On November 17, 2020, the United States Court of Appeals for the Seventh Circuit reversed a federal district court’s decision to remand a class action case alleging violations of Section 15(a) of Illinois’s Biometric Information Privacy Act (BIPA). The Seventh Circuit determined that the remand was improper, holding that a former employers’ retention of employee biometric information after the employment relationship ended constituted an injury-in-fact sufficient to satisfy Article III standing.
Section 15(a) of BIPA requires that “[a] private entity in possession of biometric identifiers or information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfies or within 3 years of the individual’s last interaction with the private entity, whichever occurs first.” BIPA provides a cause of action for persons aggrieved by a violation and permits the court to award injunctive relief, actual or statutory damages, and attorney’s fees.
The class action suit was initiated by Raven Fox, a former employee of Dakkota Integrated Systems (Dakkota), an automotive supplier that required employees to clock in and out of work by scanning their hands on a biometric timekeeping device. Dakkota used third-party software to capture employees’ biometric data, which were then stored in a timekeeping database administered by a third party. After leaving the company, Fox alleged that Dakkota violated Section 15(a) by failing to develop, publicly disclose, and comply with a data-retention schedule and guidelines for the permanent destruction of biometric data. Fox alleged that these violations resulted in the unlawful retention of her handprint after she left Dakkota and the unlawful sharing of her biometric data with the third-party database administrator.
In holding that Fox had alleged a concrete and particularized harm sufficient to confer upon her Article III standing to bring her claims, the Seventh Circuit distinguished its earlier decision in Bryant v. Compass Group USA, Inc. In that decision, the court held that a plaintiff lacked Article III standing to bring her BIPA Section 15(a) claim because she alleged only that the defendant failed to publicly disclose a data-retention policy—a failure that the Seventh Circuit characterized as a “mere procedural failure”—and thus the plaintiff did not allege any concrete and particularized harm stemming from this purported failure to disclose. By contrast, Fox alleged not only that Dakkota failed to disclose its data-retention policy, but also that Dakkota failed to comply with its data-retention and destruction policies, which resulted in the wrongful retention of her biometric data beyond the time authorized by BIPA.
The Seventh Circuit thus reversed the district court’s order, and kept the case in federal court for the parties to litigate Fox’s BIPA Section 15(a) claims.