Introduction

There is never a convenient time for a person’s credit card to get stolen; victims of credit card theft must scramble to cancel old cards and then update recurring payments with a new card. However, imagine the damage that would be caused by a thief stealing the fingerprints or the facial geometry of a victim. Unlike a credit card, these identifiers are unique to the victim and cannot be replaced.¹740 Ill. Comp. Stat. Ann. 14/5(c) (West 2008); see also Theodore Z. Wyman, Cause of Action for Wrongful Collection or Disclosure of Consumer Biometric Information, in 98 Causes of Action 2d 297 (2022). Fingerprints, like facial geometry, are referred to as biometric information.²740 Ill. Comp. Stat. Ann. 14/10 (West 2008). Biometric information consists of the biometric identifiers “used to identify an individual,” and this includes scans of the eye, facial geometry, fingerprints, voiceprints, and handprints.³Id.

The collection of biometric identifiers has quickly become the norm.⁴See 9 Industries Biometrics Technology Could Transform, CB Insights (Dec. 12, 2019), https://perma.cc/HR59-BX5M (discussing biometric implementation across various industries). For example, fingerprints and facial geometry are often used to unlock smartphones.⁵See Hannah Zimmerman, Comment, The Data of You: Regulating Private Industry’s Collection of Biometric Information, 66 U. Kan. L. Rev. 637, 637 (2018). In the automotive industry, Hyundai released a car that uses fingerprint scans to start the car,⁶9 Industries Biometrics Technology Could Transform, supra note 4. while in the banking industry biometric passwords are used to impede fraud.⁷Id. Even the makeup industry implements facial recognition technology—Ulta Beauty’s GLAMlab virtual makeup application uses consumers’ facial geometry to display what their faces would look like with virtual make-up applied.⁸Terms & Conditions, Ulta Beauty (Mar. 23, 2021), https://perma.cc/RTY7-7UG8.

Illinois was the first state to address unlawful biometric collection by passing the Biometric Information Privacy Act (“BIPA”).⁹Gerald D. Peake, 1 Data Security and Privacy Law § 7:17, Westlaw (database updated Sept. 2021). BIPA regulates the retention, collection, disclosure, and destruction of biometric information.¹⁰740 Ill. Comp. Stat. Ann. 14/15(a) (West 2008). BIPA also provides a private right of action against private actors for those aggrieved by a violation.¹¹740 Ill. Comp. Stat. Ann. 14/20 (West 2008). While Illinois was the first state to pass a statute regulating biometric information collection by private entities, Illinois is not the only state to have done so.¹²See N.Y.C., N.Y., Admin. Code § 22-1201 (2022) (similar New York City statute); Tex. Bus. & Com. Code Ann. § 503.001 (2009) (similar Texas statute).

Illinois’s BIPA lists the following ways that a private entity can violate consumers’ statutory rights: section 15(a), failing to “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers . . . when the initial purpose for collecting or obtaining such identifiers . . . has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first”; section 15(b), collecting biometric information without consumer knowledge or consent; section 15(c), profiting from consumers’ biometric information; section 15(d), disclosing consumer biometric information in ways not authorized; or section 15(e), failing to use reasonable care.¹³740 Ill. Comp. Stat. Ann. 14/15 (West 2008).

When a company violates a section of BIPA, the harm is typically widespread.¹⁴See Charles N. Insler, Understanding the Biometric Information Privacy Act Litigation Explosion, 106 Ill. B.J. 34, 36 (2018). As an example, some companies have integrated their timekeeping systems with biometric collection technology.¹⁵Seeid. Under BIPA, when a company collects its employees’ biometric identifiers to track how many hours they worked but fails to comply with a retention schedule, every employee is injured.¹⁶See Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1156 (7th Cir. 2020). Moreover, suppose that a company implemented facial recognition software that collects its customers’ biometric information to increase convenience or to personalize the customer’s experience. If the company did so without consent, then every customer would have a cause of action under BIPA.¹⁷740 Ill. Comp. Stat. Ann. 14/20 (West 2008). Consequently, the ability to bring a BIPA claim as a class action significantly increases the potential recoverable damages.¹⁸Insler, supra note 14, at 36. In state courts, a consumer is aggrieved by a violation of any of the statutory rights granted to them under BIPA.¹⁹Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1207 (Ill. 2019). Yet, in federal courts, a statutory violation alone is not sufficient injury in fact under Article III of the U.S. Constitution.²⁰See Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016); TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2200 (2021).

Under the Class Action Fairness Act (“CAFA”), class actions can be brought in federal courts when the following requirements are met: (1) there are at least 100 putative class members; (2) there is at least $5,000,000 in controversy; and (3) at least one member of the class is a citizen of a state different than the state of the defendant.²¹28 U.S.C. § 1332. As a result of CAFA, defendants can more easily remove BIPA class action lawsuits to federal court.²²Thomas J. Cunningham, The In-House Legal Professional’s Guide to Removing Cases to Federal Court—A Checklist, Locke Lord Bissell & Liddell LLP, at 12 (Sept. 25, 2022),
https://perma.cc/7SDD-ZLDS. Federal courts are often desired by defendants for a variety of reasons, including more experienced judges, a more defendant-friendly jury pool than in state courts, and “[i]n class action litigation, the availability of interlocutory review of class certification orders.”²³Id. at 6. Moreover, once in federal court, defendants can move for dismissal since plaintiffs now have to establish Article III standing.²⁴See id. at 5 (for lacking jurisdiction). In contrast, plaintiffs usually prefer to stay in state court because there is no Article III standing requirements,²⁵See Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1207 (Ill. 2019); Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 622 (7th Cir. 2020) (“[S]tanding requirements in Illinois courts are more lenient than those imposed by Article III.”). and state courts tend to be more favorable to the plaintiff compared to the usual defendant for BIPA cases—corporations.²⁶Cunningham, supra note 22, at 9. Yet, there are also reasons class action plaintiffs might desire to remain in federal court. While the standing requirements may be more lenient in state court, a BIPA class action can benefit from remaining in federal court.²⁷Ian C. Ballon, 3 E-Commerce and Internet Law § 27.07, Westlaw (database updated Apr. 2020). In federal court, “certification of potentially larger national class actions” are possible.²⁸Id. When a class is large, defendants risk incurring a significant cost in defending against the suit and receiving negative attention from the public.²⁹Id. Consequently, defendants may be more inclined to settle the claim than face these risks.³⁰Id. Larger class actions may also prompt a higher value settlement which again benefits plaintiff class members in federal courts.³¹Id.

In 2016, the U.S. Supreme Court held that a statutory violation alone does not confer Article III standing—there still must be concrete harm.³²See Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016). In every case, justiciability must be determined before a judge can rule on the merits of the case.³³See, e.g., N.H. Right to Life PAC v. Gardner, 99 F.3d 8, 12 (1st Cir. 1996). There are no exceptions, and even in class actions, each member must have standing.³⁴Rivera v. Wyeth-Ayerst Lab’ys, 283 F.3d 315, 318–19 (5th Cir. 2002). In 2021, the Supreme Court’s decision in TransUnion LLC v. Ramirez³⁵141 S. Ct. 2190 (2021). added to the holding of Spokeo, Inc. v. Robins³⁶578 U.S. 330 (2016). in the class-action context.³⁷TransUnion, LLC, 141 S. Ct. at 2200. In TransUnion, a class of consumers that all received misleading alerts in their credit files brought suit under the Fair Credit Reporting Act (“FCRA”) alleging a statutory violation.³⁸Id. However, the Court held that only the class members whose inaccurate credit files were also given to third parties suffered concrete harm.³⁹Id. at 2212–13. The decision in both Spokeo and TransUnion means that all class members must have a concrete injury caused by the defendant’s statutory violation, and in the context of TransUnion, the mere risk of future harm from inaccurate information dissemination is not sufficient injury in fact despite the FCRA statutory violation.⁴⁰Id. at 2210–12. However, the Court left open the possibility that an intangible “informational injury” can be concrete.⁴¹Id. at 2214 (discussing that although an informational injury can be concrete, here plaintiffs failed to allege any adverse effects). According to the majority’s reasoning in TransUnion and Spokeo, intangible harms are more likely to be concrete when they have a “close historical or common‑law analogue.”⁴²TransUnion, 141 S. Ct. at 2204; Spokeo, Inc. v. Robins 578 U.S. 330, 341–42 (2016). In TransUnion, the alleged injury caused by the dissemination of inaccurate information to third parties was analogized to injury caused by defamation.⁴³TransUnion, 141 S. Ct. at 2209. Although TransUnion clarified that each class member must have a concrete harm, the question remains as to whether failing to publish a retention schedule or profiting off another individual’s biometric information, both arguably procedural BIPA violations, gives standing to absent class members.⁴⁴Id. at 2208 n.4 (declining to address this question).

