Bryant v. Compass Grp. USA, Inc., No. 20-1443

• Decision Date: 05 May 2020
• Docket Number: No. 20-1443
• Parties: Christine BRYANT, Plaintiff-Appellee, v. COMPASS GROUP USA, INC., Defendant-Appellant.
• Court: U.S. Court of Appeals — Seventh Circuit

958 F.3d 617

Christine BRYANT, Plaintiff-Appellee,

v.COMPASS GROUP USA, INC., Defendant-Appellant.

No. 20-1443

United States Court of Appeals, Seventh Circuit.

Argued April 24, 2020

Decided May 5, 2020

As Amended on Denial of Rehearing and Rehearing En Banc June 30, 2020

Zachary Flowerree, Attorney, WERMAN SALAS P.C., Chicago, IL, Douglas M. Werman, Attorney, Chicago, IL, for Plaintiff-Appellee.

Molly K. McGinley, Attorney, Joseph C. Wylie, II, Attorney, K&L GATES LLP, Chicago, IL, for Defendant-Appellant.

Ryan D. Andrews, Attorney, Roger Perlstadt, Attorney, EDELSON P.C., Chicago, IL, for Amicus Curiae.

Before Wood, Chief Judge, and Ripple and Rovner, Circuit Judges.

Wood, Chief Judge.

Section 15(b) of Illinois's Biometric Information Privacy Act (BIPA), 740 ILCS 14 (2008), regulates the collection, use, and retention of a person's biometric identifiers or information. It requires collectors of this material to obtain the written informed consent of any person whose data is acquired. This regime is designed to protect consumers against the threat of irreparable privacy harms, identity theft, and other economic injuries arising from the increasing use of biometric identifiers and information by private entities. As a matter of state law, anyone "aggrieved" by a violation of the disclosure and informed consent obligations is entitled to bring a private action against the alleged offender. The question now before us is whether, for federal-court purposes, such a person has suffered the kind of injury-in-fact that supports Article III standing. We conclude that a failure to follow section 15(b) of the law leads to an invasion of personal rights that is both concrete and particularized. See Spokeo, Inc. v. Robins, ––– U.S. ––––, 136 S. Ct. 1540, 194 L.Ed.2d 635 (2016). We therefore reverse the district court's order remanding this case to state court and remand for further proceedings.

I

The underlying facts of the case are straightforward. Christine Bryant worked for a call center in Illinois. As a convenience for its employees, the center had a workplace cafeteria, in which it had installed Smart Market vending machines owned and operated by Compass Group USA, Inc. The machines did not accept cash; instead, a user had to establish an account using her fingerprint. Accordingly, during her orientation Bryant and her coworkers were instructed by their employer to scan their fingerprints into the Smart Market system and establish a payment link to create user accounts. Once their accounts were active, employees could purchase items and add money to their balance using just their fingerprints. Their fingerprints are "biometric identifiers" within the meaning of the Act. 740 ILCS 14/10.

In violation of section 15(a) of BIPA, id. § 15(a), Compass never made publicly available a retention schedule and guidelines for permanently destroying the biometric identifiers and information it was collecting and storing. In addition, in violation of section 15(b), Compass never: (1) informed Bryant in writing that her biometric identifier (fingerprint) was being collected or stored, (2) informed Bryant in writing of the specific purpose and length of term for which her fingerprint was being collected, stored, and used, or (3) obtained Bryant's written release to collect, store, and use her fingerprint. Id. § 15(b).

Bryant does not assert that she did not know that her fingerprint was being collected and stored, nor why this was happening. She voluntarily created a user account for the Smart Market vending machines and regularly made use of the fingerprint scanner to purchase items from the machines. She contends simply that Compass's failure to make the requisite disclosures denied her the ability to give informed written consent as required by section 15(b). Compass's failure to comply with the Act resulted, both for her and others similarly situated, in the loss of the right to control their biometric identifiers and information.

Seeking redress for that invasion of her personal data, on August 13, 2019, Bryant brought a putative class action against Compass in the Circuit Court of Cook County, pursuant to BIPA's provision providing a private right of action in state court to persons "aggrieved" by a violation of the statute. See 740 ILCS 14/20 ; Rosenbach v. Six Flags Entm't Corp., 432 Ill. Dec. 654, 129 N.E.3d 1197 (Ill. 2019). Bryant seeks to represent a class of Illinois citizens who used Compass's Smart Market biometric-enabled vending machines after August 2014. She alleges that Compass violated her and class members' statutory rights under BIPA when it collected users' fingerprints without first making the required written disclosures about use and retention and without written authorization. See 740 ILCS 14/15(a) – (b). For purposes of the standing issue before us, we accept Bryant's allegations as true.

