Update from LitLand: "Bare Procedural Violation" of BIPA Remanded to Illinois State Court

LitLand is a monthly feature that reviews developments in litigation as they relate to privacy matters and highlight any past, current, and future cases about which you should know.

With biometric information from face scans to gait analysis increasingly used by private companies for a variety of purposes, courts face a growing number of questions about when the use of biometric information can lead to a lawsuit. In one of the latest actions, a federal judge in the Northern District of Illinois remanded a class action under the Illinois Biometric Privacy Act (BIPA) to state court after concluding that a "bare procedural violation" of BIPA was insufficient to state a claim in federal court.

In Hunter v. Automated Health Systems, Plaintiff Evelyn Hunter alleged that Automated Health Systems, her former employer, violated BIPA when it:

• Required employees to scan their fingerprints into the company's biometric time tracking system without first obtaining their written consent;
• Failed to inform employees of the purpose for which their personal information was collected and the relevant retention period,
• Failed to provide a publicly available retention schedule and guidelines for the permanent destruction of their biometric information when no longer needed, as required by the statute.

The lawsuit was filed in state court and removed to federal district court by the defendant, Automated Health Systems, which is incorporated in Pennsylvania.

Only Illinois, Texas, and Washington have biometric information privacy laws. Of these, Illinois' Biometric Information Privacy Act (BIPA) is the most restrictive and the only one to provide consumers a private right of action. The private right of action has led to much debate over whether a violation of statutory privacy rights can give rise to standing to sue in federal court. Facebook recently settled a BIPA lawsuit related to its use of facial recognition, following the 9th Circuit’s refusal to dismiss the case and the U.S. Supreme Court's denial of certiorari.

In a footnote in the Hunter decision, the district court sought to distinguish the case from the 9th Circuit's decision against Facebook because there the plaintiffs alleged that the social media company had created face templates without consent and "thus used the plaintiffs’ images in ways that the plaintiffs had no reason to anticipate."

In Hunter, the district judge held that "plaintiff does not allege that defendant did anything with her data of which she was unaware, and there is no claim of dissemination to any third party." The district court’s opinion therefore appears to rest on two identified deficiencies in the complaint:

1. Failure to allege use of biometric information in a way of which the plaintiff was unaware, although awareness is not addressed in the statute; and
2. Failure to allege dissemination (or an appreciable risk of dissemination) to a third party.

While some may quarrel with the procedural aspects of the decision and the distinction from the decision in Facebook, particularly because BIPA does not discuss awareness, at least for now the Hunter case has been remanded to Illinois state court, where it was originally filed and where, under the Rosenbach decision, it could more easily survive a motion to dismiss.

This case is unlikely to slow the number of BIPA actions being filed in Illinois. Companies that use biometric information should continue to watch for further developments in this case, which signals divergence on BIPA standing requirements in state versus federal courts.