There is never a convenient time for a person’s credit card to get stolen; victims of credit card theft must scramble to cancel old cards and then update recurring payments with a new card. However, imagine the damage that would be caused by a thief stealing the fingerprints or the facial geometry of a victim. Unlike a credit card, these identifiers are unique to the victim and cannot be replaced.1740 Ill. Comp. Stat. Ann. 14/5(c) (West 2008); see also Theodore Z. Wyman, Cause of Action for Wrongful Collection or Disclosure of Consumer Biometric Information, in 98 Causes of Action 2d 297 (2022). Fingerprints, like facial geometry, are referred to as biometric information.2740 Ill. Comp. Stat. Ann. 14/10 (West 2008). Biometric information consists of the biometric identifiers “used to identify an individual,” and this includes scans of the eye, facial geometry, fingerprints, voiceprints, and handprints.3Id.
The collection of biometric identifiers has quickly become the norm.4See 9 Industries Biometrics Technology Could Transform, CB Insights (Dec. 12, 2019), https://perma.cc/HR59-BX5M (discussing biometric implementation across various industries). For example, fingerprints and facial geometry are often used to unlock smartphones.5See Hannah Zimmerman, Comment, The Data of You: Regulating Private Industry’s Collection of Biometric Information, 66 U. Kan. L. Rev. 637, 637 (2018). In the automotive industry, Hyundai released a car that uses fingerprint scans to start the car,69 Industries Biometrics Technology Could Transform, supra note 4. while in the banking industry biometric passwords are used to impede fraud.7Id. Even the makeup industry implements facial recognition technology—Ulta Beauty’s GLAMlab virtual makeup application uses consumers’ facial geometry to display what their faces would look like with virtual make-up applied.8Terms & Conditions, Ulta Beauty (Mar. 23, 2021), https://perma.cc/RTY7-7UG8.
Illinois was the first state to address unlawful biometric collection by passing the Biometric Information Privacy Act (“BIPA”).9Gerald D. Peake, 1 Data Security and Privacy Law § 7:17, Westlaw (database updated Sept. 2021). BIPA regulates the retention, collection, disclosure, and destruction of biometric information.10740 Ill. Comp. Stat. Ann. 14/15(a) (West 2008). BIPA also provides a private right of action against private actors for those aggrieved by a violation.11740 Ill. Comp. Stat. Ann. 14/20 (West 2008). While Illinois was the first state to pass a statute regulating biometric information collection by private entities, Illinois is not the only state to have done so.12See N.Y.C., N.Y., Admin. Code § 22-1201 (2022) (similar New York City statute); Tex. Bus. & Com. Code Ann. § 503.001 (2009) (similar Texas statute).
Illinois’s BIPA lists the following ways that a private entity can violate consumers’ statutory rights: section 15(a), failing to “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers . . . when the initial purpose for collecting or obtaining such identifiers . . . has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first”; section 15(b), collecting biometric information without consumer knowledge or consent; section 15(c), profiting from consumers’ biometric information; section 15(d), disclosing consumer biometric information in ways not authorized; or section 15(e), failing to use reasonable care.13740 Ill. Comp. Stat. Ann. 14/15 (West 2008).
When a company violates a section of BIPA, the harm is typically widespread.14See Charles N. Insler, Understanding the Biometric Information Privacy Act Litigation Explosion, 106 Ill. B.J. 34, 36 (2018). As an example, some companies have integrated their timekeeping systems with biometric collection technology.15Seeid. Under BIPA, when a company collects its employees’ biometric identifiers to track how many hours they worked but fails to comply with a retention schedule, every employee is injured.16See Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1156 (7th Cir. 2020). Moreover, suppose that a company implemented facial recognition software that collects its customers’ biometric information to increase convenience or to personalize the customer’s experience. If the company did so without consent, then every customer would have a cause of action under BIPA.17740 Ill. Comp. Stat. Ann. 14/20 (West 2008). Consequently, the ability to bring a BIPA claim as a class action significantly increases the potential recoverable damages.18Insler, supra note 14, at 36. In state courts, a consumer is aggrieved by a violation of any of the statutory rights granted to them under BIPA.19Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1207 (Ill. 2019). Yet, in federal courts, a statutory violation alone is not sufficient injury in fact under Article III of the U.S. Constitution.20See Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016); TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2200 (2021).
Under the Class Action Fairness Act (“CAFA”), class actions can be brought in federal courts when the following requirements are met: (1) there are at least 100 putative class members; (2) there is at least $5,000,000 in controversy; and (3) at least one member of the class is a citizen of a state different than the state of the defendant.2128 U.S.C. § 1332. As a result of CAFA, defendants can more easily remove BIPA class action lawsuits to federal court.22Thomas J. Cunningham, The In-House Legal Professional’s Guide to Removing Cases to Federal Court—A Checklist, Locke Lord Bissell & Liddell LLP, at 12 (Sept. 25, 2022),
https://perma.cc/7SDD-ZLDS. Federal courts are often desired by defendants for a variety of reasons, including more experienced judges, a more defendant-friendly jury pool than in state courts, and “[i]n class action litigation, the availability of interlocutory review of class certification orders.”23Id. at 6. Moreover, once in federal court, defendants can move for dismissal since plaintiffs now have to establish Article III standing.24See id. at 5 (for lacking jurisdiction). In contrast, plaintiffs usually prefer to stay in state court because there is no Article III standing requirements,25See Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1207 (Ill. 2019); Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 622 (7th Cir. 2020) (“[S]tanding requirements in Illinois courts are more lenient than those imposed by Article III.”). and state courts tend to be more favorable to the plaintiff compared to the usual defendant for BIPA cases—corporations.26Cunningham, supra note 22, at 9. Yet, there are also reasons class action plaintiffs might desire to remain in federal court. While the standing requirements may be more lenient in state court, a BIPA class action can benefit from remaining in federal court.27Ian C. Ballon, 3 E-Commerce and Internet Law § 27.07, Westlaw (database updated Apr. 2020). In federal court, “certification of potentially larger national class actions” are possible.28Id. When a class is large, defendants risk incurring a significant cost in defending against the suit and receiving negative attention from the public.29Id. Consequently, defendants may be more inclined to settle the claim than face these risks.30Id. Larger class actions may also prompt a higher value settlement which again benefits plaintiff class members in federal courts.31Id.
In 2016, the U.S. Supreme Court held that a statutory violation alone does not confer Article III standing—there still must be concrete harm.32See Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016). In every case, justiciability must be determined before a judge can rule on the merits of the case.33See, e.g., N.H. Right to Life PAC v. Gardner, 99 F.3d 8, 12 (1st Cir. 1996). There are no exceptions, and even in class actions, each member must have standing.34Rivera v. Wyeth-Ayerst Lab’ys, 283 F.3d 315, 318–19 (5th Cir. 2002). In 2021, the Supreme Court’s decision in TransUnion LLC v. Ramirez35141 S. Ct. 2190 (2021). added to the holding of Spokeo, Inc. v. Robins36578 U.S. 330 (2016). in the class-action context.37TransUnion, LLC, 141 S. Ct. at 2200. In TransUnion, a class of consumers that all received misleading alerts in their credit files brought suit under the Fair Credit Reporting Act (“FCRA”) alleging a statutory violation.38Id. However, the Court held that only the class members whose inaccurate credit files were also given to third parties suffered concrete harm.39Id. at 2212–13. The decision in both Spokeo and TransUnion means that all class members must have a concrete injury caused by the defendant’s statutory violation, and in the context of TransUnion, the mere risk of future harm from inaccurate information dissemination is not sufficient injury in fact despite the FCRA statutory violation.40Id. at 2210–12. However, the Court left open the possibility that an intangible “informational injury” can be concrete.41Id. at 2214 (discussing that although an informational injury can be concrete, here plaintiffs failed to allege any adverse effects). According to the majority’s reasoning in TransUnion and Spokeo, intangible harms are more likely to be concrete when they have a “close historical or common‑law analogue.”42TransUnion, 141 S. Ct. at 2204; Spokeo, Inc. v. Robins 578 U.S. 330, 341–42 (2016). In TransUnion, the alleged injury caused by the dissemination of inaccurate information to third parties was analogized to injury caused by defamation.43TransUnion, 141 S. Ct. at 2209. Although TransUnion clarified that each class member must have a concrete harm, the question remains as to whether failing to publish a retention schedule or profiting off another individual’s biometric information, both arguably procedural BIPA violations, gives standing to absent class members.44Id. at 2208 n.4 (declining to address this question).