Part I provides relevant background to the controversy. It discusses the characteristics of biometric identifiers, and the consequences that may follow from the regular use of these identifiers. Additionally, Part I includes a short examination of other states with laws similar to Illinois’s BIPA. This Part subsequently looks at how the standing inquiry differs between state and federal courts. Then, Part I examines possible common-law causes of actions that can serve as an analogue for the harm caused by a BIPA violation. Additionally, this Part assesses whether each of the statutory violations are currently viewed as creating concrete or procedural injury. This Part will also lay out the typical obstacles for class certification in biometric-related litigation. Finally, this Part will conclude with a brief purview of the most relevant BIPA cases so far.

Part II proposes a two-tiered analysis to assess Article III standing for class-action lawsuits alleging a violation of a state’s biometric privacy statute. Using Illinois’s BIPA as a model, the first tier assesses violations of section 15(b), (d), and (e) of BIPA through analogizing a biometric injury to an injury akin to an invasion of privacy. Under the second tier, violations of section 15(a) and (c) are assessed through a common-law analogue of conversion.

Part III demonstrates an application of this framework to cases post-TransUnion. The benefits of this framework are discussed in detail as well as possible issues that might arise. Lastly, Part IV contains concluding remarks.

I.     Background of Biometric Identifiers and the Law

Biometric identifiers cannot be “forgotten, lost, or forged.”⁴⁵Wyman, supra note 1. Moreover, biometric information tends to be inalterable.⁴⁶Bilal Adra, Note, Facing the Facts on Biometric Phone Locks: Your Face and Thumb Are Not Secure, 2018 U. Ill. J.L. Tech. & Pol’y 407, 410 (2018). For example, an individual’s fingerprints remain the same throughout life.⁴⁷Id. Due to the permanence of biometric identifiers, problems may arise when they are disseminated to others.⁴⁸Id. at 411–12. Thus, while the potential for biometric information to increase an industry’s efficacy or enhance convenience for consumers, some industries take the use of biometrics too far.⁴⁹See, e.g., Nicholas Iovino, Judge Approves Historic $650M Facebook Privacy Settlement, Courthouse News Service (Feb. 26, 2021), https://perma.cc/GW8A-LJ6X.

Recently, Facebook, Inc. settled for $650 million in a biometric‑related lawsuit that alleged Facebook collected social media users’ facial geometries.⁵⁰Id. In the case Patel v. Facebook, Inc.,⁵¹932 F.3d 1264 (9th Cir. 2019). the Ninth Circuit determined that a BIPA violation is sufficient injury for standing because it affects a person’s “concrete right to privacy.”⁵²Id. at 1267. Plaintiffs—social media users—alleged that Facebook’s feature “Tag Suggestions” improperly collected facial geometric information.⁵³Id. at 1268. When a user uploads a photo to Facebook, Tag Suggestions utilizes facial recognition technology to scan the photo. If a face is detected, Tag Suggestions compares the detected face to other faces stored in Facebook’s large database.⁵⁴Id. Once a match is found, Facebook allows users to add a tag to their pictures that indicates the name of the other person in the photo.⁵⁵Id. The Ninth Circuit noted that Facebook’s facial recognition technology creates possible far-reaching consequences that extend beyond just the social media platform.⁵⁶Id. at 1273. For instance, the court stated that “it seems likely that a face‑mapped individual could be identified from a surveillance photo taken on the streets or in an office building. Or a biometric face template could be used to unlock the face recognition lock on that individual’s cell phone.”⁵⁷Patel, 932 F.3d at 1273. Consequently, the collection of users’ facial geometry data without user consent is an invasion of the users’ concrete right to privacy.⁵⁸Id. Moreover, the court viewed Facebook’s retention of users’ biometric information without a published retention and deletion schedule as a violation of “substantive privacy interests.”⁵⁹Id. at 1274. Facebook’s settlement constitutes “one of the largest privacy-related settlements in U.S. history.”⁶⁰Id. (finding a violation of section 15(a); “[T]he procedural protections in BIPA ‘are particularly crucial in our digital world’ because ‘[w]hen a private entity fails to adhere to the statutory procedures . . . the right of the individual to maintain his or her biometric privacy vanishes into thin air.’”); Iovino, supra note 49.

Additionally, although this Comment will focus primarily on Illinois, other states have passed similar biometric acts such as Texas and Washington.⁶¹Tex. Bus. & Com. Code Ann. § 503.001 (2009); H.B. 1493, 65th Leg., Reg. Sess. (Wash. 2017). Texas’s biometric law prohibits both the commercial collection and the nonconsensual sale of another person’s biometric data.⁶²§ 503.001. The act also requires those possessing biometric data to use reasonable care and to destroy the data within a reasonable amount of time.⁶³Id. While similar to Illinois’s BIPA, Texas’s act lacks a private cause of action; rather, enforcement is left to the attorney general.⁶⁴Id. Similarly, Washington’s biometric act includes largely the same requirements and prohibitions as the Texas biometric act; however, Washington’s act differs by equating a statutory biometric violation to a deceptive business practice.⁶⁵Wash. H.B. 1493 (“[F]or the purpose of applying the consumer protection act . . . .”). Moreover, both Illinois’s BIPA and Washington’s biometric act include a statement explaining why the requirements and prohibitions are necessary.⁶⁶Id.; 740 Ill. Comp. Stat. Ann. 14/5 (West 2008). BIPA includes a section explaining that the public is benefitted by regulating the use of biometric information.⁶⁷740 Ill. Comp. Stat. Ann. 14/5 (“The public welfare, security, and safety will be served by regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.”). Likewise, Washington’s biometric act includes a section on legislative findings, stating that “[t]he legislature finds that citizens of Washington are increasingly asked to disclose sensitive biological information that uniquely identifies them for commerce, security, and convenience. The collection and marketing of biometric information about individuals, without consent or knowledge of the individual whose data is collected, is of increasing concern.”⁶⁸Wash. H.B. 1493. While not as comprehensive, other states have updated the definition of personal information to include biometric data as well.⁶⁹Zimmerman, supra note 5, at 648 (including “Connecticut, Iowa, Nebraska, North Carolina, Oregon, Wisconsin, and Wyoming”).

A.     Standing and Biometric Information

For a federal court to have jurisdiction over a biometric violation suit, the plaintiff must have standing.⁷⁰Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992). Article III of the U.S. Constitution requires a party to show “(1) that he or she suffered an injury in fact that is concrete, particularized, and actual or imminent, (2) that the injury was caused by the defendant, and (3) that the injury would likely be redressed by the requested judicial relief.”⁷¹Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1244 (7th Cir. 2021) (quoting Thole v. U.S. Bank N.A., 140 S. Ct. 1615, 1618 (2020)). Not all injuries must be tangible to be sufficient for Article III standing.⁷²TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2204 (2021). The TransUnion Court stated “[v]arious intangible harms can also be concrete,” including “reputational harms, disclosure of private information, and intrusion upon seclusion. . . [a]nd . . . harms specified by the Constitution itself.”⁷³Id. Moreover, according to the Spokeo Court, risk of harm from an intangible injury may be sufficient for standing.⁷⁴Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016) (citing Clapper v. Amnesty Int’l. USA, 568 U.S. 398, 410 (2013)). The Court cited Clapper v. Amnesty Int’l USA⁷⁵568 U.S. 398 (2013). where the Court ruled that plaintiff organizations lacked standing for their First Amendment pre-enforcement challenge to a statute allowing the government to surveil non-citizens because the risk of harm was only speculative.⁷⁶Id. at 401, 410; see also Spokeo, 578 U.S. at 342 (citing Fed. Election Comm’n v. Akins, 524 U.S. 11, 20­–25 (1998)) (“[T]he violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact. . . . [A] plaintiff in such a case need not allege any additional harm beyond the one Congress has identified.”). Although risk of future harm was insufficient for standing in TransUnion as well, the TransUnion Court distinguished Clapper because the relief sought was injunctive, not damages.⁷⁷TransUnion, 141 S. Ct. at 2210 (“As this Court has recognized, a person exposed to a risk of future harm may pursue forward-looking, injunctive relief to prevent the harm from occurring, at least so long as the risk of harm is sufficiently imminent and substantial.”. As such, the Court did not foreclose the possibility that risk of future harm can be sufficiently material for standing, and the Court’s decision does not affect recovery of damages when the harm is present rather than a future risk.⁷⁸Id. at 2212 (“[P]laintiffs did not factually establish a sufficient risk of future harm to support Article III standing.”.

