies the requirements for Article III standing, and so Bryant’s claim under section 15(b) may proceed in federal court.
We therefore REVERSE the judgment of the district court remanding the action to the Circuit Court of Cook County, and REMAND this case to the district court for further proceedings consistent with this opinion.