Part I provides relevant background to the controversy. It discusses the characteristics of biometric identifiers, and the consequences that may follow from the regular use of these identifiers. Additionally, Part I includes a short examination of other states with laws similar to Illinois’s BIPA. This Part subsequently looks at how the standing inquiry differs between state and federal courts. Then, Part I examines possible common-law causes of actions that can serve as an analogue for the harm caused by a BIPA violation. Additionally, this Part assesses whether each of the statutory violations are currently viewed as creating concrete or procedural injury. This Part will also lay out the typical obstacles for class certification in biometric-related litigation. Finally, this Part will conclude with a brief purview of the most relevant BIPA cases so far.
Part II proposes a two-tiered analysis to assess Article III standing for class-action lawsuits alleging a violation of a state’s biometric privacy statute. Using Illinois’s BIPA as a model, the first tier assesses violations of section 15(b), (d), and (e) of BIPA through analogizing a biometric injury to an injury akin to an invasion of privacy. Under the second tier, violations of section 15(a) and (c) are assessed through a common-law analogue of conversion.
Part III demonstrates an application of this framework to cases post-TransUnion. The benefits of this framework are discussed in detail as well as possible issues that might arise. Lastly, Part IV contains concluding remarks.
I. Background of Biometric Identifiers and the Law
Biometric identifiers cannot be “forgotten, lost, or forged.”45Wyman, supra note 1. Moreover, biometric information tends to be inalterable.46Bilal Adra, Note, Facing the Facts on Biometric Phone Locks: Your Face and Thumb Are Not Secure, 2018 U. Ill. J.L. Tech. & Pol’y 407, 410 (2018). For example, an individual’s fingerprints remain the same throughout life.47Id. Due to the permanence of biometric identifiers, problems may arise when they are disseminated to others.48Id. at 411–12. Thus, while the potential for biometric information to increase an industry’s efficacy or enhance convenience for consumers, some industries take the use of biometrics too far.49See, e.g., Nicholas Iovino, Judge Approves Historic $650M Facebook Privacy Settlement, Courthouse News Service (Feb. 26, 2021), https://perma.cc/GW8A-LJ6X.
Recently, Facebook, Inc. settled for $650 million in a biometric‑related lawsuit that alleged Facebook collected social media users’ facial geometries.50Id. In the case Patel v. Facebook, Inc.,51932 F.3d 1264 (9th Cir. 2019). the Ninth Circuit determined that a BIPA violation is sufficient injury for standing because it affects a person’s “concrete right to privacy.”52Id. at 1267. Plaintiffs—social media users—alleged that Facebook’s feature “Tag Suggestions” improperly collected facial geometric information.53Id. at 1268. When a user uploads a photo to Facebook, Tag Suggestions utilizes facial recognition technology to scan the photo. If a face is detected, Tag Suggestions compares the detected face to other faces stored in Facebook’s large database.54Id. Once a match is found, Facebook allows users to add a tag to their pictures that indicates the name of the other person in the photo.55Id. The Ninth Circuit noted that Facebook’s facial recognition technology creates possible far-reaching consequences that extend beyond just the social media platform.56Id. at 1273. For instance, the court stated that “it seems likely that a face‑mapped individual could be identified from a surveillance photo taken on the streets or in an office building. Or a biometric face template could be used to unlock the face recognition lock on that individual’s cell phone.”57Patel, 932 F.3d at 1273. Consequently, the collection of users’ facial geometry data without user consent is an invasion of the users’ concrete right to privacy.58Id. Moreover, the court viewed Facebook’s retention of users’ biometric information without a published retention and deletion schedule as a violation of “substantive privacy interests.”59Id. at 1274. Facebook’s settlement constitutes “one of the largest privacy-related settlements in U.S. history.”60Id. (finding a violation of section 15(a); “[T]he procedural protections in BIPA ‘are particularly crucial in our digital world’ because ‘[w]hen a private entity fails to adhere to the statutory procedures . . . the right of the individual to maintain his or her biometric privacy vanishes into thin air.’”); Iovino, supra note 49.
Additionally, although this Comment will focus primarily on Illinois, other states have passed similar biometric acts such as Texas and Washington.61Tex. Bus. & Com. Code Ann. § 503.001 (2009); H.B. 1493, 65th Leg., Reg. Sess. (Wash. 2017). Texas’s biometric law prohibits both the commercial collection and the nonconsensual sale of another person’s biometric data.62§ 503.001. The act also requires those possessing biometric data to use reasonable care and to destroy the data within a reasonable amount of time.63Id. While similar to Illinois’s BIPA, Texas’s act lacks a private cause of action; rather, enforcement is left to the attorney general.64Id. Similarly, Washington’s biometric act includes largely the same requirements and prohibitions as the Texas biometric act; however, Washington’s act differs by equating a statutory biometric violation to a deceptive business practice.65Wash. H.B. 1493 (“[F]or the purpose of applying the consumer protection act . . . .”). Moreover, both Illinois’s BIPA and Washington’s biometric act include a statement explaining why the requirements and prohibitions are necessary.66Id.; 740 Ill. Comp. Stat. Ann. 14/5 (West 2008). BIPA includes a section explaining that the public is benefitted by regulating the use of biometric information.67740 Ill. Comp. Stat. Ann. 14/5 (“The public welfare, security, and safety will be served by regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.”). Likewise, Washington’s biometric act includes a section on legislative findings, stating that “[t]he legislature finds that citizens of Washington are increasingly asked to disclose sensitive biological information that uniquely identifies them for commerce, security, and convenience. The collection and marketing of biometric information about individuals, without consent or knowledge of the individual whose data is collected, is of increasing concern.”68Wash. H.B. 1493. While not as comprehensive, other states have updated the definition of personal information to include biometric data as well.69Zimmerman, supra note 5, at 648 (including “Connecticut, Iowa, Nebraska, North Carolina, Oregon, Wisconsin, and Wyoming”).
A. Standing and Biometric Information
For a federal court to have jurisdiction over a biometric violation suit, the plaintiff must have standing.70Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992). Article III of the U.S. Constitution requires a party to show “(1) that he or she suffered an injury in fact that is concrete, particularized, and actual or imminent, (2) that the injury was caused by the defendant, and (3) that the injury would likely be redressed by the requested judicial relief.”71Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1244 (7th Cir. 2021) (quoting Thole v. U.S. Bank N.A., 140 S. Ct. 1615, 1618 (2020)). Not all injuries must be tangible to be sufficient for Article III standing.72TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2204 (2021). The TransUnion Court stated “[v]arious intangible harms can also be concrete,” including “reputational harms, disclosure of private information, and intrusion upon seclusion. . . [a]nd . . . harms specified by the Constitution itself.”73Id. Moreover, according to the Spokeo Court, risk of harm from an intangible injury may be sufficient for standing.74Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016) (citing Clapper v. Amnesty Int’l. USA, 568 U.S. 398, 410 (2013)). The Court cited Clapper v. Amnesty Int’l USA75568 U.S. 398 (2013). where the Court ruled that plaintiff organizations lacked standing for their First Amendment pre-enforcement challenge to a statute allowing the government to surveil non-citizens because the risk of harm was only speculative.76Id. at 401, 410; see also Spokeo, 578 U.S. at 342 (citing Fed. Election Comm’n v. Akins, 524 U.S. 11, 20–25 (1998)) (“[T]he violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact. . . . [A] plaintiff in such a case need not allege any additional harm beyond the one Congress has identified.”). Although risk of future harm was insufficient for standing in TransUnion as well, the TransUnion Court distinguished Clapper because the relief sought was injunctive, not damages.77TransUnion, 141 S. Ct. at 2210 (“As this Court has recognized, a person exposed to a risk of future harm may pursue forward-looking, injunctive relief to prevent the harm from occurring, at least so long as the risk of harm is sufficiently imminent and substantial.”. As such, the Court did not foreclose the possibility that risk of future harm can be sufficiently material for standing, and the Court’s decision does not affect recovery of damages when the harm is present rather than a future risk.78Id. at 2212 (“[P]laintiffs did not factually establish a sufficient risk of future harm to support Article III standing.”.
