An Illinois federal court recently remanded a case back to Illinois state court after concluding, sua sponte, that it lacked subject matter jurisdiction over a privacy suit initiated by a class of employees asserting violations of the Illinois Biometric Privacy Act (“BIPA”). The plaintiffs’ claims were based on allegations that the defendant employer collected and stored individuals’ fingerprints.
In Aguilar v. Rexnord, LLC, No. 17-cv-9019 (N.D. Ill. July 3, 2018), the district court noted that the court has an “independent obligation to ensure subject-matter jurisdiction exists, even if no party raises the issue.” The court determined that the plaintiffs comprising the putative class action lacked standing because they failed to sufficiently allege concrete harm, and thus no actual injury, as required to confer Article III subject matter jurisdiction under the U.S. Constitution.
In general, BIPA “regulat[es] the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” BIPA also contains a notice and consent provision regarding the collection of an individuals’ biometric information, which is defined to include information such as fingerprints. King & Spalding previously reported more broadly on BIPA and the fairly recent proliferation of litigation surrounding BIPA here.
In Aguilar, the defendant employer instituted a clock-in system that utilized individual employees’ fingerprints to authenticate and track when employees began and ended their shifts. In asserting a violation of BIPA, the named plaintiff alleged violations of the notice and consent aspects of the law, claiming that he never signed a written release permitting the employer to collect or store his fingerprint information, and that the employer never disclosed the purpose of the fingerprint collection or disclosed a data retention plan.
In analyzing the standing issue, the Aguilar court, quoting Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016), first held that basic procedural violations of BIPA are insufficient for Article III standing: “Not just any injury will do—[a plaintiff] must have suffered ‘an invasion of a legally protected interested’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’”
The court went on to examine whether the alleged violations of BIPA’s notice and consent provisions created a risk of concrete harm in relation to the interests that the statute was intended to protect. Ultimately, in finding a lack of Article III standing, the court determined that the plaintiff was aware that his biometric data, his fingerprints, were collected because he scanned them each time he clocked in and out at work, and that it was also clear that the fingerprint information was stored, because it was used for authentication purposes. Thus, the district court held that it lacked subject matter jurisdiction because it found no cognizable injury: “Here, the violations are divorced from concrete harm, including harm to Aguilar’s privacy interest in his biometric information and harm to his right to know that the information was collected, and therefore do not constitute injuries in fact.”
The federal district court remanded the claims in this case to the state court, but its standing analysis is instructive as it provides some insight into when violations of BIPA’s notice and consent provisions could constitute injury in fact for standing purposes, even absent additional harm. The court acknowledged in dictum that violations of the notice and consent provisions of BIPA could potentially constitute cognizable harm, and noted that a plaintiff’s lack of knowledge or consent to the collection and storage of biometric data “could violate her privacy interests and constitute an injury in fact.”
A copy of the district court opinion remanding the claims in Aguilar is available here.
We will continue monitoring and reporting on further developments in this area of the law, particularly relating to the prevalent litigation and issues surrounding Illinois’ BIPA.
