Article written by Haim Ravia, Dotan Hammer and Adi Shoval
The United States Court of Appeals for the 7th Circuit held that collecting and processing biometric information without obtaining the data subject’s informed consent constitutes a violation of privacy under the Illinois Biometric Information Privacy Act (“BIPA”), which entitles data subjects to bring a claim for compensatory damages in federal court.
The case involved the collection of fingerprints as a method of identification for purchases made in vending machines operated by Compass Group USA, Inc. The BIPA requires that before collecting biometric information, the controller of such information ensure that data subjects understand how their biometric information will be used, who will have access to it and for how long it will be retained. The plaintiff was asked to provide her fingerprints and voluntarily agreed to it, so she could purchase vending machine items and add money to her balance using just her fingerprint. However, she was never provided with the prerequisite disclosures that would support her informed written consent, as the BIPA requires.
The Court found that the plaintiff has standing to bring the class-action lawsuit in federal court. Several years ago, the U.S. Supreme Court held that federal court standing in cases such as this is conditioned on the plaintiff showing they suffered an actual or imminent, concrete, and particularized injury-in-fact. The Seventh Circuit clarified that a “concrete” injury must exist but need not be tangible, rather, the plaintiff needs to show that the statutory violation presented an ‘appreciable risk of harm’ to the underlying concrete interest that the legislature sought to protect by the BIPA.
The court found that plaintiff alleged an injury of her privacy – her fingerprints and her private information – and therefore satisfies the “injury-in-fact” requirement, even without further tangible consequences.
CLICK HERE to read the Seventh Circuit Court of Appeals’ decision in Christine Bryant v. Compass Group USA, Inc.