1. Statutory Biometric Violations as an Intangible Injury
Injury from a biometric statutory violation is commonly conceptualized as intangible. Under the framework established by Spokeo, such an injury must be analogized to a harm recognized at common law.79Spokeo, 578 U.S. at 340–42. A typical analogy is a comparison to invasion of privacy.80See, e.g., Patel v. Facebook, Inc., 932 F.3d 1264, 1272 (9th Cir. 2019). Generally, an invasion of privacy falls within one of the following four categories: “(1) unreasonable intrusion upon the seclusion of another; (2) appropriation of the other’s name or likeness; (3) unreasonable publicity given to the other’s private life; and (4) publicity that unreasonably places the other in a false light before the public.”81Wyman, supra note 1. When a biometric statutory violation is compared to an unreasonable intrusion upon seclusion, the focus is on “an intentional interference with a person’s interest in solicitude or seclusion.”82Id.; Allen v. Verizon Wireless, No. 12-CV-482, 2013 WL 2467923, at *7 (D. Conn. June 6, 2013). A violation of an individual’s right of publicity serves as another common law analogue to the harm caused by a statutory biometric violation.83Lisa Raimondi, Note, Biometric Data Regulation and the Right of Publicity: A Path to Regaining Autonomy Over Our Commodified Identity, 16 U. Mass. L. Rev. 198, 219 (2021). A right to publicity refers to a person’s “property right in their name and likeness.”84Id. at 213. As applied to biometrics, Lisa Raimondi tweaks this analogy by uniting the rights associated with one’s identity with the rights of self-ownership.85Id. at 218–20. Where the violation concerns a sale of biometric information, it implies a misappropriation of someone’s commercial opportunity.86Id. at 220–24. However, the problem with this conceptualization of injury from biometric statutory violations is that, at least under BIPA, it is inapplicable for purely procedural violations like section 15(a) given that no sale has occurred or benefit misappropriated.87See id.(discussing right of publicity).
Also, another common perspective is that an individual should have property rights in their biometric information.88Alessandra Masciandaro, Comment, Cleaning-Up After Carpenter: Personal Data as Property Under the Fourth Amendment, 51 Seton Hall L. Rev. 1241, 1262–63 (2021). Alessandra Masciandaro advances the concept of property rights in one’s personal data, distinguishing a property right from a privacy right with the former including the power to exclude others from their property.89Id. Conceptually, she formulates a definition of personal data that encompasses “objects that exist independently of a person’s volition.”90Id. at 1271. Consequently, biometric information would constitute personal data.91Id. However, as a form of property, the remedy for a biometric statutory violations would likely be an injunction, rather than damages for a privacy injury.92Id. at 1274; see infra note 271.
An injury, whether tangible or intangible, must be concrete and particularized to the individual plaintiff.93Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1152 (7th Cir. 2020); Spokeo, Inc. v. Robins, 578 U.S. 330, 339 (2016). By the plain text of BIPA, anyone “aggrieved” under the statute has standing—even for procedural harm.94740 Ill. Comp. Stat. Ann. 14/20 (West 2008); Wyman, supra note 1. Thus, any of the five statutory prohibitions under BIPA is sufficient to “aggrieve” a party.95740 Ill. Comp. Stat. Ann. 14/20. However, this is true only for cases brought at the state level; at the federal level, not all statutory violations are sufficient for standing.96TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203 (2021) (“Under Article III, federal courts do not adjudicate hypothetical or abstract disputes.”); Spokeo, 578 U.S. at 338. There must be a concrete injury that is particular to the plaintiff; thus, sufficient injury for standing is dependent on whether a violation is purely procedural or substantive.97See, e.g., Patel v. Facebook, Inc., 932 F.3d 1264, 1274 (9th Cir. 2019) (“Because the privacy right protected by BIPA is the right not to be subject to the collection and use of such biometric data, Facebook’s alleged violation of these statutory requirements would necessarily violate the plaintiffs’ substantive privacy interests.”). A violation of a procedural right does not cause injury by itself, harm must be shown to a plaintiff’s concrete interests.98Id. at 1270–71.
a. Procedural and Substantive BIPA Violations
There are five statutory BIPA requirements or prohibitions; however, not every violation results in concrete injury.99Id. First, a violation of section 15(a) is generally viewed as a procedural violation.100Kloss v. Acuant, Inc., 462 F. Supp. 3d 873, 875–76 (N.D. Ill. 2020); Wyman, supra note 1. In this context, failure to publish retention schedules and deletion guidelines does not create concrete injury.101Kloss, 462 F. Supp. at 875–76 (holding that a section 15(a) violation is not an individual or concrete harm because the duty to publish a retention schedule and guidelines is owed to the public). However, this view is not shared uniformly by the courts.102Compare Hazlitt v. Apple Inc., 543 F. Supp. 3d 643, 649 (S.D. Ill. 2021) (“[T]he allegation that Apple has failed to follow a policy for retaining and destroying Plaintiffs’ biometric identifiers and information is enough to establish Article III standing for Plaintiffs’ § 15(a) claim.”) with Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020) (denying standing for plaintiff’s section 15(a) claim where no additional harm was alleged). Second, under section 15(b), concrete injury exists when there is collection of another person’s biometric information without informed consent.103Bryant, 958 F.3d at 626–27 (reversing summary judgment for defendant where a company’s failure to obtain consent prior to biometric collection “inflicted the concrete injury BIPA intended to protect against, i.e. a consumer’s loss of the power and ability to make informed decisions”); 740 Ill. Comp. Stat. Ann. 14/15(b) (West 2008) (stating that information regarding the purpose or timeframe for the collected biometric information must be conveyed to the owner of the biometrics prior to biometric collection). But see Figueroa v. Kronos Inc., 454 F. Supp. 3d 772, 780–81 (N.D. Ill. 2020) (distinguishing a complete failure to disclose the purpose and timeframe of collection from an incomplete disclosure, with the latter being only a procedural violation). Third, a section 15(c) violation is viewed as akin to a violation of section 15(a)—sale of biometric information requires specific harm to constitute sufficient injury for standing since this regulation is viewed as a duty owed to the public generally.104Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1247 (7th Cir. 2021) (“[Section 15(c)] is the same kind of general regulation as the duty to create and publish a retention and destruction schedule found in § 15(a), at least when the plaintiff asserts no particularized injury resulting from the commercial transaction.”); see also Hazlitt, 543 F. Supp. 3d, at 651–52 (holding that despite Apple profiting off its facial recognition devices, plaintiffs did not have standing because no specific harm was alleged). Fourth, a section 15(d) violation occurs when there is unauthorized disclosure of a person’s biometrics to a third party.105740 Ill. Comp. Stat. Ann. 14/15(d) (West 2008). When this occurs, the harm is concrete.106Cothron v. White Castle Sys., Inc., 467 F. Supp. 3d 604, 613 (N.D. Ill. 2020) (finding that a violation of section 15(d) is concrete because it deprives a consumer of the “opportunity to object to the way her data was being handled or to opt out of the system entirely”). Fifth, under section 15(e), failure to use reasonable care in the collection, storage, and transmission of a person’s biometric information creates concrete harm.107Roberson v. Maestro Consulting Servs. LLC, 507 F. Supp. 3d 998, 1010 (S.D. Ill. 2020) (holding that an employer’s failure to use reasonable care with an employee’s biometric information collected for time-keeping purposes creates a concrete injury analogous to unlawful retention).
b. Statutory BIPA Violations Brought as a Class Action
When a suit alleging a statutory BIPA violation is brought as a class action, the distinction between procedural and substantive BIPA violations adds an additional layer of complexity to the standing inquiry. There are several prerequisites for a representative party to sue on behalf of others in a class action.108Fed. R. Civ. P. 23(a). Class actions requires that
(1) the class is so numerous that joinder of all members is impracticable; (2) there are questions of law or fact common to the class; (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and (4) the representative parties will fairly and adequately protect the interests of the class.109Id.
