The Illinois Supreme Court recently ruled in Rosenbach v. Six Flags Entm’t Corp. that an allegation of “actual injury or adverse effect” is not required for a plaintiff to sue under the state’s Biometric Information Privacy Act (BIPA). The ruling clarifies that a plaintiff whose biometric information was merely collected in violation of BIPA is injured within the meaning of the statute and authorized to bring an action for statutory damages.
Despite this ruling, defendants facing BIPA claims in federal court are expected to continue pressing the argument that the U.S. Supreme Court’s holding in Spokeo v. Robins nonetheless requires such plaintiffs to allege an actual injury to have standing.
The clash over standing under BIPA demonstrates the inherent challenges facing state statutes creating new rights to privacy, and the results foreshadow how future state privacy laws will be enacted and litigated.
Rosenbach‘s shortcoming is that it cannot provide a precedential ruling with respect to the federal constitutional issue of standing. In Spokeo, the Supreme Court held that a plaintiff does not automatically satisfy the injury-in-fact requirement whenever a law grants a person a statutory right and purports to authorize that person to sue to vindicate that right. Article III standing requires a concrete injury even in the context of a statutory violation.
Determining if Harm Is Concrete
Spokeo identified two factors to consider in determining whether an intangible harm is concrete and rises to the level of an injury-in-fact.
A statute itself can create an intangible injury that is sufficiently concrete by articulating a chain of causation that will give rise to a case or controversy where none existed before. In Spokeo, the court refers to the judgment of Congress as being “instructive and important” when evaluating standing under a statute “because Congress is well positioned to identify intangible harms that meet minimum Article III requirements.”
The second way to determine whether an intangible harm is concrete is to consider whether the alleged harm is closely related to a harm that has traditionally provided a valid basis for a lawsuit.
Traditional Causes of Action
In the privacy realm, intangible harms have been channeled into four traditional causes of action:
- appropriation of name or likeness;
- intrusion upon seclusion;
- false light; and
- public disclosure of private facts.
BIPA’s legislative findings suggest that it is intended to prevent identity theft, which is related to appropriation of name or likeness, but the fact that the statute can be violated by improper collection alone is problematic for standing. Spokeo warns that violations of a procedural right protected by a statute must entail a degree of risk sufficient to meet the concreteness requirement.
The difficulty of conceptualizing a concrete injury based on the intangible harm caused by violating a person’s right to control his or her biometric information makes standing an area that remains vulnerable to attack by defendants, particularly in class action cases. Defendants have successfully argued that violations of BIPA’s notice and consent procedures do not present sufficient risk of harm in every case.
Easier Path for State Court Litigants
State court plaintiffs will not face the same obstacles. Although Illinois law requires an injury-in-fact, standing is not jurisdictional but rather an affirmative defense that is the defendant’s burden to plead and prove.
As a result, Illinois courts generally are not as restrictive as federal courts in recognizing the standing of a plaintiff to bring a claim, holding that standing “should not be an obstacle to the litigation of a valid claim” and denigrating federal courts for “mudd[ying] the issue of standing with the merits of the underlying suit.”
Adding to that is that the Rosenbach opinion, which essentially checks off the Illinois requirements for injury-in-fact for any claim under BIPA, and standing in state court should be secure.
The Rosenbach opinion and the difference in the standing analysis for federal and state court will have significant effects on how BIPA claims are litigated. The result could be to effectively segregate BIPA claims into two cohorts:
- those that choose to allege additional injury (which can proceed in federal court), and
- those that do not (and may only be able to proceed in state court).
Diverging Law Would Be Bad
If federal and state courts diverge in how they treat BIPA claims, bodies of case law could develop that provide differential treatment based on how the threshold standing question is answered.
The fight over standing under BIPA should inform potential future regulation concerning biometric data, and more broadly privacy issues related to the collection of personal information. State legislatures looking to create new rights to privacy should be mindful of the traditional categories of harm, and carefully tailor the language used in statutes to match with one or more of those categories.
The legacy of BIPA remains to be written, and how BIPA claims are litigated after Rosenbach will serve as an important foundation, or stumbling block, for the future of privacy and data collection laws.
Torsten Kracht is a partner at Hunton Andrews Kurth in the firm’s Washington, D.C., and New York offices. He represents clients from the U.S. and abroad in complex commercial litigation and arbitration.
Lisa Sotto is the managing partner of the firm’s New York office and chair of its global privacy and cybersecurity practice.
Bennett Sooy is a litigation associate at the firm in the Washington, D.C., office.