On April 24, 2020, the U.S. Court of Appeals for the Seventh Circuit held in Bryant v. Compass Group USA, Inc. that plaintiffs lack standing to assert in federal courts claims arising under Section 15(a) of the Illinois Biometric Information Privacy Act (BIPA) for failing to develop a publicly available policy for the retention and destruction of biometric data, because they do not incur actual damages as a result of the violation. Although the immediate effect of this procedural ruling is that plaintiffs cannot assert claims under Section 15(a) in federal courts within the Seventh Circuit, courts may rely on the ruling to apply Illinois’ two-year statute of limitation to state court actions asserting claims under Section 15(a), and hold that actions under this section are not insurable as a matter of law.
The Illinois Biometric Privacy Act
In light of the growing use of biometrics by businesses, Illinois enacted BIPA to regulate the collection, use, storage, and destruction of biometric identifiers – fingerprints, voiceprints, facial geometries, or retinal scans – and biometric information – information derived from a biometric identifier used to identify a person – by private entities. My colleague Andy Shapiro previously wrote about whether companies were covered by insurance for BIPA claims here.
BIPA imposes a number of requirements on those who obtain a person’s biometric data, including providing that person with required disclosures and obtaining that person’s written release prior to acquiring that data. BIPA likewise prohibits those in possession of biometric data from selling or profiting from that data, nor can they, with few exceptions, disclose that data to third parties. Another requirement in Section 15(a), one of the provisions at issue in Bryant, requires those in possession of biometric data to develop a publicly available written policy regarding the retention and destruction of biometric data in their possession. Anyone violating any provision of BIPA, including Section 15(a), is liable for the greater of statutory liquidated damages of $1,000 for each negligent violation, or $5,000 for each intentional or reckless violation, or the actual damages incurred by the plaintiff, as well as attorneys’ fees, costs, and injunctive relief.
Plaintiffs lack standing to assert claims for violations of Section 15(a) of BIPA in Federal Court
An action alleging a violation of BIPA can be commenced in Illinois state court. Recently, the Illinois Supreme Court held that in order to do so, plaintiffs “need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Act.” An action under BIPA may also be brought in federal court if the diversity of citizenship and amount-in-controversy requirements are met. However, a plaintiff must also establish that he or she has standing to assert that claim in federal court by alleging: (i) he or she suffered an actual, concrete injury-in-fact; (ii) a causal connection between the injury and conduct complained of; and (iii) a likelihood that the injury will be redressed by a favorable decision. In Spokeo, Inc. v. Robins, the U.S. Supreme Court held that “a bare procedural violation, divorced from any concrete harm,” does not “satisfy the injury-in-fact requirement.”
In Bryant, the Seventh Circuit was presented with the question of whether an alleged violation of Section 15(a) constitutes a “bare procedural violation” for which a plaintiff lacks standing to assert in federal court. Plaintiff commenced a class action in state court, asserting violations of Section 15(a), as well as of Section 15(b) of BIPA, for failing to provide the required disclosures or obtain the plaintiff’s written release. Defendant removed the action to federal court, and plaintiff in turn moved to remand, arguing she “lacked the concrete injury-in-fact necessary to satisfy the federal requirement for Article III standing.” The district court agreed, and granted the motion to remand, finding the alleged violations of Sections 15(a) and 15(b) “were bare procedural violations that cause no concrete harm” to plaintiff.
On appeal, the Seventh Circuit in part reversed, finding plaintiff had standing to assert her claim under Section 15(b). However, the court upheld the ruling district court’s ruling that plaintiff lacked standing to assert her Section 15(a) claim, finding this section’s requirements of maintaining publicly available biometric data retention and destruction policies were “owed to the public generally” and not directly to plaintiff and thus she not suffer a particularized injury-in-fact arising from the alleged violation of Section 15(a).
Are BIPA’s statutory damages for violations of Section 15(a) penal or remedial?