Parties must also show either that a class action is the superior method given inconsistencies if individual adjudications were undertaken instead; that adjudication would be applicable to the common harm suffered by the class; or that there are not issues pertaining to individuals rather than the class as a whole, and that the class action is more efficient than any alternative.110Fed. R. Civ. P. 23(b). There is no bright line rule on whether “a proposed class definition sweeps too broadly by including persons who could not have been injured by defendant’s conduct.”1111 Joseph M. McLaughlin, McLaughlin on Class Actions § 4.28 (18th ed. 2021). Rather, whether a class definition is overbroad “is a matter of degree that turns on the facts and circumstances of the case.”112Id.
The breadth of the class definition matters because in Spokeo, the Court held that procedural violations are insufficient, without more, to satisfy standing, and TransUnion added that even absent class members need to demonstrate standing before relief is given.113TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2208 (2021); Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016). The TransUnion Court also questioned whether only the representative class member must have standing prior to class certification or whether all plaintiffs are required to show standing.114TransUnion, 141 S. Ct. at 2208 n.4. Thus, breadth of the class definition is a pivotal determination to the action’s success since members of the class must share a common injury.115Id. at 2214 (stating that class members whose biometrics were not disseminated to a third party lacked standing while those whose biometrics were disseminated had standing; class definition was overbroad as it included uninjured members).
i. Class Certification
Because federal courts are only empowered to decide on the merits in cases where plaintiffs suffered a concrete injury, standing at the class certification stage may prove difficult to satisfy if required for absent class members.116Spokeo, 578 U.S. at 341. For example, “[i]n a product defect case . . . even if the product is proven to be defective, the defect might not affect 100% of the units sold.”117William B. Rubenstein, 1 Newberg on Class Actions § 2:3 (6th ed. 2022). Similarly, for a violation of section 15(b) of BIPA, a class representative may show concrete injury from the unauthorized biometric collection while other absent class members are unable.118See id. Since the TransUnion Court declined to answer when absent class members must show standing,119TransUnion, 141 S. Ct. at 2208 n.4. standing for class certification is determined circuit by circuit. The Third, Fifth, Seventh, and Ninth Circuits generally hold that putative absent class members do not need to show sufficient injury prior to class certification.120See Neale v. Volvo Cars of N. Am., LLC, 794 F.3d 353, 362 (3d Cir. 2015); Mims v. Stewart Title Guar. Co., 590 F.3d 298, 308 (5th Cir. 2009) (“Class certification is not precluded simply because a class may include persons who have not been injured by the defendant’s conduct.”); Kohen v. Pac. Inv. Mgmt. Co. LLC, 571 F.3d 672, 676 (7th Cir. 2009); Bates v. United Parcel Serv., Inc., 511 F.3d 974, 985 (9th Cir. 2007). Conversely, the Second, Eighth, and D.C. Circuits tend to require each class member to have standing before certification.121Denney v. Deutsche Bank AG, 443 F.3d 253, 264 (2d Cir. 2006) (stating that while no specific proof is needed, “[t]he class must therefore be defined in such a way that anyone within it would have standing”); Halvorson v. Auto-Owners Ins. Co., 718 F.3d 773, 779–80 (8th Cir. 2013); In re Rail Freight Fuel Surcharge Antitrust Litig.-MDL No. 1869, 725 F.3d 244, 252 (D.C. Cir. 2013) (declaring that class certification necessitates “common evidence [that] show[s] all class members suffered some injury”).
ii. Class Actions and the Constitution
The interaction between class actions and Article III might be one of conflict. Peter Ormerod notes that there is an incentive for a class to forgo alleging specific facts pertaining to each member’s injury since a class with too many individualized injuries will not be certified.122Fed. R. Civ. P. 23(a)(2); see Peter C. Ormerod, Privacy Injuries and Article III Concreteness, 48 Fla. St. U. L. Rev. 133, 161 (2020). However, Article III operates as a barrier in this context because a lack of specificity affects whether an injury is sufficiently concrete for standing.123Ormerod, supra note 121. Tensions are even more pronounced when the standing inquiry comes prior to class certification because the injury must be alleged with enough specificity to show standing for all class members, absent or not, while also not too specific as to preclude certification due to a lack of commonality.124Id. Peter Ormerod goes on to propose an approach where “a court should give effect to Congress’s policy choices.”125Id. at 169. This approach would provide federal jurisdiction for statutory violations.126Id. at 182 (providing federal jurisdiction over “claims arising from legislatively authorized enforcement of digitally- and algorithmically-enabled privacy injuries”).
Another view of this interplay is that courts are primarily concerned over class definition when they examine absent class members for standing.127Rubenstein, supra note 116. Consequently, the standing inquiry is more of a question as to whether Rule 23 is satisfied because “[w]hile Article III requires an ‘injury in fact,’ . . . ‘[f]or purposes of determining standing, [the court] must accept as true all material allegations of the complaint.’”128In re Elec. Books Antitrust Litig., No. 11 MD 2293 DLC, 2014 WL 1641699, at *8 (S.D.N.Y. Apr. 24, 2014) (quoting Denney v. Deutsche Bank AG, 443 F.3d 253, 263 (2d Cir. 2006)); see Rubenstein, supra note 116. At the class certification stage, the court’s interest is in whether the class contains individuals who are incapable of showing injury; thus, whether an absent class member is injured should be viewed in relation to Rule 23, not Article III standing.129Rubenstein, supra note 116. This view recognizes that “unlike the abstract and often politicized nature of standing decisions, class certification focuses a court on pragmatic factors in a familiar and accessible manner.”130Id.
2. Major BIPA Cases
This Section will examine some of the major BIPA cases to provide a general understanding of the state of BIPA litigation. However, these cases were all decided prior to the Supreme Court’s most recent decision in TransUnion. Thus, while still good law, these cases might be decided differently today given the decision in TransUnion that all class members must have a concrete injury.131TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2212–13 (2021).
a. Illinois Appellate Court Case
In Rosenbach v. Six Flags Entertainment Corp.,132129 N.E.3d 1197 (Ill. 2019). amusement park visitors brought a class action against the defendant amusement park company alleging that in violation of BIPA, Six Flags collected visitors’ fingerprints without informed consent.133Id. at 1200–01. The park utilized a system of fingerprint verification to confirm the identity of visitors who purchased “repeat-entry passes to the park.”134Id. While Six Flags acknowledged its BIPA violation, it claimed that there was no concrete injury and therefore, no liability.135Id. at 1204. In holding for plaintiff visitors, the court concluded that limiting recovery under BIPA to only concrete injuries “would require that [the court] disregard the commonly understood and accepted meaning of the term ‘aggrieved,’ . . . and interpret the law in a way that is inconsistent with the objectives and purposes the legislature sought to achieve.”136Id. at 1207. Thus, under Illinois law, any BIPA statutory violation is recoverable even sans specific harm.137Id. This is not the case in federal court.
b. Federal Appellate Court Cases
In Bryant v. Compass Group USA, Inc.,138958 F.3d 617 (7th Cir. 2020). employees brought a class action lawsuit against a vending machine company alleging both a section 15(a) and section 15(b) BIPA violation after the employees’ company placed defendant’s vending machines in the workplace.139Id. at 619–20. To use the vending machines, employees were required to scan their fingerprints.140Id. at 619. Here, the Seventh Circuit Court of Appeals held that the collection of the employees’ fingerprints without consent was sufficient injury for standing because it was “an invasion of [their] private domain, much like an act of trespass would be.”141Id. at 624. The court noted the distinct characteristics of biometric data and acknowledged that a section 15(b) violation is not simply procedural; rather, it is a substantive violation.142Id. The employees were deprived of the ability to make an informed decision as to the disclosure of their unique biometric identifiers.143Id. at 626. As for the employees’ claim of a section 15(a) violation, the court distinguished the employees’ claim that defendant company failed to publish a retention schedule from a claim that it failed to comply with said retention schedule; the former being a duty “owed to the public generally” and thus not sufficient for standing sans concrete harm.144Bryant, 958 F.3d at 626.