  1.     Statutory Biometric Violations as an Intangible Injury

Injury from a biometric statutory violation is commonly conceptualized as intangible. Under the framework established by Spokeo, such an injury must be analogized to a harm recognized at common law.⁷⁹Spokeo, 578 U.S. at 340–42. A typical analogy is a comparison to invasion of privacy.⁸⁰See, e.g., Patel v. Facebook, Inc., 932 F.3d 1264, 1272 (9th Cir. 2019). Generally, an invasion of privacy falls within one of the following four categories: “(1) unreasonable intrusion upon the seclusion of another; (2) appropriation of the other’s name or likeness; (3) unreasonable publicity given to the other’s private life; and (4) publicity that unreasonably places the other in a false light before the public.”⁸¹Wyman, supra note 1. When a biometric statutory violation is compared to an unreasonable intrusion upon seclusion, the focus is on “an intentional interference with a person’s interest in solicitude or seclusion.”⁸²Id.; Allen v. Verizon Wireless, No. 12-CV-482, 2013 WL 2467923, at *7 (D. Conn. June 6, 2013). A violation of an individual’s right of publicity serves as another common law analogue to the harm caused by a statutory biometric violation.⁸³Lisa Raimondi, Note, Biometric Data Regulation and the Right of Publicity: A Path to Regaining Autonomy Over Our Commodified Identity, 16 U. Mass. L. Rev. 198, 219 (2021). A right to publicity refers to a person’s “property right in their name and likeness.”⁸⁴Id. at 213. As applied to biometrics, Lisa Raimondi tweaks this analogy by uniting the rights associated with one’s identity with the rights of self-ownership.⁸⁵Id. at 218–20. Where the violation concerns a sale of biometric information, it implies a misappropriation of someone’s commercial opportunity.⁸⁶Id. at 220–24. However, the problem with this conceptualization of injury from biometric statutory violations is that, at least under BIPA, it is inapplicable for purely procedural violations like section 15(a) given that no sale has occurred or benefit misappropriated.⁸⁷See id.(discussing right of publicity).

Also, another common perspective is that an individual should have property rights in their biometric information.⁸⁸Alessandra Masciandaro, Comment, Cleaning-Up After Carpenter: Personal Data as Property Under the Fourth Amendment, 51 Seton Hall L. Rev. 1241, 1262–63 (2021). Alessandra Masciandaro advances the concept of property rights in one’s personal data, distinguishing a property right from a privacy right with the former including the power to exclude others from their property.⁸⁹Id. Conceptually, she formulates a definition of personal data that encompasses “objects that exist independently of a person’s volition.”⁹⁰Id. at 1271. Consequently, biometric information would constitute personal data.⁹¹Id. However, as a form of property, the remedy for a biometric statutory violations would likely be an injunction, rather than damages for a privacy injury.⁹²Id. at 1274; see infra note 271.

An injury, whether tangible or intangible, must be concrete and particularized to the individual plaintiff.⁹³Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1152 (7th Cir. 2020); Spokeo, Inc. v. Robins, 578 U.S. 330, 339 (2016). By the plain text of BIPA, anyone “aggrieved” under the statute has standing—even for procedural harm.⁹⁴740 Ill. Comp. Stat. Ann. 14/20 (West 2008); Wyman, supra note 1. Thus, any of the five statutory prohibitions under BIPA is sufficient to “aggrieve” a party.⁹⁵740 Ill. Comp. Stat. Ann. 14/20. However, this is true only for cases brought at the state level; at the federal level, not all statutory violations are sufficient for standing.⁹⁶TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203 (2021) (“Under Article III, federal courts do not adjudicate hypothetical or abstract disputes.”); Spokeo, 578 U.S. at 338. There must be a concrete injury that is particular to the plaintiff; thus, sufficient injury for standing is dependent on whether a violation is purely procedural or substantive.⁹⁷See, e.g., Patel v. Facebook, Inc., 932 F.3d 1264, 1274 (9th Cir. 2019) (“Because the privacy right protected by BIPA is the right not to be subject to the collection and use of such biometric data, Facebook’s alleged violation of these statutory requirements would necessarily violate the plaintiffs’ substantive privacy interests.”). A violation of a procedural right does not cause injury by itself, harm must be shown to a plaintiff’s concrete interests.⁹⁸Id. at 1270–71.

a.     Procedural and Substantive BIPA Violations

There are five statutory BIPA requirements or prohibitions; however, not every violation results in concrete injury.⁹⁹Id. First, a violation of section 15(a) is generally viewed as a procedural violation.¹⁰⁰Kloss v. Acuant, Inc., 462 F. Supp. 3d 873, 875–76 (N.D. Ill. 2020); Wyman, supra note 1. In this context, failure to publish retention schedules and deletion guidelines does not create concrete injury.¹⁰¹Kloss, 462 F. Supp. at 875–76 (holding that a section 15(a) violation is not an individual or concrete harm because the duty to publish a retention schedule and guidelines is owed to the public). However, this view is not shared uniformly by the courts.¹⁰²Compare Hazlitt v. Apple Inc., 543 F. Supp. 3d 643, 649 (S.D. Ill. 2021) (“[T]he allegation that Apple has failed to follow a policy for retaining and destroying Plaintiffs’ biometric identifiers and information is enough to establish Article III standing for Plaintiffs’ § 15(a) claim.”) with Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020) (denying standing for plaintiff’s section 15(a) claim where no additional harm was alleged). Second, under section 15(b), concrete injury exists when there is collection of another person’s biometric information without informed consent.¹⁰³Bryant, 958 F.3d at 626–27 (reversing summary judgment for defendant where a company’s failure to obtain consent prior to biometric collection “inflicted the concrete injury BIPA intended to protect against, i.e. a consumer’s loss of the power and ability to make informed decisions”); 740 Ill. Comp. Stat. Ann. 14/15(b) (West 2008) (stating that information regarding the purpose or timeframe for the collected biometric information must be conveyed to the owner of the biometrics prior to biometric collection). But see Figueroa v. Kronos Inc., 454 F. Supp. 3d 772, 780–81 (N.D. Ill. 2020) (distinguishing a complete failure to disclose the purpose and timeframe of collection from an incomplete disclosure, with the latter being only a procedural violation). Third, a section 15(c) violation is viewed as akin to a violation of section 15(a)—sale of biometric information requires specific harm to constitute sufficient injury for standing since this regulation is viewed as a duty owed to the public generally.¹⁰⁴Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1247 (7th Cir. 2021) (“[Section 15(c)] is the same kind of general regulation as the duty to create and publish a retention and destruction schedule found in § 15(a), at least when the plaintiff asserts no particularized injury resulting from the commercial transaction.”); see also Hazlitt, 543 F. Supp. 3d, at 651–52 (holding that despite Apple profiting off its facial recognition devices, plaintiffs did not have standing because no specific harm was alleged). Fourth, a section 15(d) violation occurs when there is unauthorized disclosure of a person’s biometrics to a third party.¹⁰⁵740 Ill. Comp. Stat. Ann. 14/15(d) (West 2008). When this occurs, the harm is concrete.¹⁰⁶Cothron v. White Castle Sys., Inc., 467 F. Supp. 3d 604, 613 (N.D. Ill. 2020) (finding that a violation of section 15(d) is concrete because it deprives a consumer of the “opportunity to object to the way her data was being handled or to opt out of the system entirely”). Fifth, under section 15(e), failure to use reasonable care in the collection, storage, and transmission of a person’s biometric information creates concrete harm.¹⁰⁷Roberson v. Maestro Consulting Servs. LLC, 507 F. Supp. 3d 998, 1010 (S.D. Ill. 2020) (holding that an employer’s failure to use reasonable care with an employee’s biometric information collected for time-keeping purposes creates a concrete injury analogous to unlawful retention).

b.     Statutory BIPA Violations Brought as a Class Action

When a suit alleging a statutory BIPA violation is brought as a class action, the distinction between procedural and substantive BIPA violations adds an additional layer of complexity to the standing inquiry. There are several prerequisites for a representative party to sue on behalf of others in a class action.¹⁰⁸Fed. R. Civ. P. 23(a). Class actions requires that

(1) the class is so numerous that joinder of all members is impracticable; (2) there are questions of law or fact common to the class; (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and (4) the representative parties will fairly and adequately protect the interests of the class.¹⁰⁹Id.

