The Illinois Supreme Court decided last month that the mother of a child who had to give his fingerprints to purchase a season pass to the Six Flags amusement park had a valid claim as an “aggrieved person” under the Illinois Biometric Privacy Act of 2008 (“BIPA”). In Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, the plaintiff challenged the Six Flags practice of collecting the thumbprints of patrons entering the park. Six Flags argued that the plaintiff did not have a claim under BIPA because plaintiff did not allege that any harm resulted from the collection of her son’s thumbprints, so she was not an “aggrieved person” under BIPA with standing to bring the action.

The Court found that an “aggrieved person” under BIPA need not have “sustained actual damage beyond violation of his or her rights under the Act in order to bring an action under it.” The Court reasoned that this definition of aggrieved is consistent with definitions of aggrieved in the dictionary, as well as other Illinois court decisions.

BIPA is the subject of intense interest nationwide because it is considered to be the most stringent law in the United States regulating biometric information. The statute governs the collection, use, safeguarding, handling, storage, retention and destruction of biometric identifiers and biometric information and creates a private right of action for a person “aggrieved” by a violation of the statute. The law was enacted in response to the growing use of biometrics to identify people without notice and in recognition of the fact that biometrics are unlike other unique identifiers used to access finances or other sensitive information.

A wave of class action litigation is likely to follow Rosenbach. Many defendants will want to remove the cases to federal court. But the Rosenbach ruling underscores the limits of federal jurisdiction over BIPA claims, particularly in employment cases where an employee challenging workplace collection of biometric information has not suffered an actual injury. Since the enactment of BIPA, Illinois federal courts in particular have struggled over whether a case that pleads a cognizable state law claim under BIPA satisfies the different Article III “injury in fact” standard to confer federal jurisdiction. Now that Rosenbach has confirmed that a BIPA plaintiff need not allege any actual injury to state a claim, there are likely to be more and more BIPA cases that cannot be removed to federal court.

In light of Rosenbach, I decided to use ROSS to trace a line of authority that marks the boundary of federal jurisdiction in BIPA cases in the employment law context where plaintiff has not alleged any actual injury.  

Establishing Article III standing based on intangible rights conferred by BIPA is not a straightforward proposition. But doing the research on ROSS illustrates the power of the software. In about 30 minutes I was able to mark off a practical boundary for federal jurisdiction in a complex area of the law. Yet again, ROSS quickly helped me find lines of reasoning that might have taken days on Westlaw or Lexis.

‍

Determining Article III Standing Under BIPA

‍

I began my research by filtering for Illinois and related federal cases and asking: What is the federal standard for evaluating Article III employee standing to challenge employer use of biometric information to monitor employees?

I have to admit that even I was impressed that eight of the first ten cases returned immediately by ROSS discussed the courts’ line of reasoning concerning Article III standing to bring a BIPA claim in federal court. The ninth case, Rivera v. Google, Inc., 16 C 02714, (N.D. Ill. December 29, 2018) (ROSS, Ill. Case Law) involves Google’s use of face scanning technology and discusses legal issues that are highly relevant to BIPA standing. The tenth case, Spokeo, Inc. v. Robins, 136 S.Ct. 1540, 194 L.Ed.2d 635, 84 U.S.L.W. 4263 (U.S. 2016) is among the leading cases on Article III standing and a key case in any brief on the subject.

ROSS found a remarkably similar set of facts in the eight cases on BIPA Article III standing. In every one of the cases the employer used a fingerprint system to monitor employees and the plaintiff challenged the practice on the grounds that it violated BIPA. In each case the court considered whether or not the employee’s alleged injury satisfied the Article III “injury in fact” standing requirement.  