The Seventh Circuit dealt with the latter claim—whether failure to comply with a retention schedule created sufficient injury for standing—in Fox v. Dakkota Integrated Systems.145980 F.3d 1146, 1149 (7th Cir. 2020). Similar to Bryant, plaintiff employees alleged that their employer collected their handprints to keep track of the hours each employee spent working.146Id. The court held that “an unlawful retention of a person’s biometric data is as concrete and particularized an injury as an unlawful collection of a person’s biometric data.”147Id. at 1155. Thus, the court reversed the district court’s decision to remand the case to state court.148Id. at 1156.
Moreover, in Thornley v. Clearview AI, Inc.,149984 F.3d 1241 (7th Cir. 2021). plaintiffs alleged that defendant company Clearview violated section 15(c) of BIPA when it collected facial geometric data from pictures on various sites online to store in a database.150Id. at 1246 (alleging that Clearview profited from the social media website users’ biometric identifiers). For a fee, the company provides database access to people who wish to find out information on the people that appear in the stored photo.151Id. at 1243. Once a user uploads a photo, Clearview compares the facial geometry of the person in the photo with pictures in its database and informs the user where the other picture originated.152Id. In a major role reversal, plaintiffs claimed that Clearview did not injure them in a way sufficient for standing while Clearview argued the opposite—plaintiffs do have standing to assert their BIPA violation claim.153Id. at 1242. As described by the Seventh Circuit,
[t]hat peculiar line-up exists for reasons that only a civil procedure buff could love: the case started out in an Illinois state court, but Clearview removed it to federal court. Thornley wants to return to state court to litigate the BIPA claims, but Clearview prefers a federal forum. The case may stay in federal court, however, only if the more stringent federal standards for standing can be satisfied; Illinois (as is its right) has a more liberal attitude toward the kinds of cases its courts are authorized to entertain.154Id.
Like the court’s view on a section 15(a) violation in Bryant, section 15(c) is also a duty owed to the public and without concrete injury there is not sufficient injury for standing.155Thornley, 984 F.3d at 1247; Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020). Consequently, the court of appeals affirmed the district court’s remand of the case to state court where the plaintiffs’ BIPA claim could proceed despite the lack of concrete injury.156Thornley, 984 F.3d at 1248–49.
These cases, taken together, demonstrate the divide between BIPA violations that are thought to be concrete, and the two violations commonly thought to be procedural. However, for a section 15(a) claim, courts have emphasized the language used to describe the violation—a failure to publish a retention and deletion schedule is different than a failure to comply with the published schedule.157Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1154–55 (7th Cir. 2020). This difference matters because only the failure to comply creates a concrete harm.158Id.
II. Two-Tiered Standing Analysis For Biometric Statutory Violations
A two-tier analysis to assess Article III standing for class-action lawsuits alleging a violation of a state’s biometric privacy statute is superior given the unique nature of biometric information. Under the first tier, violations of section 15(b), (d), and (e) of BIPA should be assessed through the established framework of analogizing a biometric injury to an invasion of privacy injury. Under the second tier, injury from violations of section 15(a) and (c)—procedural violations—is analogized to injury from the common law tort of conversion. This Section will focus primarily on section 15(a) and (c) violations because the other sections are routinely viewed as concrete and therefore, recoverable in federal court.159Kloss v. Acuant, Inc., 462 F. Supp. 3d 873, 876 (N.D. Ill. 2020); Thornley, 984 F.3d at 1247; Bryant, 958 F.3d at 626; Cothron v. White Castle Sys., Inc., 467 F. Supp. 3d 604, 613 (N.D. Ill. 2020); Roberson v. Maestro Consulting Servs. LLC, 507 F. Supp. 3d 998, 1010 (S.D. Ill. 2020).
A. The First Tier—Violations of Section 15(b), (d), and (e)
Courts should use the traditional invasion of privacy analogue for the BIPA violations commonly thought of as concrete—section 15(b), (d), and (e).160Bryant, 958 F.3d at 626–27; Cothron, 467 F. Supp. 3d at 613; Roberson, 507 F. Supp. 3d at 1010. Consequently, this Section will be brief as the first tier follows the established framework of using an invasion of privacy analogue.161See, e.g., Patel v. Facebook, Inc., 932 F.3d 1264, 1273 (9th Cir. 2019) (discussing use of an invasion of privacy claim as an analogue for a BIPA violation).
When courts view a statutory BIPA violation as concrete, the invasion of privacy analogue is conducive to standing.162See, e.g., id. When only the named class representative must show standing before the class is certified, the concreteness of the injury caused by a section 15(b), (d), or (e) violation should not be an impediment to certification.163Id. at 1275–76. However, when absent class members must show standing at the class certification stage, potential problems might arise. For example, under section 15(b), a private entity aggrieves a party when it collects a party’s biometric information without first obtaining consent.164740 Ill. Comp. Stat. Ann. 14/15(b) (West 2008). If a court requires individual proof of standing at the class certification stage, absent class members would likely have to show that their biometric information was collected without consent.165See Ormerod, supra note 121, at 161. While not an insurmountably high barrier, the question of when class members must show standing certainly affects whether a class is certified.
B. The Second Tier—Violations of Section 15(a) and (c)
The invasion of privacy analogue for statutory BIPA violations does not work for violations of section 15(a) and (c) because these sections are thought to be procedural; consequently, additional harm is necessary for plaintiffs to have standing.166Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1242–43 (7th Cir. 2021); Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020). Instead of an invasion of privacy analogue, there are two potentially superior common law causes of action that could serve as analogue for a biometric statutory violation: (1) trespass to chattels and (2) conversion. While both have benefits, conversion is superior to trespass to chattels because concrete injury is easier to prove.167See Restatement (Second) of Torts §§ 218, 222A (Am. L. Inst. 1965). Thus, courts should use traditional common law theories of conversion when faced with either a section 15(a) or (c) BIPA violation.
1. Trespass to Chattel
In the well-known torts case Intel Corp. v. Hamidi,16871 P.3d 296 (Cal. 2003). the court examined whether a former employee’s use of his employer’s computer system to send mass emails criticizing the company to 35,000 employees constitutes trespass to chattel.169Id. at 299–302. To grapple with this issue, the court looked at other cases where “[d]ata search and collection robots” gathered data without permission from various company websites.170Id. at 305 & n.4. In the cases that the court examined, trespass to chattels occurred only when the defendant threatened to, or did, impede the normal operations of the plaintiff’s computer system.171Id. at 300. The court distinguished the prior cases from the instant one by pointing to the impairment or substantial deprivation in the former, and the temporary use of the company’s computer system to send the emails in the instant case.172Id. at 306–07. The court also noted that the law of trespass to chattels is primarily concerned with the interference of possession and does not cover receipt of unauthorized electronic communication.173Id. at 308. Although the court considered extending trespass of chattels to the internet, the court decided that any resulting harm does not damage property; accordingly, there was no trespass to chattels.174Hamidi, 71 P.3d at 308–09. Despite denying the company’s trespass to chattels claim, the court considered Professor Richard Epstein’s argument in favor of the expansion.175Id.
