Locke Lord QuickStudy: Second Circuit Set to Address Key Issues Under Illinois Biometric Information Privacy Act

The Second Circuit became the first U.S. Court of Appeals to wade into the rising tide of litigation under Illinois’s Biometric Information Privacy Act (“BIPA”) when it conducted oral argument on October 26, 2017 in a BIPA case that the district court had dismissed. See Santana v. Take-Two Interactive Software, No. 17-303 (2nd Cir.). The Second Circuit at oral argument seemed prepared to affirm the district court’s conclusion that plaintiffs lacked Article III standing because they did not allege any concrete injury. Many are eagerly anticipating the court’s decision as it will be the first significant guidance regarding at least some of the issues that can arise in BIPA cases, which plaintiffs have been filing at a rapidly accelerating pace in recent months.

BIPA regulates private entities’ collection, storage, and use of biometric information.
The statute narrowly defines biometric identifiers as only one of the following: “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10. The definition is a closed list—not a list of examples—and also specifically excludes things like writing samples, photographs, or biological samples. Id. “Biometric information” is defined as any information based on a biometric identifier and used to identify an individual. Id.

The statute prohibits a private entity from capturing, buying, or otherwise obtaining a person’s biometric identifier/information unless it first does the following: (1) develops a publicly available written retention schedule governing how long the information will be kept; (2) gives the person written notice that the information is being collected or stored and of the purpose of doing so and how long the information will be kept; and, (3) obtains a written release from the person. 740 ILCS 14/15(a), (b). BIPA also prohibits private entities from selling biometric identifiers/information, restricts any other disclosure thereof, and requires reasonable care be taken in storing or transmitting biometric identifiers/information.

BIPA creates a private right of action for any “person aggrieved” by a statutory violation and authorizes recovery of the greater of either actual damages or “liquidated damages” of $1,000 for a negligent violation or $5,000 for an intentional or reckless violation. 740 ILCS 14/20. Reasonable attorneys’ fees and injunctive relief are also available. Id.

BIPA is not the only statute governing biometric information, but it is the most onerous. Other statutes in Texas and Washington do not authorize a private right of action (state officials must enforce), and do not require a written release. Tex. Bus. & Com. Code Ann. § 503.001; Wash. Rev. Code Ann. § 19.375, et seq.

A wave of BIPA litigation has already begun.
BIPA’s remedies, along with employers’ increasingly frequent use of biometrics for employee tracking purposes, seem to have contributed to a recent wave of putative class actions filed in Illinois courts alleging BIPA violations. So far this year, over a dozen putative class actions have been filed against employers alleging BIPA violations in connection with fingerprint scans used for time-keeping purposes. No industry is immune; recent class actions name retailers, a fast-food franchise, a trucking company, a nursing home, an airline cargo handling company, an ambulance company, a food manufacturer, and a supermarket chain.

Potential defenses in BIPA litigation.
Several defenses have been tried in BIPA cases thus far, some of which the Take Two court may offer guidance on. First, defendants have argued that BIPA’s “person aggrieved” qualifier limits its private right of action to people with actual damages. This has met with mixed results. Compare McCollough v. Smarte Carte, Inc., 2016 WL 4077108, at *4 (N.D. Ill. Aug. 1, 2016) (dismissing BIPA action for lack of actual damages) with Monroy v. Shutterfly, Inc., 2017 WL 4099846, at *9 (N.D. Ill. Sept. 15, 2017) (rejecting argument). These same two courts also split on whether a BIPA violation was a concrete harm sufficient to support federal subject-matter jurisdiction under Spokeo v. Robins, 136 S.Ct. 1540 (2016).

Defendants have also argued that allegations fall outside the narrow definition of biometric identifier, though with little success at the pleadings stage. See Rivera v. Google, Inc., 238 F. Supp. 3d 1088, 1095, 1100 (N.D. Ill. 2017) (denying motion to dismiss arguing face scan derived from a photo is not biometric information, but suggesting that discovery could change the analysis); In re Facebook Biometric Information Privacy Litg., 2016 WL 2593853, at *12 (N.D. Cal. May 5, 2016) (same); Monroy, 2017 WL 4099846 at *5 (rejecting argument that facial recognition scan was not a biometric identifier); Norberg v. Shutterfly, Inc., 2015 WL 9914203, at *2 (N.D. Ill. Dec. 29, 2015) (finding a plausible claim under BIPA based on face geometry derived from photographs). This argument may be more successful on summary judgment.

Finally, defendants have argued that BIPA does not apply extraterritorially and that applying it in that way would violate the Dormant Commerce Clause of the U.S. Constitution. But these defenses are highly fact specific and therefore likely would not be successful in a motion to dismiss. See Monroy, 2017 WL 4099846 at *6 (agreeing that BIPA does not apply extraterritorially but declining to dismiss case because of the required factual inquiry); Rivera, 238 F. Supp. 3d at 1100-1102 (same).

In Take-Two, the Second Circuit may address Spokeo and who a “person aggrieved” is.
In Take-Two, defendants made a video game that scanned players’ faces to create a personalized in-game avatar. Although plaintiffs knew their faces were being scanned, they did not receive the specific notice or provide the written release required by BIPA. But the district court dismissed their case with prejudice, finding they lacked Article III standing, and were not “aggrieved” under BIPA, because any violations caused no harm. In other words, plaintiffs lacked both constitutional and statutory standing.

At oral argument, the Second Circuit peppered plaintiffs’ counsel with questions regarding what harm, if any, plaintiffs suffered when they knowingly consented to the face scans, particularly since there was no subsequent data breach or significant risk of a breach. These questions suggest the court may affirm the district court’s finding that plaintiffs lacked Article III standing under Spokeo. A ruling along these lines would significantly bolster defendants’ threshold challenges to BIPA cases in federal courts.

The argument did not touch on the “person aggrieved” issue other than the Second Circuit’s suggestion that the district court should not have reached that issue once it found no subject-matter jurisdiction under Spokeo. Thus, a plausible outcome will be the Second Circuit affirming dismissal under Spokeo but vacating the district court’s finding that plaintiffs were not “aggrieved” under BIPA.