Two cases, one from the U.S. Supreme Court and one from the Illinois Supreme Court, have set the venue for the enforcement and interpretation of an Illinois privacy law squarely in the Illinois state courts, to the exclusion of the federal courts. This situation is likely to spread as other states move to pass their own privacy and cybersecurity laws. As such, state courts are likely to be on the forefront of enforcing state privacy and cybersecurity laws, especially those that provide procedural protections to guard against harms that are difficult to quantify.

The story starts with the Supreme Court's decision in Spokeo v. Robins, 136 S.Ct. 1540 (2016), a case involving allegations of violations of the Fair Credit Reporting Act. In Spokeo, the Supreme Court reiterated that to have standing to bring a claim in federal court under Article III of the U.S. Constitution, the plaintiff, among other things, must have suffered an injury in fact. That is, he or she must have suffered an invasion of a legally protected interest that is concrete and particularized and actual and imminent, not conjectural or hypothetical. The court stated that to be concrete, an injury must be real and not abstract, although it does not necessarily have to be tangible. While the court noted that Congress can elevate intangible harms to meet the injury in fact requirement, plaintiffs do not “automatically satisfy the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Thus, plaintiffs cannot meet the Article III standing requirement by alleging “a bare procedural violation, divorced from any concrete harm.”

Although Spokeo was a case arising under the Fair Credit Reporting Act, the standing analysis quickly spread to other privacy laws. One of those laws was the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS/1, et seq.  BIPA imposes numerous requirements on entities that collect biometric identifiers or biometric information, such as fingerprints or retina scans.  Specifically, an entity cannot collect a person's biometric data without first informing that person that his or her biometric data is being captured and stored, informing that person of the specific purpose for which his or her biometric data is being collected, and receiving a written release from the individual whose biometric data is being collected. BIPA creates a private right of action and statutory or actual damages for any person “aggrieved by” a violation of the statute.

Soon after the Supreme Court decided Spokeo, several BIPA cases made their way to federal district courts by way of diversity jurisdiction. Those cases involved allegations that the defendant collected the plaintiff's biometric information without providing the required notices or receiving the required release. They did not involve a security breach that exposed this information or a subsequent disclosure of any biometric information to a third party. Using the Spokeo analysis, the federal courts dismissed these suits for lack of standing. They reasoned that the cases involved “bare procedural violations” of BIPA, and without more to demonstrate concrete harm, the plaintiffs lacked standing under Article III.

Meanwhile, BIPA faced a similar debate in Illinois state courts that were dealing with the interpretation of BIPA itself. Some state courts had ruled that to be “aggrieved by” a violation of BIPA, and therefore have a right of action, an individual must have sustained some actual injury or harm beyond the statutory violation itself. Other state court decisions rejected this idea, ruling that the violation of an individual's statutory rights to notice and consent under BIPA is alone sufficient to make that individual “aggrieved” under the statute with standing to sue.

Ultimately, the Illinois Supreme Court was called on to resolve the debate in Rosenbach v. Six Flags Entertainment, — N.E.3d —, 2019 IL 123186 (2019). The Rosenbach court ruled that “an individual need not allege some actual injury or adverse effect, beyond violation of his rights under [BIPA], in order to qualify as an 'aggrieved' person” with a right of action.

The court's analysis centered on the generally understood meaning of the word “aggrieved.” It rejected the lower court's statement that “mere technical” violations of BIPA do not make one “aggrieved” under the statute. In doing so, the court noted that in passing BIPA, the Illinois General Assembly sought to give individuals control over their biometric information by requiring that they be given notice and the “power to say no by withholding consent.” Therefore, it reasoned, the procedural protections in BIPA were critical to protect individuals from the harm that the General Assembly sought to avoid, the right to maintain one's biometric privacy. According to the court, violation of the procedural protections in BIPA, therefore, is “no mere 'technicality.'” Rather, the injury from a procedural violation “is real and significant.”

In coming to its conclusion, the Illinois Supreme Court  gave weight to the General Assembly's assessment that biometric data is inherently different from other forms of personal data. When passing BIPA, the General Assembly noted that other forms of personal data, such as Social Security numbers, could be changed if compromised. But biometric information is “biologically unique to the individual” and therefore cannot so easily be changed if compromised.  As such, the court essentially concluded that there is no such thing as a “mere technical” violation of BIPA.  Violation of the procedural provisions of BIPA violates the substantive right that BIPA is designed to protect.

Thus, did Rosenbach change anything with respect to the Article III standing analysis in BIPA cases?  It has not yet, although Rosenbach was just decided in January 2019. Granted, the issues raised in Rosenbach and Spokeo are two separate questions, one dealing with state law statutory construction, and one dealing with constitutional interpretation. Yet the questions are related. In Spokeo, the Supreme Court ruled that “a bare procedural violation” of a statute is not enough to establish Article III standing absent any concrete harm. It also noted, however, that Congress plays an important role in identifying intangible harms that meet the concrete harm requirement. And the Rosenbach court determined that the Illinois General Assembly had found that the risk associated with having one's biometric data collected without notice and consent created a “real and significant” injury.

In other words, Rosenbach stands for the proposition that a “mere procedural violation” of BIPA creates an appreciable risk of the very harm the statute was designed to prevent, individuals losing control over their biometric information. While the Illinois General Assembly cannot elevate this intangible harm to meet the injury in fact requirement as Congress can, its assessment and the Rosenbach decision should at least inform the analysis of whether a “mere procedural violation” of BIPA creates a risk of real harm that is concrete enough to satisfy Article III standing requirements.

In any event, for the time being, BIPA cases alleging no more than a procedural violation are essentially nonremovable under Spokeo, even if there is diversity of citizenship. An individual whose biometric information is collected without the requisite notice or consent is an aggrieved person under the statute, and therefore, has a right of action in state court. That same individual, however, has not necessarily suffered a concrete injury for purposes of Article III analysis under Spokeo. Therefore, if a diverse defendant attempts to remove the case, the district court will likely remand it for lack of standing if it sticks to pre-Rosenbach analysis. As more states pass their own biometric privacy laws, this may become the case for those laws as well, depending on the statutory language and how the state courts interpret it. For now, unless the federal courts are willing to view biometric data differently than they view other forms of personal data, it appears that state courts will largely be on the forefront of enforcing notice and consent provisions in biometric privacy laws, with federal courts mere observers based on constitutional standing principles.

Brian Kint is a Philadelphia-based member of the data privacy & security practice at Cozen O'Connor.  Both an attorney and a certified information privacy professional (CIPP/US), he can speak the language of the law as well as the language of the IT professionals responsible for developing and implementing technology solutions to adhere to the law and to the organization's data security strategy. Contact him at [email protected].