Professor Epstein advocated for the inclusion of “web sites and servers” as real property.176Amicus Brief for Cal. Emp. Law Council et al. Supporting Respondent Intel Corp. at 14, Intel Corp. v. Hamidi, 71 P.3d 296 (Cal. 2003) (No. S103781). To him, the “purpose of the law of trespass” is to protect an owner’s property from interference by others and to guard the property owner’s privacy; thus, in Hamidi the owner’s right to exclusive possession is diminished by each person who co-opts Intel Corp.’s computer system to send spam communications.177Id. at 18, 29–30. The failure to recognize this type of damage as trespass results in the disruption of the company for which there is no remedy.178See id. at 19. To rectify this failure, Professor Epstein suggests providing consequential damages for “the loss of good will and morale that necessarily follow when the defendant commandeers its servers and equipment for his own use.”179Id. at 30. Furthermore, recovery is not precluded when the commandeered chattel is still retained by the owner.180Id. Interestingly, Professor Epstein states that when full recovery of damages is impossible, an injunction is an appropriate form of equitable relief.181Id. at 34. Moreover, when an action constitutes a dispossession, then nominal damages are recoverable despite no harm to the chattel itself.182Amicus Brief for Cal. Emp. Law Council et al., supra note 176, at 14 (citing Restatement (Second) of Torts § 218 (Am. L. Inst. 1965)).
However, trespass to chattels does not cover situations where the owner is completely, rather than momentarily, deprived of his property.183See Restatement (Second) of Torts § 218 (Am. L. Inst. 1965). Rather, the tort of conversion covers when there is complete dispossession.184Id. § 222A. The Restatement (Second) of Tortsdescribes conversion as an exercise of the defendant’s dominion or control over the chattel, as distinguished from a mere interference with the chattel itself, or with the possession of it.185Id. In the context of BIPA, the tort of conversion should apply to violations of section 15(a) and (c). The tort of conversion for these procedural BIPA violations aligns with the purpose of trespass to chattels per Professor Epstein’s view—protecting a property owner’s exclusive right of possession and to privacy—while accounting for the complete dispossession that occurs when there is unauthorized use of an individual’s biometrics.186Amicus Brief for Cal. Emp. Law Council et al., supra note 176, at 18, 29–30. Although an individual retains his biometric identifiers, he is forever disposed of his exclusive ownership when there is unauthorized possession.187See Wyman, supra note 1 (“Biometrics, the legislature observes, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.”).
Furthermore, Professor Epstein states that “it is the owner of the chattel that has an interest in exclusive possession”; therefore, recovery must extend to all consequential damages that result.188Amicus Brief for Cal. Emp. Law Council et al., supra note 176, at 18, 26–27. Hamidi highlights the problem with applying the tort of trespass to chattels. There, the court held that the mass spam email communications that Hamidi sent users through the company’s computer systems was not actionable without actual, or threatened injury.189Hamidi, 71 P.3d at 311. In contrast, the tort of conversion—complete dispossession—does not depend on the existence of injury.190See Restatement (Second) of Torts § 222A (Am. L. Inst. 1965). As such, conversion, not trespass to chattels, is the superior cause of action for procedural BIPA violations because the harm is in the act of dispossession; no additional harm is required for standing.191Id.
The American Law of Torts defines conversion as “a wrongful taking, detention, or interference with, or an illegal assumption of ownership or possession, or illegal use or misuse, of the personal property of another.”192Stuart M. Speiser, Charles F. Krause & Alfred W. Gans, 7 American Law of Torts § 24:1, Westlaw (database updated Mar. 2022). The tort of conversion depends on the establishment of exclusive ownership of property.193See Kremen v. Cohen, 337 F.3d 1024, 1030 (9th Cir. 2003). For intangible assets, the critical question is whether a property right exists.194Id. In Kremen v. Cohen,195337 F.3d 1024 (9th Cir. 2003). the Ninth Circuit examined whether (1) a property right in an intangible internet domain name exists, and (2) if so, whether plaintiff could recover under a claim of conversion.196Id. at 1029–30. Regarding the first question, the Ninth Circuit posited a three-part analysis to determine the existence of a property right: “[f]irst, there must be an interest capable of precise definition; second, it must be capable of exclusive possession or control; and third, the putative owner must have established a legitimate claim to exclusivity.”197Id. at 1030. The court held that plaintiff owner had a property right in his internet domain name because it is exactly defined when registered.198Id. Moreover, ownership of a domain name is exclusive since only the registrant may decide where the domain name sends those who follow it.199Id. Lastly, when a domain name is registered, exclusive ownership is apparent since no others may register that same name.200Id. Thus, the court held that the plaintiff had an intangible property right in the internet domain name, and that this property right was sufficient to support a conversion claim.201Kremen, 337 F.3d at 1030.
Biometric identifiers are similarly an intangible property right that can serve as the basis for a claim of conversion. Applying the test in Kremen to biometric identifiers, biometric identifiers are also a well-defined interest since they are “unique to the individual” and capable of being measured through technology.202Wyman, supra note 1 (discussing uniqueness of biometrics); Zimmerman, supra note 5, at 640. In Kremen, the court pointed to corporate shares and land as other types of defined property interests.203Kremen, 337 F.3d at 1030. The commonality between corporate shares, land, and internet domain names is registrability; like these, a person’s biometrics are registered when an individual decides to use his biometrics.204Id.; Apple Inc., About Touch ID Advanced Security Technology (Sept. 11, 2017), https://perma.cc/7B3P-TQPW. For instance, Apple iPhone owners can use their fingerprint to unlock their phones, but only if they first scan their fingerprints; subsequently, the owner’s unique biometric data is stored on the iPhone.205Apple Inc., supra note 203. This completes the act of registration and every time the owner wants to unlock his phone, his fingerprint is compared to the stored biometric data to verify the identity of the owner.206Id.; see also In re Jessica M., 928 N.E.2d 511, 524 (Ill. App. Ct. 2010) (providing an example of biometric identifiers being registered: “In 1989, a working group sponsored by the Federal Bureau of Investigations (FBI) laboratory provided the framework for a combined DNA Index System among crime laboratories to share DNA profiles, much like the fingerprint matching system.”). Ownership of biometric identifiers is also exclusive given that each person’s biometrics are different—they are “biologically unique to the individual.”207Wyman, supra note 1. Additionally, the enactment of BIPA served as recognition that people have a right to control their own biometric information.208Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1206 (Ill. 2019). Finally, owners have a legitimate claim to their own biometric identifiers because sans consent or theft, only they have access to their own biometrics; thus, like in Kremen, others are on notice that an individual’s biometrics are uniquely possessed by that individual.209Kremen v. Cohen, 337 F.3d 1024, 1030 (9th Cir. 2003); see Blake Benson, Recent Development, Fingerprint Not Recognized: Why the United States Needs to Protect Biometric Privacy, 19 N.C.J.L. & Tech. Online Ed. 161, 168 (2018) (suggesting that although biometric information is susceptible to theft, an individual’s biometrics are inherently unique to that individual). Just as an internet domain name is a property right,210Kremen, 337 F.3d at 1030. so too are biometric identifiers.
Furthermore, Kremen demonstrates that an action for conversion is not precluded by the owner retaining access to his property.211Id.; see Amicus Brief for Cal. Emp. Law Council et al., supra note 176, at 30 (In accordance with Professor Epstein’s view). When an owner of an internet domain name is deprived of exclusive control over his property, then this forms the basis for a conversion claim despite the owner retaining access to the property—the owner can still follow the internet domain name to where it leads.212Kremen, 337 F.3d at 1030. In this aspect, conversion of both an internet domain name and biometrics are similar since the owner of either still has access to the property; however, the owner no longer has exclusive ownership.213See id. (suggesting that the right to sell is part of the exclusive right of ownership).
