A federal district court in the Northern District of Illinois dismissed a putative class action alleging violations of the Illinois Biometric Information Privacy Act — known as the BIPA — holding that the allegation of a mere procedural violation of the statute did not establish Article III standing. The July 30 ruling in Johnson v. United Airlines furthers the split among trial courts on whether allegations of technical violations of BIPA allege the concrete injury necessary for federal subject matter jurisdiction. Ultimately, Illinois' highest court will take up the issue and its decision will likely substantially impact pending and future BIPA litigation.
Illinois Biometric Information Privacy Act
BIPA is the nation's toughest law regulating the collection and use of biometric information. Under BIPA, a "biometric identifier" is defined as "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." BIPA requires organizations to provide written notice prior to their biometric information collection, storage and use practices, and to obtain written consent before collecting an individual's biometric data. The notice must include the purpose of the collection and the duration that the organization will use or retain the data. Once an organization has collected biometric data, BIPA requires that the data be protected in the same manner as other sensitive and confidential information using the reasonable standard of care in the organization's industry. BIPA also requires organizations to have a publicly available written policy stating how long the organization will retain the data and rules governing its destruction. Unlike other state biometric data laws, BIPA provides a private right of action to any "person aggrieved" by a violation of the law.
Background
The plaintiff, David Johnson, is a baggage handler for United Airlines. Johnson and other United employees are subject to a collective bargaining agreement between United and International Association of Machinists and Aerospace Workers. Under the CBA, United requires fingerprint scans as a condition of employment and mandates that its employees swipe their fingerprints as a means of clocking in and out and for timekeeping purposes.
Johnson filed a putative class action in Illinois state court challenging United's collection and use of his fingerprints as a violation of BIPA. Specifically, Johnson alleged that United had failed "to obtain consent from its workers prior to capturing and collecting their biometric information and similarly failed to provide workers and the public with a retention schedule and detention policies which detailed how and when Defendants would retain and then destroy their workers' biometric information and/or biometric identifiers." United removed the action to the Northern District of Illinois on the basis of federal question jurisdiction pursuant to the Railway Labor Act, and the diversity of the parties. United then moved to dismiss Johnson's complaint for lack of subject matter jurisdiction.
District Court Decision
The district court dismissed Johnson's complaint, holding that Johnson's BIPA claim was preempted by the RLA and that, even if it was not, Johnson had failed to establish an injury sufficient to establish standing.
The district court began by noting that Congress had enacted the RLA to "promote stability in labor-management relations by providing a comprehensive framework for resolving labor disputes." It held that any dispute between labor and management whose resolution required interpretation of the collective bargaining agreement between the parties fell within the scope of the RLA and was subject to preemption. Because Johnson's BIPA claim required interpreting the CBA to determine whether United's use of fingerprint scanning for a timekeeping system fell within the scope of the CBA, the court held the BIPA claim was preempted. In addition, Johnson's claim that United failed to obtain a written release before using its employees' fingerprints also required interpreting the CBA to determine if it provisions directly contradicted BIPA's requirements. Thus, the district court found that the RLA stripped it of subject matter jurisdiction.
The district court next addressed Johnson's standing to bring his BIPA claims, finding that "[n]ot only does preemption support dismissal in the underlying matter, but so too does the issue of Article III standing." It held that "although injuries may be intangible harms or purely statutory procedural harms, the harm alleged by Johnson fails to rise to the level of an injury-in-fact without more." The district court found that "notice and consent violations do not without more create a risk of disclosure," and "Johnson alleges a statutory violation based entirely on United's failure to obtain consent but provides no factual basis to show there was any subsequent disclosure that would form the injury." Accordingly, the district court granted United's motion to dismiss for lack of subject matter jurisdiction.
Takeaways
Although BIPA limits private actions to individuals who are "aggrieved" by a violation, the law does not define that term. This omission has led to conflicting decisions concerning whether an injury beyond a procedural violation is required for statutory standing. In McCollough v. Smarte Carte (N.D. Ill. Aug. 1, 2016) and Santana v. Take-Two Interactive Software (2d Cir. Nov. 21, 2017), BIPA actions were dismissed because there was no actual injury separate and distinct from the alleged procedural statutory violation. In contrast, in Monroy v. Shutterfly (N.D. Ill. Sept. 15, 2017) and In re Facebook Biometric Information Privacy Litigation (N.D. Cal. Apr. 16, 2016), the courts found that allegations of a BIPA violation without an actual injury were still sufficient to establish standing. The United Airlines decision weighs in firmly on the side of those courts requiring an actual injury for standing in BIPA cases and provides defendants with additional ammunition to challenge BIPA plaintiffs whose claims only include a technical or procedural violation of the statute.
However, it should be noted that the BIPA case of Rosenbach v. Six Flags Entertainment which directly addresses whether an actual injury is required in BIPA cases is currently pending before the Illinois Supreme Court. In Rosenbach, the plaintiff alleged that the theme park violated BIPA by collecting fingerprints in connection with the purchase of a season pass and not obtaining written consent or disclosing how the collected fingerprint scans would be used, stored, and/or destroyed. The Appellate Court of Illinois found that a plaintiff who alleges only a technical violation of the statute without also alleging some injury or adverse effect is not an aggrieved person under BIPA. How the Illinois Supreme Court rules will likely decide the issue and substantially impact pending and future BIPA litigation.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
