Federal district court in Illinois dismisses biometric information privacy case against Smarte Carte
A federal district court in Illinois has determined the mere violation of the Illinois Biometric Information Privacy Act does not amount to an injury sufficient to allow a plaintiff to sue in federal court.
A federal district court in Illinois dismissed a biometric information privacy case against Smarte Carte Aug. 1, according to the Cook County Record. The plaintiff has alleged Smarte Carte violated Illinois’ Biometric Information Privacy Act, or BIPA, through the company’s operation of fingerprint-keyed lockers at Chicago’s Union Station. The court based its dismissal on the Spokeo v. Robins case, which the U.S. Supreme Court decided May 16. The dismissal of the Smarte Carte case marks a stark departure from recent decisions in other BIPA cases in which courts allowed them to proceed.
The Illinois General Assembly passed the BIPA in 2008 to regulate private entities’ collection, use and storage of biometric data. The BIPA includes as “biometric information” data derived from a “biometric identifier” such as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.”
Illinois’ BIPA makes it illegal for a private entity to obtain a person’s biometric identifier or information, unless the entity first informs the person in writing and discloses the specific purpose and length of time for which the data is being collected, stored or used. The entity must then obtain written consent from the person to use or store the biometric information.
The act further requires the party in possession of the data to protect the security of the information.
Under the BIPA, Illinoisans “aggrieved” by violations of the act have the right to sue private parties for violations of the act and to collect the greater of $1,000 or actual damages for each violation negligently committed, and the greater of $5,000 or actual damages for each violation recklessly or intentionally committed.
The plaintiff in the Smarte Carte case alleged Smarte Carte failed to obtain her consent to collect, store and use her fingerprint, and did not provide information regarding the storage of her fingerprint. She sued for unspecified damages under the BIPA.
In dismissing the case against Smarte Carte, the court noted that in order to have standing to file a lawsuit in federal court, Article III of the U.S. Constitution requires a plaintiff to have an actual conflict that needs to be resolved. The court pointed out that the U.S. Supreme Court in Spokeo emphasized the necessity of a “concrete and particularized injury” to satisfy Article III’s “case or controversy” requirement and held that allegations of a mere violation of a statute do not qualify.
The Illinois federal district court asked, “How can there be an injury from the lack of advanced consent to retain the fingerprint data beyond the rental period if there is no allegation that the information was disclosed or at risk of disclosure?” Moreover, according to the court, the plaintiff did not demonstrate how she was “aggrieved” by Smarte Carte’s alleged BIPA violation so as to give her the right to recover damages under the statute. The court determined the plaintiff would need to allege specific harms to show she is entitled to sue for Smarte Carte’s BIPA violation. The court also noted even if the mere statutory violation made the plaintiff an “aggrieved” person entitled to seek damages in state court under the BIPA, this would still not give her standing to sue in federal court. Although the court dismissed the case, the judge left the plaintiff free to file her BIPA claims in Illinois state court.
Not surprisingly, Facebook, the defendant in another BIPA case Illinois plaintiffs filed, has also requested the dismissal of its case in light of Spokeo. Facebook lost a battle in May when a federal district court in California denied the company’s motion to dismiss the class action lawsuit against it. The judge explained that the plaintiffs’ complaint about Facebook’s photo tag suggestions sufficed to state a case under the BIPA, and determined the case could proceed to trial. But that decision came before Spokeo. Facebook explained in its June motion to dismiss, that contrary to the requirement under Spokeo, “Plaintiffs do not allege that they suffered any ‘concrete injury’ as a result of these claimed statutory violations,” according to a report in Corporate Counsel. The federal district court in California is scheduled to hear Facebook’s new motion to dismiss in September.
The Smarte Carte dismissal marks a potential turning point in the BIPA cases pending against companies such as Facebook, Google and SnapChat. To the extent plaintiffs have failed to allege specific, concrete harm, as opposed to mere statutory violations, these lawsuits could face the same fate as the case against Smarte Carte.