Although historically conversion only applied to tangible property, this distinction is largely irrelevant today.214Id. (“Virtually every jurisdiction, however, has discarded this rigid limitation to some degree.”); see FMC Corp. v. Capital Cities/ABC, Inc., 915 F.2d 300, 304–05 (7th Cir. 1990) (declining to distinguish between tangible and intangible property). Arguments that intangible property cannot be subject to a conversion claim center on whether the intangible property is reflected through something that can be taken from the owner.215See Thrifty-Tel, Inc. v. Bezenek, 54 Cal. Rptr. 2d 468, 472 (App. 1996). The Restatement (Second) of Torts supports the view that intangible property must be merged with some document before a claim for conversion can be successfully brought.216Restatement (Second) of Torts § 242 (Am. L. Inst. 1965). As noted, not many jurisdictions follows this; furthermore, the document does not have to be tangible itself.217Kremen, 337 F.3d at 1034 n.11. For example, in eBay, Inc. v. Bidder’s Edge, Inc.,218100 F. Supp. 2d 1058 (N.D. Cal. 2000). the court held that “electronic signals” are sufficiently tangible.219Id. at 1069. An electronic signal, recorded on an electronic record, can serve as a document.220Kremen, 337 F.3d at 1034 n.11. Likewise, biometric identifiers are stored in a type of electronic record for later use;221Zimmerman, supra note 5, at 657 (fingerprint example). thus, even for the jurisdictions that follow the Restatement, there is a sufficient property right in biometric identifiers to form the basis of a conversion claim.222Benson, supra note 208, at 169 (noting the security issues that arise when biometric information are stored in an unsecured database); see also Apple Inc., supra note 203 (“Your fingerprint data is encrypted, stored on device, and protected with a key available only to the Secure Enclave.”). Whether a person’s biometric information is tangible or intangible, the analysis of a section 15(a) or (c) BIPA violation is similar because, if tangible, then conversion is the appropriate cause of action; if intangible, then under the TransUnion framework, an analogy to common-law conversion works.
III. Application of the Second Tier
This Part begins with an examination of BIPA cases post-TransUnion. The second tier of my framework is applied to one of the post-TransUnion BIPA cases to illustrate the benefits of using a conversion claim or analogue instead of an invasion of privacy analogue. This application will also demonstrate the utility of the second tier in the context of the class action certification inquiry.
A. BIPA Cases after TransUnion
In one of the few biometric cases post-TransUnion, the Seventh Circuit Court of Appeals, while examining whether violation of section 15(d) results in injury sufficient for standing, implied that the holding in Fox regarding section 15(a) is still good law—”that the unlawful retention of biometric data, just like its unlawful collection, works a concrete and particularized Article III injury.”223Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1161 (7th Cir. 2021). Another recent Illinois case looked at section 15(a) as an invasion of privacy harm; however, the court noted that “Illinois’ definition of a right to privacy in the context of BIPA and insurance policies should be the focus, not the interpretation of Article III standing.”224Twin City Fire Ins. Co. v. Vonachen Servs., Inc., 567 F. Supp. 3d 979, 999–1000 (C.D. Ill. 2021). Despite being post-TransUnion, these two cases had expected outcomes.225See, e.g., Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1207 (Ill. 2019); Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1149 (7th Cir. 2020).
1. Procedural BIPA Violations in King v. PeopleNet Corp.
The following case directly addressed the two procedural BIPA violations: section 15(a) and (c).226King v. PeopleNet Corp., No. 21 CV 2774, 2021 U.S. Dist. LEXIS 207694, at *4 (N.D. Ill. Oct. 28, 2021). In King v. PeopleNet Corp.,227No. 21 CV 2774, 2021 U.S. Dist. LEXIS 207694 (N.D. Ill. Oct. 28, 2021). the defendant company provided other companies with biometric devices designed to track how long each employee worked.228Id. at *3–4. Plaintiff worked at a company that utilized the defendant company’s services.229Id. Plaintiff alleged that the defendant biometric provider violated section 15(a) of BIPA by failing to publish a biometric retention and destruction schedule and section 15(c) by profiting from plaintiff’s biometrics.230Id. at *6–11. Here, the court held that because plaintiff alleged only that defendant company failed to publish a public retention and deletion schedule under section 15(a), there was not sufficient injury for standing as the duty to publish a schedule is owed to the public and not just to the individual.231Id. at *6–9; accord Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020). However, the court also noted that plaintiff’s allegation of a section 15(a) violation was conclusory and suggested that the result might be different if plaintiff alleged an unlawful retention.232King, No. 21 CV 2774, at *6–9 (suggesting plaintiff’s allegation that her privacy was violated and was injured did not amount to an allegation that defendant company “unlawfully retained her information”). Similarly, the court held that plaintiff’s section 15(c) claim failed as well, holding that standing under section 15(c) exists
(1) where a collector of biometric data has deprived a plaintiff of the opportunity to profit from her own information; (2) where the sale and dissemination of a plaintiff’s data “amplified the invasion of her privacy that occurred when the data was first collected;” or (3) if a defendant profiting from a plaintiff’s biometric information raises her costs.233Id. at *9–10 (quoting Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1247 (7th Cir. 2021)).
However, if a plaintiff fails to allege any of the three or some other concrete injury, then a plaintiff states only a section 15(c) regulatory violation; therefore, no Article III standing exists.234Id. Although post-TransUnion, this case followed the reasoning of Bryant and Thornley in holding that a procedural violation of BIPA, without more, is insufficient for standing.235Id. at *9–11; Bryant, 958 F.3d at 626; Thornley, 984 F.3d at 1248. While the court did not discuss class certification, absent class members are unlikely to have standing for these two procedural BIPA violations if the named putative class representative cannot prove injury; however, this is not a bright-line rule.236The Second Circuit Court of Appeals held the following: Since class action plaintiffs are not required to have individual standing to press any of the claims belonging to their unnamed class members, it makes little sense to dismiss the state law claims of unnamed class members for want of standing when there was no requirement that the named plaintiffs have individual standing to bring those claims in the first place. Langan v. Johnson & Johnson Consumer Cos., Inc., 897 F.3d 88, 95 (2d Cir. 2018).
Since class action plaintiffs are not required to have individual standing to press any of the claims belonging to their unnamed class members, it makes little sense to dismiss the state law claims of unnamed class members for want of standing when there was no requirement that the named plaintiffs have individual standing to bring those claims in the first place.
Langan v. Johnson & Johnson Consumer Cos., Inc., 897 F.3d 88, 95 (2d Cir. 2018).
2. A Conversion Analogue in King v. PeopleNet Corp.
Using the second tier of this proposed framework, a claim of conversion would have been successful in King v. PeopleNet Corp. The success of a conversion analogue depends on recognizing that people have a property right in their own biometrics,237See Kremen v. Cohen, 337 F.3d 1024, 1030 (9th Cir. 2003). and a person’s biometric identifiers are both permanent and unique to that person.238Adra, supra note 45, at 410. Thus, this property right means that each person has the exclusive right to control the use of his own biometrics.239Kremen, 337 F.3d at 1030. While this Section’s focus is on biometrics as intangible property given the current perception of biometrics,240See, e.g., United States v. Zheng, 762 F.3d 605, 609 (7th Cir. 2014) (stating that biometric information is intangible). if biometric identifiers are considered tangible then the difference is that plaintiffs can simply bring a per se claim of conversion without the need for a common-law analogue to harm akin to that caused by a violation of section 15(a) or (c).241See Restatement (Second) of Torts § 222A (Am. L. Inst. 1965) (discussing the tort of conversion).
a. Section 15(a) BIPA Violations
The court in King held that section 15(a), failure to publish a retention and deletion schedule, is procedural since this regulatory duty is owed to the public.242King v. PeopleNet Corp., No. 21 CV 2774, 2021 U.S. Dist. LEXIS 207694, at *6–9 (N.D. Ill. Oct. 28, 2021). However, as the exclusive owner, a person that permits a company to collect his biometrics does so under specific terms—a company must publish guidelines for the destruction of the collected biometrics “when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first.”243740 Ill. Comp. Stat. Ann. 14/15(a) (West 2008). While this duty is owed to the public, this does not necessarily mean that a violation is insufficient for standing without an additional harm.244Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020).