Parties must also show either that a class action is the superior method given inconsistencies if individual adjudications were undertaken instead; that adjudication would be applicable to the common harm suffered by the class; or that there are not issues pertaining to individuals rather than the class as a whole, and that the class action is more efficient than any alternative.¹¹⁰Fed. R. Civ. P. 23(b). There is no bright line rule on whether “a proposed class definition sweeps too broadly by including persons who could not have been injured by defendant’s conduct.”¹¹¹1 Joseph M. McLaughlin, McLaughlin on Class Actions § 4.28 (18th ed. 2021). Rather, whether a class definition is overbroad “is a matter of degree that turns on the facts and circumstances of the case.”¹¹²Id.

The breadth of the class definition matters because in Spokeo, the Court held that procedural violations are insufficient, without more, to satisfy standing, and TransUnion added that even absent class members need to demonstrate standing before relief is given.¹¹³TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2208 (2021); Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016). The TransUnion Court also questioned whether only the representative class member must have standing prior to class certification or whether all plaintiffs are required to show standing.¹¹⁴TransUnion, 141 S. Ct. at 2208 n.4. Thus, breadth of the class definition is a pivotal determination to the action’s success since members of the class must share a common injury.¹¹⁵Id. at 2214 (stating that class members whose biometrics were not disseminated to a third party lacked standing while those whose biometrics were disseminated had standing; class definition was overbroad as it included uninjured members).

i.     Class Certification

Because federal courts are only empowered to decide on the merits in cases where plaintiffs suffered a concrete injury, standing at the class certification stage may prove difficult to satisfy if required for absent class members.¹¹⁶Spokeo, 578 U.S. at 341. For example, “[i]n a product defect case . . . even if the product is proven to be defective, the defect might not affect 100% of the units sold.”¹¹⁷William B. Rubenstein, 1 Newberg on Class Actions § 2:3 (6th ed. 2022). Similarly, for a violation of section 15(b) of BIPA, a class representative may show concrete injury from the unauthorized biometric collection while other absent class members are unable.¹¹⁸See id. Since the TransUnion Court declined to answer when absent class members must show standing,¹¹⁹TransUnion, 141 S. Ct. at 2208 n.4. standing for class certification is determined circuit by circuit. The Third, Fifth, Seventh, and Ninth Circuits generally hold that putative absent class members do not need to show sufficient injury prior to class certification.¹²⁰See Neale v. Volvo Cars of N. Am., LLC, 794 F.3d 353, 362 (3d Cir. 2015); Mims v. Stewart Title Guar. Co., 590 F.3d 298, 308 (5th Cir. 2009) (“Class certification is not precluded simply because a class may include persons who have not been injured by the defendant’s conduct.”); Kohen v. Pac. Inv. Mgmt. Co. LLC, 571 F.3d 672, 676 (7th Cir. 2009); Bates v. United Parcel Serv., Inc., 511 F.3d 974, 985 (9th Cir. 2007). Conversely, the Second, Eighth, and D.C. Circuits tend to require each class member to have standing before certification.¹²¹Denney v. Deutsche Bank AG, 443 F.3d 253, 264 (2d Cir. 2006) (stating that while no specific proof is needed, “[t]he class must therefore be defined in such a way that anyone within it would have standing”); Halvorson v. Auto-Owners Ins. Co., 718 F.3d 773, 779–80 (8th Cir. 2013); In re Rail Freight Fuel Surcharge Antitrust Litig.-MDL No. 1869, 725 F.3d 244, 252 (D.C. Cir. 2013) (declaring that class certification necessitates “common evidence [that] show[s] all class members suffered some injury”).

ii.     Class Actions and the Constitution

The interaction between class actions and Article III might be one of conflict. Peter Ormerod notes that there is an incentive for a class to forgo alleging specific facts pertaining to each member’s injury since a class with too many individualized injuries will not be certified.¹²²Fed. R. Civ. P. 23(a)(2); see Peter C. Ormerod, Privacy Injuries and Article III Concreteness, 48 Fla. St. U. L. Rev. 133, 161 (2020). However, Article III operates as a barrier in this context because a lack of specificity affects whether an injury is sufficiently concrete for standing.¹²³Ormerod, supra note 121. Tensions are even more pronounced when the standing inquiry comes prior to class certification because the injury must be alleged with enough specificity to show standing for all class members, absent or not, while also not too specific as to preclude certification due to a lack of commonality.¹²⁴Id. Peter Ormerod goes on to propose an approach where “a court should give effect to Congress’s policy choices.”¹²⁵Id. at 169. This approach would provide federal jurisdiction for statutory violations.¹²⁶Id. at 182 (providing federal jurisdiction over “claims arising from legislatively authorized enforcement of digitally- and algorithmically-enabled privacy injuries”).

Another view of this interplay is that courts are primarily concerned over class definition when they examine absent class members for standing.¹²⁷Rubenstein, supra note 116. Consequently, the standing inquiry is more of a question as to whether Rule 23 is satisfied because “[w]hile Article III requires an ‘injury in fact,’ . . . ‘[f]or purposes of determining standing, [the court] must accept as true all material allegations of the complaint.’”¹²⁸In re Elec. Books Antitrust Litig., No. 11 MD 2293 DLC, 2014 WL 1641699, at *8 (S.D.N.Y. Apr. 24, 2014) (quoting Denney v. Deutsche Bank AG, 443 F.3d 253, 263 (2d Cir. 2006)); see Rubenstein, supra note 116. At the class certification stage, the court’s interest is in whether the class contains individuals who are incapable of showing injury; thus, whether an absent class member is injured should be viewed in relation to Rule 23, not Article III standing.¹²⁹Rubenstein, supra note 116. This view recognizes that “unlike the abstract and often politicized nature of standing decisions, class certification focuses a court on pragmatic factors in a familiar and accessible manner.”¹³⁰Id.

2.     Major BIPA Cases

This Section will examine some of the major BIPA cases to provide a general understanding of the state of BIPA litigation. However, these cases were all decided prior to the Supreme Court’s most recent decision in TransUnion. Thus, while still good law, these cases might be decided differently today given the decision in TransUnion that all class members must have a concrete injury.¹³¹TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2212–13 (2021).

a.     Illinois Appellate Court Case

In Rosenbach v. Six Flags Entertainment Corp.,¹³²129 N.E.3d 1197 (Ill. 2019). amusement park visitors brought a class action against the defendant amusement park company alleging that in violation of BIPA, Six Flags collected visitors’ fingerprints without informed consent.¹³³Id. at 1200–01. The park utilized a system of fingerprint verification to confirm the identity of visitors who purchased “repeat-entry passes to the park.”¹³⁴Id. While Six Flags acknowledged its BIPA violation, it claimed that there was no concrete injury and therefore, no liability.¹³⁵Id. at 1204. In holding for plaintiff visitors, the court concluded that limiting recovery under BIPA to only concrete injuries “would require that [the court] disregard the commonly understood and accepted meaning of the term ‘aggrieved,’ . . . and interpret the law in a way that is inconsistent with the objectives and purposes the legislature sought to achieve.”¹³⁶Id. at 1207. Thus, under Illinois law, any BIPA statutory violation is recoverable even sans specific harm.¹³⁷Id. This is not the case in federal court.

b.     Federal Appellate Court Cases

In Bryant v. Compass Group USA, Inc.,¹³⁸958 F.3d 617 (7th Cir. 2020). employees brought a class action lawsuit against a vending machine company alleging both a section 15(a) and section 15(b) BIPA violation after the employees’ company placed defendant’s vending machines in the workplace.¹³⁹Id. at 619–20. To use the vending machines, employees were required to scan their fingerprints.¹⁴⁰Id. at 619. Here, the Seventh Circuit Court of Appeals held that the collection of the employees’ fingerprints without consent was sufficient injury for standing because it was “an invasion of [their] private domain, much like an act of trespass would be.”¹⁴¹Id. at 624. The court noted the distinct characteristics of biometric data and acknowledged that a section 15(b) violation is not simply procedural; rather, it is a substantive violation.¹⁴²Id. The employees were deprived of the ability to make an informed decision as to the disclosure of their unique biometric identifiers.¹⁴³Id. at 626. As for the employees’ claim of a section 15(a) violation, the court distinguished the employees’ claim that defendant company failed to publish a retention schedule from a claim that it failed to comply with said retention schedule; the former being a duty “owed to the public generally” and thus not sufficient for standing sans concrete harm.¹⁴⁴Bryant, 958 F.3d at 626.

