Takeaway: Article III standing requires an injury-in-fact. To allege an injury-in-fact, a claimant must show "'an invasion of a legally protected interest' that is 'concrete and particularized' and 'actual or imminent, not conjectural or hypothetical.'" Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1548 (2016) (citation omitted). As the Supreme Court famously observed in Spokeo, "Article III standing requires a concrete injury even in the context of a statutory violation." Id. at 1549. Simply pleading a statutory claim – a "bare procedural violation, divorced from any concrete harm" – does not clear the bar of an actionable injury-in-fact. Id. at 1549.
An intangible injury can give rise to an injury-in-fact but presents the more challenging Article III analysis. Alleged injuries for violations of the Illinois Biometric Information Privacy Act ("BIPA") typically constitute intangible injuries, because BIPA protects a person's privacy interests in his or her "biometric identifiers," such as "fingerprints, retina and iris scans, hand scans, and facial geometry." Fox v. Dakkota Integrated Systems, LLC, --- F.3d ---, No. 20-2782, 2020 WL 6738112, at *1 (7th Cir. Nov. 17, 2020) (citing 740 ILL. COMP. STAT. 14/1 et seq. (2008)). BIPA regulates the collection, use, retention, disclosure, and dissemination of biometric identifiers, and provides a private right of action for statutory violations.
In Fox, the Seventh Circuit ruled the unlawful collection or retention of biometric data gives rise to an injury-in-fact, given the "the inherent sensitivity of biometric data." In contrast, the mere unlawful collection or retention of information as sensitive as a social security number will not be enough. The claimant must also allege a materially appreciable risk of harm.
The Fox case presented typical BIPA facts. Raven Fox worked for Dakkota Integrated Systems, an automotive supplier, at its plant in Chicago. Dakkota required its employees to clock in and out of work by scanning their hands on a biometric timekeeping machine. Dakkota utilized third-party software to record this biometric data, which were transmitted to and then stored in a third-party database.
The specific BIPA claim at issue in Fox concerned an alleged violation of Section 15(a) of the statute. Fox alleged that Dakkota violated all of its duties under Section 15(a) "by failing to develop, publicly disclose, and comply with a data-retention schedule and guidelines for the permanent destruction of biometric data when the initial purpose for collection ends." 2020 WL 6738112, at *6 (emphasis in original). According to Fox, instead of permanently destroying her biometric data when she left the company, Dakkota unlawfully retained her handprint and then unlawfully shared the data with the third-party database administrator, a company with "unknown security practices." Id. at *7.
Fox filed a putative class action in Illinois state court, asserting violations of Sections 15(a), (b), and (d) of BIPA. Although not specified in her class action complaint, Fox indisputably had been represented by a union during the time of her employment with Dakkota. Accordingly, Dakkota filed a notice removing the action to federal court under the Class Action Fairness Act (CAFA), and then moved to dismiss all three claims as preempted by the Labor Management Relations Act, 29 U.S.C. §§ 141–197 ("LMRA"). Dakkota's preemption argument relied on a Seventh Circuit decision, Miller v. Southwest Airlines Co., 926 F.3d 898 (7th Cir. 2019), which held that the federal Railway Labor Act preempted BIPA claims by unionized airline employees. Under Miller, BIPA claims could not be litigated in federal court but had to be resolved by an adjustment board under the Railway Labor Act, which governs employment conditions subject to bargaining between unions and management. Id. at 902–03.
The district court agreed in part and dismissed the Section 15(b) and (d) claims as preempted by the LMRA. But the district court, sua sponte, remanded the Section 15(a) claim to state court on the ground that Fox did not have standing to assert that claim. The district court based its decision on earlier Seventh Circuit BIPA case involving an alleged violation of the duty to publicly disclose a data-retention policy. Although the earlier case held that the plaintiff did not have standing to pursue a 15(a) claim based on such a bare procedural violation of BIPA, the Seventh Circuit explicitly limited its standing ruling to the "narrow violation" alleged in that case.
Dakkota filed a petition for permission to appeal the district court's remand order under CAFA. The Seventh Circuit granted that request, reversed the remand order, and sent the case back to the district court to resolve the issue of whether federal labor law preempted the Section 15(a) claim (a seemingly foregone conclusion under Miller).
According to the Fox panel, the district court erred in applying the earlier, narrow standing ruling to Fox's comprehensive Section 15(a) claim, because "Fox's section 15(a) claim does not allege a mere procedural failure to publicly disclose a data-retention policy." 2020 WL 6738112, at *6. Rather, she "accuses Dakkota of violating the full range of its section 15(a) duties by failing to develop, publicly disclose, and comply with a data-retention schedule and guidelines for the permanent destruction of biometric data when the initial purpose for collection ends." Id. (emphasis in original). "These allegations suffice to plead an injury in fact for purposes of Article III. The invasion of a legally protected privacy right, though intangible, is personal and real, not general and abstract." Id. at *1.
The court's decision turned on "the inherent sensitivity of biometric data." Id. at *7. In reaching its conclusion, the court distinguished another earlier standing decision which had dismissed a claim that a cable television provider violated the Cable Communications Policy Act (47 U.S.C. § 551(e)), by failing to destroy "personal identifying information" including social security and credit card numbers and dates of birth. That earlier claim failed on standing grounds because the plaintiff did not allege that the provider "had lost, leaked, given away, disseminated, or otherwise misused his identifying information in any way that harmed him, or that the statutory violation created a materially appreciable risk of any such harm to him." Id.
According to Fox, biometric identifiers are "meaningfully different because they are immutable, and once compromised, are compromised forever – as the legislative findings in BIPA reflect. That legislative judgment, though not conclusive, is 'instructive and important.' Spokeo, 136 S. Ct. at 1549." Id.
Having found standing and reversed the remand to state court, the Fox court returned the case to the district court to determine the preemption question, acknowledging that the answer "appears to flow directly from Miller." Id. at *8. Thus, by successfully keeping the case in federal court, Dakkota appeared poised to secure a preemption-based dismissal of all of Fox's BIPA claims.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