Whether the ruling in Bryant applies beyond the issue of standing depends on whether the statutory damages imposed for violations of Section 15(a) are construed to be a statutory penalty rather than remedial damages. Under Illinois law, a statutory penalty: (i) is imposed automatically for a violation; (ii) set at a predetermined amount; and (iii) imposed without regard to the actual damages incurred by plaintiff. Remedial damages, on the other hand, are imposes solely “for actual damages suffered by the plaintiff as a result of the violation of the statute.”
Applying this standard, a court could conclude that the statutory damages imposed for a violation of Section 15(a) constitutes a statutory penalty because they are automatically imposed upon a finding of a violation, the amount is predetermined by statute, and, based on the holding in Bryant, they are imposed in the absence of actual damages. However, in Std. Mut. Ins. Co. v. Lay, the Illinois Supreme Court held that similar statutory damages available under the Telephone Consumer Protection Act of 1991 for sending unsolicited faxes were remedial. The court reached that conclusion in part by finding that plaintiffs who receive unsolicited faxes incur actual compensable damages in the form of loss of paper and ink, as well as in “annoyance and in convenience.” In contrast, the Seventh Circuit held a plaintiff does not incur actual compensable damages arising from a violation of Section 15(a) of BIPA. This difference may be sufficient for a court to distinguish the holding in Lay and find the statutory damages under Section 15(a) are penalties.
Violations of Section 15(a) may be subject to a shorter statute of limitation and may not be insurable
The characterization of the statutory damages imposed for a violation of Section 15(a) as a penalty could have significant effects on the substantive rights of both plaintiffs and defendants.
BIPA does not provide for its own statute of limitation. Thus, parties have argued that different limitation periods apply, with plaintiffs arguing that Illinois’ five-year catch-all statute of limitation applies whereas defendants have argued that the two-year period for actions seeking statutory penalties applies. Prior to the ruling in Bryant, a judge in the Circuit Court of Cook County held that the five-year statute of limitations applied, finding that the statutory damages for violations of BIPA were not statutory penalties. However, that court did not consider the question of whether the statutory damages imposed by each separate section of BIPA were statutory penalties. Rather, the court generally concluded that statutory damages awarded under BIPA as a whole were remedial. By doing so, the court may have conflated the damages awarded under those sections that are remedial with that awarded under Section 15(a), which may be penal. Further, this ruling, as it relates to Section 15(a), is contrary to the more recent holding in Bryant. If a court follows Bryant and concludes that the statutory damages under Section 15(a) are penalties, then it may find that the two-year statute of limitation applies. If so, plaintiffs will have far less time to bring their claims, and the time period encompassing a purported class of plaintiffs will likewise be shorter, reducing the size of the requested class.
A defendant facing liability for statutory damages under Section 15(a) may find its insurer seeking to deny both coverage and a duty to defend for that claim. Although the scope of an insurer’s duty to indemnify and defend typically depends on the language of the applicable insurance policy, as a general matter Illinois “public policy prohibits insurance against liability for punitive damages that arise out of one’s own misconduct…” If a court determines that the statutory damages imposed for a violation of Section 15(a) are penal in nature, the court could find this public policy bars insurance coverage for, and precludes a duty to defend, the alleged violation. Recently, in West Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc., the Appellate Court of Illinois held that an insurer owed a duty to defend its insured in a class action brought under BIPA. However, the ruling in West Bend was issued prior to the ruling in Bryant and thus the Seventh Circuit’s finding of a lack of actual damages incurred in connection with Section 15(a) violations was not before that court. A court now presented with this issue, in light of the ruling in Bryant, may reach a different decision.
The number of lawsuits asserting violations under BIPA has grown exponentially since the Illinois Supreme Court held that plaintiffs do not need to allege they incurred actual damages. While that ruling has permitted a greater number of plaintiffs to assert claims under BIPA, it also had the effect of precluding those plaintiffs from bringing claims under Section 15(a) in federal court. Courts in the future may hold that the lack of actual damages incurred under this section may also affect the time when an action must be brought and whether that claim is insurable.