‍

ROSS Returns Article III Cases in the BIPA Employment Context

‍

In the first case returned by ROSS, McGinnis v. United States Cold Storage, Inc., Case No. 17 C 08054, (N.D. Ill. January 3, 2019) (ROSS, Ill. Case Law), plaintiff challenged his former employer’s use of fingerprint data as part of its employee time-tracking system. Plaintiff alleged that his fingerprints were stored in the employer’s database, that the employer failed to inform him of the specific purpose of collecting his fingerprints, did not tell him how long it would store or use his fingerprints and did not provide him a copy of the employer’s biometric data-retention policy. The employee also never signed a written release allowing the employer to collect or store his fingerprints.

The McGinnis court laid out the tension between state law standing under BIPA and Article III federal standing: Standing to sue in federal court is a federal question which does not depend on the party's standing in state court. To satisfy the Article III federal standing requirement, the plaintiff must establish an injury-in-fact that is “concrete and particularized.” Although tangible injuries are easier to recognize, intangible injuries can nevertheless be concrete. However, a “bare procedural violation” of a statute is not automatically enough to satisfy Article III's concreteness requirement.

Applying the standard, the McGinnis court dismiss plaintiff’s claims sua sponte on the grounds that the failure to provide and obtain the statutorily required notice or consent when collecting and retaining McGinnis's fingerprint--without more--did not constitute a concrete injury for Article III purposes.  

The case ranked second by ROSS, Miller v. Southwest Airlines Co., (N.D. Ill. August 23, 2018) (ROSS, Ill. Case Law), was also directly on point. In Miller, Southwest ground employees challenged the company’s use of a biometric timekeeping system at Chicago’s Midway airport. The system required employees to scan their fingers to sign in and out of work every day and stored the biometric data to identify employees and for payroll purposes. Plaintiffs alleged, among other things, that Southwest violated BIPA by not providing adequate notice to employees about the biometric timekeeping program, did not obtain informed consent from employees and disseminated employee data to third parties.

The Miller court found Article III standing even though a mere violation of BIPA's notice and consent provisions did not create a concrete risk of harm to a plaintiff's right of privacy in his biometric data. According to the Miller court, Article III standing was not conferred “unless the information is collected or disseminated without the plaintiff's knowledge or consent.” The court found Article III standing because “[e]ven if Plaintiffs voluntarily scanned their fingerprints to the biometric time clock Defendant required them to use, they still have alleged a concrete injury because there is no indication on the face of the complaint that they knew about or consented to the disclosure of their fingerprint scans to third parties.”


The remaining five cases turned on the same questions of knowing consent and whether or not the plaintiff’s biometric data had been disclosed to third parties. See Aguilar v. Rexnord LLC, 17 CV 9019, (N.D. Ill. July 3, 2018) (ROSS, Ill. Case Law) (“A person's privacy may be invaded [and Article III standing conferred] if her biometric information is obtained or disclosed without her consent or knowledge.”); Goings v. UGN, Inc., 17 CV 9340, (N.D. Ill. June 13, 2018) (ROSS, Ill. Case Law) (dismissing the case for lack of Article III standing where plaintiff “was aware that he was providing his biometric data to defendants and does not claim that defendants have disclosed (either purposely or unwittingly) that information to any other entity without his consent.”); Dixon v. The Washington and Jane Smith Community-Beverly, 17 C 8033, (N.D. Ill. May 31, 2018) (ROSS, Ill. Case Law) (finding Article III standing where defendant disclosed plaintiff’s fingerprint data to a third party without informing plaintiff.) ; Howe v. Speedway LLC, 17 CV 07303, (N.D. Ill. May 31, 2018) (ROSS, Ill. Case Law)(finding no Article III standing because defendant disclosed practice); Kiefer v. Bob Evans Farms, LLC, 313 F.Supp.3d 966 (C.D. Ill. 2018) (lack of Article III standing not undisputed); Barnes v. Aryzta LLC, 17 CV 7358, (N.D. Ill. December 20, 2017) (ROSS, Ill. Case Law) (remanded based on defendant’s failure to establish Article III standing).