The Seventh Circuit dealt with the latter claim—whether failure to comply with a retention schedule created sufficient injury for standing—in Fox v. Dakkota Integrated Systems.¹⁴⁵980 F.3d 1146, 1149 (7th Cir. 2020). Similar to Bryant, plaintiff employees alleged that their employer collected their handprints to keep track of the hours each employee spent working.¹⁴⁶Id. The court held that “an unlawful retention of a person’s biometric data is as concrete and particularized an injury as an unlawful collection of a person’s biometric data.”¹⁴⁷Id. at 1155. Thus, the court reversed the district court’s decision to remand the case to state court.¹⁴⁸Id. at 1156.

Moreover, in Thornley v. Clearview AI, Inc.,¹⁴⁹984 F.3d 1241 (7th Cir. 2021). plaintiffs alleged that defendant company Clearview violated section 15(c) of BIPA when it collected facial geometric data from pictures on various sites online to store in a database.¹⁵⁰Id. at 1246 (alleging that Clearview profited from the social media website users’ biometric identifiers). For a fee, the company provides database access to people who wish to find out information on the people that appear in the stored photo.¹⁵¹Id. at 1243. Once a user uploads a photo, Clearview compares the facial geometry of the person in the photo with pictures in its database and informs the user where the other picture originated.¹⁵²Id. In a major role reversal, plaintiffs claimed that Clearview did not injure them in a way sufficient for standing while Clearview argued the opposite—plaintiffs do have standing to assert their BIPA violation claim.¹⁵³Id. at 1242. As described by the Seventh Circuit,

[t]hat peculiar line-up exists for reasons that only a civil procedure buff could love: the case started out in an Illinois state court, but Clearview removed it to federal court. Thornley wants to return to state court to litigate the BIPA claims, but Clearview prefers a federal forum. The case may stay in federal court, however, only if the more stringent federal standards for standing can be satisfied; Illinois (as is its right) has a more liberal attitude toward the kinds of cases its courts are authorized to entertain.¹⁵⁴Id.

Like the court’s view on a section 15(a) violation in Bryant, section 15(c) is also a duty owed to the public and without concrete injury there is not sufficient injury for standing.¹⁵⁵Thornley, 984 F.3d at 1247; Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020). Consequently, the court of appeals affirmed the district court’s remand of the case to state court where the plaintiffs’ BIPA claim could proceed despite the lack of concrete injury.¹⁵⁶Thornley, 984 F.3d at 1248–49.

These cases, taken together, demonstrate the divide between BIPA violations that are thought to be concrete, and the two violations commonly thought to be procedural. However, for a section 15(a) claim, courts have emphasized the language used to describe the violation—a failure to publish a retention and deletion schedule is different than a failure to comply with the published schedule.¹⁵⁷Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1154–55 (7th Cir. 2020). This difference matters because only the failure to comply creates a concrete harm.¹⁵⁸Id.

II.     Two-Tiered Standing Analysis For Biometric Statutory Violations

A two-tier analysis to assess Article III standing for class-action lawsuits alleging a violation of a state’s biometric privacy statute is superior given the unique nature of biometric information. Under the first tier, violations of section 15(b), (d), and (e) of BIPA should be assessed through the established framework of analogizing a biometric injury to an invasion of privacy injury. Under the second tier, injury from violations of section 15(a) and (c)—procedural violations—is analogized to injury from the common law tort of conversion. This Section will focus primarily on section 15(a) and (c) violations because the other sections are routinely viewed as concrete and therefore, recoverable in federal court.¹⁵⁹Kloss v. Acuant, Inc., 462 F. Supp. 3d 873, 876 (N.D. Ill. 2020); Thornley, 984 F.3d at 1247; Bryant, 958 F.3d at 626; Cothron v. White Castle Sys., Inc., 467 F. Supp. 3d 604, 613 (N.D. Ill. 2020); Roberson v. Maestro Consulting Servs. LLC, 507 F. Supp. 3d 998, 1010 (S.D. Ill. 2020).

A.     The First Tier—Violations of Section 15(b), (d), and (e)

Courts should use the traditional invasion of privacy analogue for the BIPA violations commonly thought of as concrete—section 15(b), (d), and (e).¹⁶⁰Bryant, 958 F.3d at 626–27; Cothron, 467 F. Supp. 3d at 613; Roberson, 507 F. Supp. 3d at 1010. Consequently, this Section will be brief as the first tier follows the established framework of using an invasion of privacy analogue.¹⁶¹See, e.g., Patel v. Facebook, Inc., 932 F.3d 1264, 1273 (9th Cir. 2019) (discussing use of an invasion of privacy claim as an analogue for a BIPA violation).

When courts view a statutory BIPA violation as concrete, the invasion of privacy analogue is conducive to standing.¹⁶²See, e.g., id. When only the named class representative must show standing before the class is certified, the concreteness of the injury caused by a section 15(b), (d), or (e) violation should not be an impediment to certification.¹⁶³Id. at 1275–76. However, when absent class members must show standing at the class certification stage, potential problems might arise. For example, under section 15(b), a private entity aggrieves a party when it collects a party’s biometric information without first obtaining consent.¹⁶⁴740 Ill. Comp. Stat. Ann. 14/15(b) (West 2008). If a court requires individual proof of standing at the class certification stage, absent class members would likely have to show that their biometric information was collected without consent.¹⁶⁵See Ormerod, supra note 121, at 161. While not an insurmountably high barrier, the question of when class members must show standing certainly affects whether a class is certified.

B.     The Second Tier—Violations of Section 15(a) and (c)

The invasion of privacy analogue for statutory BIPA violations does not work for violations of section 15(a) and (c) because these sections are thought to be procedural; consequently, additional harm is necessary for plaintiffs to have standing.¹⁶⁶Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1242–43 (7th Cir. 2021); Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020). Instead of an invasion of privacy analogue, there are two potentially superior common law causes of action that could serve as analogue for a biometric statutory violation: (1) trespass to chattels and (2) conversion. While both have benefits, conversion is superior to trespass to chattels because concrete injury is easier to prove.¹⁶⁷See Restatement (Second) of Torts §§ 218, 222A (Am. L. Inst. 1965). Thus, courts should use traditional common law theories of conversion when faced with either a section 15(a) or (c) BIPA violation.

    1.     Trespass to Chattel

In the well-known torts case Intel Corp. v. Hamidi,¹⁶⁸71 P.3d 296 (Cal. 2003). the court examined whether a former employee’s use of his employer’s computer system to send mass emails criticizing the company to 35,000 employees constitutes trespass to chattel.¹⁶⁹Id. at 299–302. To grapple with this issue, the court looked at other cases where “[d]ata search and collection robots” gathered data without permission from various company websites.¹⁷⁰Id. at 305 & n.4. In the cases that the court examined, trespass to chattels occurred only when the defendant threatened to, or did, impede the normal operations of the plaintiff’s computer system.¹⁷¹Id. at 300. The court distinguished the prior cases from the instant one by pointing to the impairment or substantial deprivation in the former, and the temporary use of the company’s computer system to send the emails in the instant case.¹⁷²Id. at 306–07. The court also noted that the law of trespass to chattels is primarily concerned with the interference of possession and does not cover receipt of unauthorized electronic communication.¹⁷³Id. at 308. Although the court considered extending trespass of chattels to the internet, the court decided that any resulting harm does not damage property; accordingly, there was no trespass to chattels.¹⁷⁴Hamidi, 71 P.3d at 308–09. Despite denying the company’s trespass to chattels claim, the court considered Professor Richard Epstein’s argument in favor of the expansion.¹⁷⁵Id.