Compass removed the action to federal court under the Class Action Fairness Act (CAFA), 28 U.S.C. § 1332(d), on the basis of diversity of citizenship and an amount in controversy exceeding $5 million. Compass is incorporated in Delaware and has its principal place of business in North Carolina; Bryant is a citizen of Illinois. This is enough to assure the minimal diversity required by CAFA. The requisite amount in controversy is also secure: claims of individual class members are aggregated for purposes of CAFA, see 28 U.S.C. § 1332(d)(6), and here, BIPA authorizes statutory damages of $5,000 for each intentional or reckless violation. 740 ILCS 14/20(1) – (2). Compass asserts, and Bryant does not contest, that the alleged class has at least 1,000 members.

Bryant moved to remand the action to the state court, claiming that the district court did not have subject-matter jurisdiction because she lacked the concrete injury-in-fact necessary to satisfy the federal requirement for Article III standing. (State law apparently poses no such problem, we note, as the Illinois Supreme Court pointed out in Rosenbach. )

The district court found that Compass's alleged violations of sections 15(a) and (b) were bare procedural violations that caused no concrete harm to Bryant; accordingly, it remanded the action to the state court. Compass petitioned this court for permission to appeal the remand order under 28 U.S.C. § 1453(c) ; on March 13, 2020, we accepted the appeal.

II

A

As the party invoking federal jurisdiction, Compass bears the burden of establishing Bryant's Article III standing. See Collier v. SP Plus Corp. , 889 F.3d 894, 896 (7th Cir. 2018) (per curiam ). This fact has occasioned a role reversal in the arguments we normally see in these cases, with the defendant insisting that Article III standing is solid, and the plaintiff casting doubt on it.

For Bryant to have Article III standing, three requirements must be satisfied: (1) she must have suffered an actual or imminent, concrete and particularized injury-in-fact; (2) there must be a causal connection between her injury and the conduct complained of; and (3) there must be a likelihood that this injury will be redressed by a favorable decision. Lujan v. Defs. of Wildlife , 504 U.S. 555, 560–61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). Only the first of those criteria is at issue here: any injury she suffered was caused directly by Compass's failure to comply with BIPA, and the prospect of statutory damages shows that such an injury is redressable.

In Spokeo , the Supreme Court explained that a "concrete" injury must actually exist but need not be tangible. 136 S. Ct. at 1548–49. A legislature may "elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law." Id. (quoting Lujan , 504 U.S. at 578, 112 S.Ct. 2130 ). But "a bare procedural violation, divorced from any concrete harm," does not "satisfy the injury-in-fact requirement of Article III." Id. "Instead, the plaintiff must show that the statutory violation presented an ‘appreciable risk of harm’ to the underlying concrete interest that [the legislature] sought to protect by enacting the statute." Groshek v. Time Warner Cable, Inc. , 865 F.3d 884, 887 (7th Cir. 2017) (quoting Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 (7th Cir. 2016) ).

Compass urges that BIPA has elevated to protectible status a person's inherent right to control her own body, including the associated biometric identifiers and information. The violation or trespass upon that right, it reasons, is a concrete injury-in-fact for standing purposes. Compass relies on the Illinois Supreme Court's recent decision in Rosenbach , in which that court decided who qualifies as an "aggrieved" person for purposes of a state-court action pursuant to BIPA. The state supreme court had no cause to consider Article III standing requirements, but Compass argues that its conclusions about the interests BIPA was intended to protect nonetheless shed light on the question before us.

In Rosenbach , the plaintiff alleged that defendant Six Flags violated the procedures spelled out in section 15(b). 432 Ill. Dec. at 658–59, 129 N.E.3d 1197. Six Flags argued that the plaintiff had to allege more in order to pursue her action—some tangible injury or harm. Id. at 659, 129 N.E.3d 1197. The Illinois appellate court agreed with that contention, but the Illinois Supreme Court reversed, explaining that it is the well-established understanding in Illinois that "a person is prejudiced or aggrieved, in the legal sense, when a legal right is invaded by the act complained of or his pecuniary interest is directly affected by the decree or judgment." Id. at 662, 129 N.E.3d 1197 (internal citation and quotation marks omitted). Because section 15(b) of BIPA confers a right to receive certain information from an entity that collects, stores, or uses a person's biometric information, the violation of that right, standing alone, is an actionable grievance. Id. at 663, 129 N.E.3d 1197.

Compass highlights the fact that the Illinois Supreme...