Virginia M. Kendall
Virginia M. Kendall

A federal judge ruled that procedural violations do not meet the standard of “actual injuries” needed to establish standing in federal court for violations of the Illinois Biometric Information Privacy Act, or BIPA.

U.S. District Judge Virginia M. Kendall remanded a proposed class-action case against Compass Group USA to Cook County Circuit Court on Jan. 28. Plaintiff Christine Bryant asked for such a ruling, arguing Compass Group couldn’t prove Bryant alleged an injury-in-fact in her complaint.

Compass is a North Carolina-based food services company that operates restaurants and cafeterias at places like hospitals, schools and museums.

Bryant filed her suit against Compass in Cook County Circuit Court in August, alleging the company violated BIPA by requiring her and others to provide fingerprint scans when ringing up items at its self-service SmartMarket food kiosks.

Bryant alleges Compass did not obtain written consent or establish a written retention schedule or destruction guidelines for possession of her biometric data, as required by the state statute.

She does not allege the company collected her data without her knowledge, nor does she accuse the company of sharing her data or putting it at risk to fall into the hands of a third party.

Compass filed notice of removal to the U.S. District Court for the Northern District of Illinois, and Bryant moved for remand, claiming that she lacked standing in federal court because she did not allege an injury-in-fact.

For an injury to qualify as an injury-in-fact, it must be “concrete,” “affect the plaintiff in a personal and individual way” and be “actual and imminent, not conjectural or hypothetical.”

In her opinion, Kendall wrote “a bare procedural violation divorced from any concrete harm does not qualify as an injury-in-fact” unless “it presents an ‘appreciable risk of harm’ to the underlying concrete interest that the legislature sought to protect by enacting the statute.”

Citing multiple previous cases on this issue, Kendall wrote “several courts in the Northern District of Illinois have ruled on the precise question before this court and have uniformly held that BIPA procedural violations — without some additional action by the defendant, like surreptitious collection or disclosure to third parties — do not give rise to concrete injuries.”

Kendall cited five federal cases in which plaintiffs were found to not have standing under Article III because they “alleged nothing more than a procedural violation of BIPA, which does not confer Article III standing.”

Several of the cases involved employers collecting employee fingerprints for timecard information. In each case, the information was taken with the employees’ knowledge but without written consent or a clear storage and destruction plan in place.

Since none of the plaintiffs in the cases had information released to third parties or put at risk of being taken by third parties, the harm was limited to statutory violations and fell under the jurisdiction of state courts.

Kendall also cited two personal data cases which were found to fall under federal jurisdiction.

In Miller v. Southwest Airlines, decided by the 7th U.S. Circuit Court of Appeals in 2019, airline employees alleged their fingerprints were “shared with outside administrators which created a greater risk of disclosure to computer hackers” and that they “faced the prospect of material change in the terms and conditions of their employment” if they refused the fingerprinting identification.

In Patel v. Facebook, a case decided by the 9th U.S. Circuit Court of Appeals last year, Facebook users sued the social media giant for using the pictures they uploaded to create facial recognition templates for photo tagging without their consent.

Kendall wrote that Compass, “did nothing with the [p]laintiff’s data about which she was not aware.”

“Unlike the plaintiffs in Miller [plaintiff] does not allege that defendant shared her biometric information with third parties,” she continued. “When the plaintiffs in Patel uploaded their images to​​​​​ Facebook, by contrast, they had no idea their images would be used to create a facial-recognition template that Facebook could then use to identify them in images posted by other users. As such, the instant case is readily distinguishable.”

Compass’ attorneys contended the Illinois Supreme Court’s decision last year in Rosenbach v. Six Flags Entertainment Corp. would elevate Bryant’s complaints to more than technical statutory violations, as the court held that “a plaintiff may qualify as an aggrieved party entitled to relief under BIPA even without alleging some ‘actual injury or damage beyond infringement of the rights afforded them under the law.’”

Kendall, however, maintained Rosenbach merely establishes that “it is the [s]tate’s policy that an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the [a]ct, in order to qualify as an aggrieved person entitled to relief” as opposed to the federal courts, whose policy is “that a plaintiff must allege an ‘actual or imminent’ injury in order to establish Article III [s]tanding.”

Since the ruling deliberately distinguished between “actual injuries” and statutory violations of rights, Kendall held that the procedural violations are not concrete injuries and granted Bryant’s motion to remand the case back to the circuit court.

“We’re very glad to be back in Cook County where we originally filed suit and where we believe the case belongs,” said Douglas M. Werman, of Werman Salas P.C., who represents Bryant in the case. “The motion to move the case was filed almost immediately, so now we are actually in a position to do proper discovery and advance the litigation.”

Bryant hopes to have it certified as a class-action suit.

Bryant is also represented by Maureen Ann Salas and Zachary Cole Flowerree of Werman Salas.

Compass Group USA is represented by Joseph Clark Wylie II, Kenn Brotman, Molly K. McGinley and Paul W. Sweeney Jr., of K&L Gates LLP. Compass’ attorneys did not respond to a request for comment.

This case is Bryant v. Compass Group USA Inc., No. 19 C 6622.