Professor Epstein advocated for the inclusion of “web sites and servers” as real property.¹⁷⁶Amicus Brief for Cal. Emp. Law Council et al. Supporting Respondent Intel Corp. at 14, Intel Corp. v. Hamidi, 71 P.3d 296 (Cal. 2003) (No. S103781). To him, the “purpose of the law of trespass” is to protect an owner’s property from interference by others and to guard the property owner’s privacy; thus, in Hamidi the owner’s right to exclusive possession is diminished by each person who co-opts Intel Corp.’s computer system to send spam communications.¹⁷⁷Id. at 18, 29–30. The failure to recognize this type of damage as trespass results in the disruption of the company for which there is no remedy.¹⁷⁸See id. at 19. To rectify this failure, Professor Epstein suggests providing consequential damages for “the loss of good will and morale that necessarily follow when the defendant commandeers its servers and equipment for his own use.”¹⁷⁹Id. at 30. Furthermore, recovery is not precluded when the commandeered chattel is still retained by the owner.¹⁸⁰Id. Interestingly, Professor Epstein states that when full recovery of damages is impossible, an injunction is an appropriate form of equitable relief.¹⁸¹Id. at 34. Moreover, when an action constitutes a dispossession, then nominal damages are recoverable despite no harm to the chattel itself.¹⁸²Amicus Brief for Cal. Emp. Law Council et al., supra note 176, at 14 (citing Restatement (Second) of Torts § 218 (Am. L. Inst. 1965)).

However, trespass to chattels does not cover situations where the owner is completely, rather than momentarily, deprived of his property.¹⁸³See Restatement (Second) of Torts § 218 (Am. L. Inst. 1965). Rather, the tort of conversion covers when there is complete dispossession.¹⁸⁴Id. § 222A. The Restatement (Second) of Tortsdescribes conversion as an exercise of the defendant’s dominion or control over the chattel, as distinguished from a mere interference with the chattel itself, or with the possession of it.¹⁸⁵Id. In the context of BIPA, the tort of conversion should apply to violations of section 15(a) and (c). The tort of conversion for these procedural BIPA violations aligns with the purpose of trespass to chattels per Professor Epstein’s view—protecting a property owner’s exclusive right of possession and to privacy—while accounting for the complete dispossession that occurs when there is unauthorized use of an individual’s biometrics.¹⁸⁶Amicus Brief for Cal. Emp. Law Council et al., supra note 176, at 18, 29–30. Although an individual retains his biometric identifiers, he is forever disposed of his exclusive ownership when there is unauthorized possession.¹⁸⁷See Wyman, supra note 1 (“Biometrics, the legislature observes, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.”).

Furthermore, Professor Epstein states that “it is the owner of the chattel that has an interest in exclusive possession”; therefore, recovery must extend to all consequential damages that result.¹⁸⁸Amicus Brief for Cal. Emp. Law Council et al., supra note 176, at 18, 26–27. Hamidi highlights the problem with applying the tort of trespass to chattels. There, the court held that the mass spam email communications that Hamidi sent users through the company’s computer systems was not actionable without actual, or threatened injury.¹⁸⁹Hamidi, 71 P.3d at 311. In contrast, the tort of conversion—complete dispossession—does not depend on the existence of injury.¹⁹⁰See Restatement (Second) of Torts § 222A (Am. L. Inst. 1965). As such, conversion, not trespass to chattels, is the superior cause of action for procedural BIPA violations because the harm is in the act of dispossession; no additional harm is required for standing.¹⁹¹Id.

2.     Conversion

The American Law of Torts defines conversion as “a wrongful taking, detention, or interference with, or an illegal assumption of ownership or possession, or illegal use or misuse, of the personal property of another.”¹⁹²Stuart M. Speiser, Charles F. Krause & Alfred W. Gans, 7 American Law of Torts § 24:1, Westlaw (database updated Mar. 2022). The tort of conversion depends on the establishment of exclusive ownership of property.¹⁹³See Kremen v. Cohen, 337 F.3d 1024, 1030 (9th Cir. 2003). For intangible assets, the critical question is whether a property right exists.¹⁹⁴Id. In Kremen v. Cohen,¹⁹⁵337 F.3d 1024 (9th Cir. 2003). the Ninth Circuit examined whether (1) a property right in an intangible internet domain name exists, and (2) if so, whether plaintiff could recover under a claim of conversion.¹⁹⁶Id. at 1029–30. Regarding the first question, the Ninth Circuit posited a three-part analysis to determine the existence of a property right: “[f]irst, there must be an interest capable of precise definition; second, it must be capable of exclusive possession or control; and third, the putative owner must have established a legitimate claim to exclusivity.”¹⁹⁷Id. at 1030. The court held that plaintiff owner had a property right in his internet domain name because it is exactly defined when registered.¹⁹⁸Id. Moreover, ownership of a domain name is exclusive since only the registrant may decide where the domain name sends those who follow it.¹⁹⁹Id. Lastly, when a domain name is registered, exclusive ownership is apparent since no others may register that same name.²⁰⁰Id. Thus, the court held that the plaintiff had an intangible property right in the internet domain name, and that this property right was sufficient to support a conversion claim.²⁰¹Kremen, 337 F.3d at 1030.

Biometric identifiers are similarly an intangible property right that can serve as the basis for a claim of conversion. Applying the test in Kremen to biometric identifiers, biometric identifiers are also a well-defined interest since they are “unique to the individual” and capable of being measured through technology.²⁰²Wyman, supra note 1 (discussing uniqueness of biometrics); Zimmerman, supra note 5, at 640. In Kremen, the court pointed to corporate shares and land as other types of defined property interests.²⁰³Kremen, 337 F.3d at 1030. The commonality between corporate shares, land, and internet domain names is registrability; like these, a person’s biometrics are registered when an individual decides to use his biometrics.²⁰⁴Id.; Apple Inc., About Touch ID Advanced Security Technology (Sept. 11, 2017), https://perma.cc/7B3P-TQPW. For instance, Apple iPhone owners can use their fingerprint to unlock their phones, but only if they first scan their fingerprints; subsequently, the owner’s unique biometric data is stored on the iPhone.²⁰⁵Apple Inc., supra note 203. This completes the act of registration and every time the owner wants to unlock his phone, his fingerprint is compared to the stored biometric data to verify the identity of the owner.²⁰⁶Id.; see also In re Jessica M., 928 N.E.2d 511, 524 (Ill. App. Ct. 2010) (providing an example of biometric identifiers being registered: “In 1989, a working group sponsored by the Federal Bureau of Investigations (FBI) laboratory provided the framework for a combined DNA Index System among crime laboratories to share DNA profiles, much like the fingerprint matching system.”). Ownership of biometric identifiers is also exclusive given that each person’s biometrics are different—they are “biologically unique to the individual.”²⁰⁷Wyman, supra note 1. Additionally, the enactment of BIPA served as recognition that people have a right to control their own biometric information.²⁰⁸Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1206 (Ill. 2019). Finally, owners have a legitimate claim to their own biometric identifiers because sans consent or theft, only they have access to their own biometrics; thus, like in Kremen, others are on notice that an individual’s biometrics are uniquely possessed by that individual.²⁰⁹Kremen v. Cohen, 337 F.3d 1024, 1030 (9th Cir. 2003); see Blake Benson, Recent Development, Fingerprint Not Recognized: Why the United States Needs to Protect Biometric Privacy, 19 N.C.J.L. & Tech. Online Ed. 161, 168 (2018) (suggesting that although biometric information is susceptible to theft, an individual’s biometrics are inherently unique to that individual). Just as an internet domain name is a property right,²¹⁰Kremen, 337 F.3d at 1030. so too are biometric identifiers.

Furthermore, Kremen demonstrates that an action for conversion is not precluded by the owner retaining access to his property.²¹¹Id.; see Amicus Brief for Cal. Emp. Law Council et al., supra note 176, at 30 (In accordance with Professor Epstein’s view). When an owner of an internet domain name is deprived of exclusive control over his property, then this forms the basis for a conversion claim despite the owner retaining access to the property—the owner can still follow the internet domain name to where it leads.²¹²Kremen, 337 F.3d at 1030. In this aspect, conversion of both an internet domain name and biometrics are similar since the owner of either still has access to the property; however, the owner no longer has exclusive ownership.²¹³See id. (suggesting that the right to sell is part of the exclusive right of ownership).

Although historically conversion only applied to tangible property, this distinction is largely irrelevant today.²¹⁴Id. (“Virtually every jurisdiction, however, has discarded this rigid limitation to some degree.”); see FMC Corp. v. Capital Cities/ABC, Inc., 915 F.2d 300, 304–05 (7th Cir. 1990) (declining to distinguish between tangible and intangible property). Arguments that intangible property cannot be subject to a conversion claim center on whether the intangible property is reflected through something that can be taken from the owner.²¹⁵See Thrifty-Tel, Inc. v. Bezenek, 54 Cal. Rptr. 2d 468, 472 (App. 1996). The Restatement (Second) of Torts supports the view that intangible property must be merged with some document before a claim for conversion can be successfully brought.²¹⁶Restatement (Second) of Torts § 242 (Am. L. Inst. 1965). As noted, not many jurisdictions follows this; furthermore, the document does not have to be tangible itself.²¹⁷Kremen, 337 F.3d at 1034 n.11. For example, in eBay, Inc. v. Bidder’s Edge, Inc.,²¹⁸100 F. Supp. 2d 1058 (N.D. Cal. 2000). the court held that “electronic signals” are sufficiently tangible.²¹⁹Id. at 1069. An electronic signal, recorded on an electronic record, can serve as a document.²²⁰Kremen, 337 F.3d at 1034 n.11. Likewise, biometric identifiers are stored in a type of electronic record for later use;²²¹Zimmerman, supra note 5, at 657 (fingerprint example). thus, even for the jurisdictions that follow the Restatement, there is a sufficient property right in biometric identifiers to form the basis of a conversion claim.²²²Benson, supra note 208, at 169 (noting the security issues that arise when biometric information are stored in an unsecured database); see also Apple Inc., supra note 203 (“Your fingerprint data is encrypted, stored on device, and protected with a key available only to the Secure Enclave.”). Whether a person’s biometric information is tangible or intangible, the analysis of a section 15(a) or (c) BIPA violation is similar because, if tangible, then conversion is the appropriate cause of action; if intangible, then under the TransUnion framework, an analogy to common-law conversion works.

III.     Application of the Second Tier

This Part begins with an examination of BIPA cases post-TransUnion. The second tier of my framework is applied to one of the post-TransUnion BIPA cases to illustrate the benefits of using a conversion claim or analogue instead of an invasion of privacy analogue. This application will also demonstrate the utility of the second tier in the context of the class action certification inquiry.

A.     BIPA Cases after TransUnion

In one of the few biometric cases post-TransUnion, the Seventh Circuit Court of Appeals, while examining whether violation of section 15(d) results in injury sufficient for standing, implied that the holding in Fox regarding section 15(a) is still good law—”that the unlawful retention of biometric data, just like its unlawful collection, works a concrete and particularized Article III injury.”²²³Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1161 (7th Cir. 2021). Another recent Illinois case looked at section 15(a) as an invasion of privacy harm; however, the court noted that “Illinois’ definition of a right to privacy in the context of BIPA and insurance policies should be the focus, not the interpretation of Article III standing.”²²⁴Twin City Fire Ins. Co. v. Vonachen Servs., Inc., 567 F. Supp. 3d 979, 999–1000 (C.D. Ill. 2021). Despite being post-TransUnion, these two cases had expected outcomes.²²⁵See, e.g., Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1207 (Ill. 2019); Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1149 (7th Cir. 2020).

1.     Procedural BIPA Violations in King v. PeopleNet Corp.

The following case directly addressed the two procedural BIPA violations: section 15(a) and (c).²²⁶King v. PeopleNet Corp., No. 21 CV 2774, 2021 U.S. Dist. LEXIS 207694, at *4 (N.D. Ill. Oct. 28, 2021). In King v. PeopleNet Corp.,²²⁷No. 21 CV 2774, 2021 U.S. Dist. LEXIS 207694 (N.D. Ill. Oct. 28, 2021). the defendant company provided other companies with biometric devices designed to track how long each employee worked.²²⁸Id. at *3–4. Plaintiff worked at a company that utilized the defendant company’s services.²²⁹Id. Plaintiff alleged that the defendant biometric provider violated section 15(a) of BIPA by failing to publish a biometric retention and destruction schedule and section 15(c) by profiting from plaintiff’s biometrics.²³⁰Id. at *6–11. Here, the court held that because plaintiff alleged only that defendant company failed to publish a public retention and deletion schedule under section 15(a), there was not sufficient injury for standing as the duty to publish a schedule is owed to the public and not just to the individual.²³¹Id. at *6–9; accord Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020). However, the court also noted that plaintiff’s allegation of a section 15(a) violation was conclusory and suggested that the result might be different if plaintiff alleged an unlawful retention.²³²King, No. 21 CV 2774, at *6–9 (suggesting plaintiff’s allegation that her privacy was violated and was injured did not amount to an allegation that defendant company “unlawfully retained her information”). Similarly, the court held that plaintiff’s section 15(c) claim failed as well, holding that standing under section 15(c) exists

(1) where a collector of biometric data has deprived a plaintiff of the opportunity to profit from her own information; (2) where the sale and dissemination of a plaintiff’s data “amplified the invasion of her privacy that occurred when the data was first collected;” or (3) if a defendant profiting from a plaintiff’s biometric information raises her costs.²³³Id. at *9–10 (quoting Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1247 (7th Cir. 2021)).

However, if a plaintiff fails to allege any of the three or some other concrete injury, then a plaintiff states only a section 15(c) regulatory violation; therefore, no Article III standing exists.²³⁴Id. Although post-TransUnion, this case followed the reasoning of Bryant and Thornley in holding that a procedural violation of BIPA, without more, is insufficient for standing.²³⁵Id. at *9–11; Bryant, 958 F.3d at 626; Thornley, 984 F.3d at 1248. While the court did not discuss class certification, absent class members are unlikely to have standing for these two procedural BIPA violations if the named putative class representative cannot prove injury; however, this is not a bright-line rule.²³⁶The Second Circuit Court of Appeals held the following:

Since class action plaintiffs are not required to have individual standing to press any of the claims belonging to their unnamed class members, it makes little sense to dismiss the state law claims of unnamed class members for want of standing when there was no requirement that the named plaintiffs have individual standing to bring those claims in the first place.

Langan v. Johnson & Johnson Consumer Cos., Inc., 897 F.3d 88, 95 (2d Cir. 2018).

2.     A Conversion Analogue in King v. PeopleNet Corp.

Using the second tier of this proposed framework, a claim of conversion would have been successful in King v. PeopleNet Corp. The success of a conversion analogue depends on recognizing that people have a property right in their own biometrics,²³⁷See Kremen v. Cohen, 337 F.3d 1024, 1030 (9th Cir. 2003). and a person’s biometric identifiers are both permanent and unique to that person.²³⁸Adra, supra note 45, at 410. Thus, this property right means that each person has the exclusive right to control the use of his own biometrics.²³⁹Kremen, 337 F.3d at 1030. While this Section’s focus is on biometrics as intangible property given the current perception of biometrics,²⁴⁰See, e.g., United States v. Zheng, 762 F.3d 605, 609 (7th Cir. 2014) (stating that biometric information is intangible). if biometric identifiers are considered tangible then the difference is that plaintiffs can simply bring a per se claim of conversion without the need for a common-law analogue to harm akin to that caused by a violation of section 15(a) or (c).²⁴¹See Restatement (Second) of Torts § 222A (Am. L. Inst. 1965) (discussing the tort of conversion).

a.     Section 15(a) BIPA Violations

The court in King held that section 15(a), failure to publish a retention and deletion schedule, is procedural since this regulatory duty is owed to the public.²⁴²King v. PeopleNet Corp., No. 21 CV 2774, 2021 U.S. Dist. LEXIS 207694, at *6–9 (N.D. Ill. Oct. 28, 2021). However, as the exclusive owner, a person that permits a company to collect his biometrics does so under specific terms—a company must publish guidelines for the destruction of the collected biometrics “when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first.”²⁴³740 Ill. Comp. Stat. Ann. 14/15(a) (West 2008). While this duty is owed to the public, this does not necessarily mean that a violation is insufficient for standing without an additional harm.²⁴⁴Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020).

Instead of an invasion of privacy analogy,²⁴⁵Twin City Fire Ins. Co. v. Vonachen Servs., Inc., 567 F. Supp. 3d 979, 999–1000 (C.D. Ill. 2021) (stating invasion of privacy does not go to interpreting Article III standing). an analogy to conversion overcomes the impediment caused by the standing requirement of additional harm. When a company fails to publish a retention schedule and deletion guidelines, the company wrongfully detains the biometrics provided by its exclusive owner.²⁴⁶Speiser et al., supra note 191 (conversion as wrongful detention of property). The owner provided his property on the specific terms set forth under BIPA; as such, there is an expectation that the terms are followed and his biometrics will not be kept for longer than needed.²⁴⁷740 Ill. Comp. Stat. Ann. 14/15(b)(2) (West 2008). Perhaps companies willingly destroy their collected biometric identifiers; however, without a published policy, this is uncertain. Due to the uncertainty, an owner’s control over his own biometrics is interfered with because he no longer has exclusive control over his property—the company has indefinitely interfered with his exclusive right.²⁴⁸740 Ill. Comp. Stat. Ann. 14/5(c) (West 2008) (biometric identifiers are unique: “[O]nce compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.”). As the Restatement (Second) of Torts states, “[w]here the trespass to the chattel is a dispossession, the action will lie although there has been no impairment of the condition, quality, or value of the chattel, and no other harm to any interest of the possessor.”²⁴⁹Restatement (Second) of Torts § 218 (Am. L. Inst. 1965). When dispossession occurs, recovery of nominal damages is possible regardless of how long the dispossession lasts.²⁵⁰Id. This accords with Kremen since a person can be deprived of exclusive control over his property despite retaining it in his possession.²⁵¹Kremen v. Cohen, 337 F.3d 1024, 1030 (9th Cir. 2003). Therefore, a company’s failure to publish retention and destruction guidelines acts as an indeterminate dispossession of a person’s exclusive property right in his biometric identifiers and no additional harm is necessary.²⁵²See Restatement (Second) of Torts § 218 (Am. L. Inst. 1965). The benefit of a conversion analogue is that under Spokeo and TransUnion, a section 15(a) BIPA violation creates per se harm even though it is a procedural violation; thus, injury sufficient for standing exists.²⁵³TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2204 (2021); Spokeo, Inc. v. Robins, 578 U.S. 330, 340–42 (2016) (stating that if an intangible harm has a closely related harm at common law, standing is more likely to exist).

b.     Section 15(c) BIPA Violation

Likewise, the court in King viewed a section 15(c) violation, profiting from another’s biometric information, as insufficient injury for standing without an allegation of some other concrete harm.²⁵⁴King v. PeopleNet Corp., No. 21 CV 2774, 2021 U.S. Dist. LEXIS 207694, at *9–11 (N.D. Ill. Oct. 28, 2021). Although the court listed three ways that plaintiff could have alleged a section 15(c) violation that would constitute concrete injury,²⁵⁵Id. (quoting Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1247 (7th Cir. 2021)). using an analogy to a conversion claim overcomes the standing hurdle given that plaintiffs have the exclusive right to control their own biometric identifiers.²⁵⁶See Restatement (Second) of Torts § 222A (Am. L. Inst. 1965) (discussing the tort of conversion). Consequently, plaintiffs are injured when a company sells these identifiers to others in an exercise of complete dominion over the owner of biometrics.²⁵⁷See id. While this arguably renders a section 15(c) violation as per se injurious, this is appropriate given that the “full ramifications of biometric technology are not fully known.”²⁵⁸740 Ill. Comp. Stat. Ann. 14/5(f) (West 2008). At minimum, there is recognition that biometric identifiers can be forever compromised;²⁵⁹740 Ill. Comp. Stat. Ann. 14/5(c) (West 2008). thus, more deference to plaintiffs that adequately allege a statutory BIPA violation is needed to ensure that large corporations do not leave plaintiffs without recourse.

B.     Class Actions

Furthermore, while not addressed in King, a class is more likely to receive certification for all class members, including absent unnamed class representative, if the standing inquiry comes first since conversion requires no additional harm to constitute concrete injury.²⁶⁰Restatement (Second) of Torts §§ 218, 222A (Am. L. Inst. 1965). Depending on how the resulting injury is viewed, either as a specific injury or a more general injury,²⁶¹Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1247 (7th Cir. 2021) (discussing a duty owed to public or a duty owed to an individual). absent class members may not be able to show standing at the class certification stage under the invasion of privacy framework. Instead, conceptualizing these violations as akin to conversion rather than an invasion of privacy is superior given the permanence and unique characteristics of biometric information.²⁶²SeeAdra, supra note 45, at 410. Thus, the benefit of viewing section 15(a) and (c) violations as or analogous to conversion is that, at least at the class certification stage, standing should not be as high of a barrier for absent class members. As a conversion of a party’s property, injury is easier to prove—when a private entity collects the biometric information of an absent party, but fails to publish a retention schedule, then that entity wrongfully interferes with the absent party’s property.²⁶³See Masciandaro, supra note 87, at 1274 (“By deleting information, a business ensures it is not infringing on property rights that exclude unwanted possession, use, or interference.”).

IV.     Concluding Remarks

Part IV briefly discusses possible next steps while acknowledging some of the issues that remain. First, limitations are examined. Then, possible areas of improvements going forward are discussed.

A.     Limitations

Until recognition of the special nature of biometric identifiers occurs, the ability to test the application of a conversion analogue for BIPA class actions is limited. Additionally, the distinction between a tangible property right and an intangible property right has ramifications despite the analysis of the existence of a property right remaining the same. As an intangible property right, jurisdictions that follow the Restatement (Second) of Torts will require biometric identifiers to be merged with some type of document.²⁶⁴Restatement (Second) of Torts § 242 (Am. L. Inst. 1965). Whether electronic signals or records constitute a type of document depends on the court’s perspective;²⁶⁵SeeeBay, Inc. v. Bidder’s Edge, Inc., 100 F. Supp. 2d 1058, 1069 (N.D. Cal. 2000). although, since biometric identifiers are typically registered and stored in some type of database,²⁶⁶See Apple Inc., supra note 203 (explaining an example of the iPhone fingerprint technology). it seems likely that courts following the Restatement will view this as constituting a merger.

Moreover, using conversion as an analogue will likely be met with resistance by companies that operate in Illinois.²⁶⁷Anna L. Metzger, Comment, The Litigation Rollercoaster of BIPA: A Comment on the Protection of Individuals from Violations of Biometric Information Privacy, 50 Loy. U. Chi. L.J. 1051, 1092 (2019). These companies may be worried about the economic consequences of running afoul of BIPA since under a conversion analogue, the standing hurdle for plaintiffs is lower.²⁶⁸Id. Although valid, this concern is likely overstated. Not only is it relatively simple to comply with the five BIPA requirements, it is also in the company’s best interest given that the alternative is a potentially devastating class action against the company.²⁶⁹Id. at 1092–93. Additionally, even if operating costs rise, “whatever expenses a business might incur to meet the law’s requirements are likely to be insignificant compared to the substantial and irreversible harm that could result if biometric identifiers and information are not properly safeguarded.”²⁷⁰Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1207 (Ill. 2019).

B.     Next Steps

For now, this framework offers courts a starting place to begin thinking about how biometric identifiers are different from other personal identifiable information like social security numbers. Biometric identifiers are becoming more and more pervasive despite the inability to comprehend the potential consequences that will result as technology grows and changes.²⁷¹740 Ill. Comp. Stat. Ann. 14/5(a) (West 2008). Moreover, as additional time passes from when TransUnion was decided, there will likely be more opportunities to examine the decision’s effect on class action BIPA claims in federal court. Presently, it is worth noting another possible solution that recognizes the harm caused by a statutory BIPA violation—injunctive relief. As an alternative, injunctive relief cannot ensure full recovery of harm because once a person’s biometric identifiers are compromised the person is forever disposed of exclusive ownership; still, it may be useful where damages are inadequate or not feasible.²⁷²Amicus Brief for Cal. Emp. Law Council et al., supra note 176, at 34.

Conclusion

The unique nature of biometric information necessitates a different response to statutory biometric violations than if the violation only concerned data such as one’s address or credit card information. When a statutory biometric violation occurs, the denial of federal jurisdiction is inappropriate. Although Article III standing must be demonstrated, recognition that biometric information is distinct serves as a bridge between arguably procedural violations and concrete injuries. For absent class members who may not be able to show specific instances of harm outside of, for example, unauthorized profiting, the proposed two-tier analysis offers a solution. By analogizing procedural violations of BIPA to the common law tort of conversion, all absent class members can show a concrete harm. Under this framework, absent class member would satisfy standing prior to class certification more readily and thus, recovery will not be precluded.