Instead of an invasion of privacy analogy,245Twin City Fire Ins. Co. v. Vonachen Servs., Inc., 567 F. Supp. 3d 979, 999–1000 (C.D. Ill. 2021) (stating invasion of privacy does not go to interpreting Article III standing). an analogy to conversion overcomes the impediment caused by the standing requirement of additional harm. When a company fails to publish a retention schedule and deletion guidelines, the company wrongfully detains the biometrics provided by its exclusive owner.246Speiser et al., supra note 191 (conversion as wrongful detention of property). The owner provided his property on the specific terms set forth under BIPA; as such, there is an expectation that the terms are followed and his biometrics will not be kept for longer than needed.247740 Ill. Comp. Stat. Ann. 14/15(b)(2) (West 2008). Perhaps companies willingly destroy their collected biometric identifiers; however, without a published policy, this is uncertain. Due to the uncertainty, an owner’s control over his own biometrics is interfered with because he no longer has exclusive control over his property—the company has indefinitely interfered with his exclusive right.248740 Ill. Comp. Stat. Ann. 14/5(c) (West 2008) (biometric identifiers are unique: “[O]nce compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.”). As the Restatement (Second) of Torts states, “[w]here the trespass to the chattel is a dispossession, the action will lie although there has been no impairment of the condition, quality, or value of the chattel, and no other harm to any interest of the possessor.”249Restatement (Second) of Torts § 218 (Am. L. Inst. 1965). When dispossession occurs, recovery of nominal damages is possible regardless of how long the dispossession lasts.250Id. This accords with Kremen since a person can be deprived of exclusive control over his property despite retaining it in his possession.251Kremen v. Cohen, 337 F.3d 1024, 1030 (9th Cir. 2003). Therefore, a company’s failure to publish retention and destruction guidelines acts as an indeterminate dispossession of a person’s exclusive property right in his biometric identifiers and no additional harm is necessary.252See Restatement (Second) of Torts § 218 (Am. L. Inst. 1965). The benefit of a conversion analogue is that under Spokeo and TransUnion, a section 15(a) BIPA violation creates per se harm even though it is a procedural violation; thus, injury sufficient for standing exists.253TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2204 (2021); Spokeo, Inc. v. Robins, 578 U.S. 330, 340–42 (2016) (stating that if an intangible harm has a closely related harm at common law, standing is more likely to exist).
b. Section 15(c) BIPA Violation
Likewise, the court in King viewed a section 15(c) violation, profiting from another’s biometric information, as insufficient injury for standing without an allegation of some other concrete harm.254King v. PeopleNet Corp., No. 21 CV 2774, 2021 U.S. Dist. LEXIS 207694, at *9–11 (N.D. Ill. Oct. 28, 2021). Although the court listed three ways that plaintiff could have alleged a section 15(c) violation that would constitute concrete injury,255Id. (quoting Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1247 (7th Cir. 2021)). using an analogy to a conversion claim overcomes the standing hurdle given that plaintiffs have the exclusive right to control their own biometric identifiers.256See Restatement (Second) of Torts § 222A (Am. L. Inst. 1965) (discussing the tort of conversion). Consequently, plaintiffs are injured when a company sells these identifiers to others in an exercise of complete dominion over the owner of biometrics.257See id. While this arguably renders a section 15(c) violation as per se injurious, this is appropriate given that the “full ramifications of biometric technology are not fully known.”258740 Ill. Comp. Stat. Ann. 14/5(f) (West 2008). At minimum, there is recognition that biometric identifiers can be forever compromised;259740 Ill. Comp. Stat. Ann. 14/5(c) (West 2008). thus, more deference to plaintiffs that adequately allege a statutory BIPA violation is needed to ensure that large corporations do not leave plaintiffs without recourse.
B. Class Actions
Furthermore, while not addressed in King, a class is more likely to receive certification for all class members, including absent unnamed class representative, if the standing inquiry comes first since conversion requires no additional harm to constitute concrete injury.260Restatement (Second) of Torts §§ 218, 222A (Am. L. Inst. 1965). Depending on how the resulting injury is viewed, either as a specific injury or a more general injury,261Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1247 (7th Cir. 2021) (discussing a duty owed to public or a duty owed to an individual). absent class members may not be able to show standing at the class certification stage under the invasion of privacy framework. Instead, conceptualizing these violations as akin to conversion rather than an invasion of privacy is superior given the permanence and unique characteristics of biometric information.262SeeAdra, supra note 45, at 410. Thus, the benefit of viewing section 15(a) and (c) violations as or analogous to conversion is that, at least at the class certification stage, standing should not be as high of a barrier for absent class members. As a conversion of a party’s property, injury is easier to prove—when a private entity collects the biometric information of an absent party, but fails to publish a retention schedule, then that entity wrongfully interferes with the absent party’s property.263See Masciandaro, supra note 87, at 1274 (“By deleting information, a business ensures it is not infringing on property rights that exclude unwanted possession, use, or interference.”).
IV. Concluding Remarks
Part IV briefly discusses possible next steps while acknowledging some of the issues that remain. First, limitations are examined. Then, possible areas of improvements going forward are discussed.
Until recognition of the special nature of biometric identifiers occurs, the ability to test the application of a conversion analogue for BIPA class actions is limited. Additionally, the distinction between a tangible property right and an intangible property right has ramifications despite the analysis of the existence of a property right remaining the same. As an intangible property right, jurisdictions that follow the Restatement (Second) of Torts will require biometric identifiers to be merged with some type of document.264Restatement (Second) of Torts § 242 (Am. L. Inst. 1965). Whether electronic signals or records constitute a type of document depends on the court’s perspective;265SeeeBay, Inc. v. Bidder’s Edge, Inc., 100 F. Supp. 2d 1058, 1069 (N.D. Cal. 2000). although, since biometric identifiers are typically registered and stored in some type of database,266See Apple Inc., supra note 203 (explaining an example of the iPhone fingerprint technology). it seems likely that courts following the Restatement will view this as constituting a merger.
Moreover, using conversion as an analogue will likely be met with resistance by companies that operate in Illinois.267Anna L. Metzger, Comment, The Litigation Rollercoaster of BIPA: A Comment on the Protection of Individuals from Violations of Biometric Information Privacy, 50 Loy. U. Chi. L.J. 1051, 1092 (2019). These companies may be worried about the economic consequences of running afoul of BIPA since under a conversion analogue, the standing hurdle for plaintiffs is lower.268Id. Although valid, this concern is likely overstated. Not only is it relatively simple to comply with the five BIPA requirements, it is also in the company’s best interest given that the alternative is a potentially devastating class action against the company.269Id. at 1092–93. Additionally, even if operating costs rise, “whatever expenses a business might incur to meet the law’s requirements are likely to be insignificant compared to the substantial and irreversible harm that could result if biometric identifiers and information are not properly safeguarded.”270Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1207 (Ill. 2019).
B. Next Steps
For now, this framework offers courts a starting place to begin thinking about how biometric identifiers are different from other personal identifiable information like social security numbers. Biometric identifiers are becoming more and more pervasive despite the inability to comprehend the potential consequences that will result as technology grows and changes.271740 Ill. Comp. Stat. Ann. 14/5(a) (West 2008). Moreover, as additional time passes from when TransUnion was decided, there will likely be more opportunities to examine the decision’s effect on class action BIPA claims in federal court. Presently, it is worth noting another possible solution that recognizes the harm caused by a statutory BIPA violation—injunctive relief. As an alternative, injunctive relief cannot ensure full recovery of harm because once a person’s biometric identifiers are compromised the person is forever disposed of exclusive ownership; still, it may be useful where damages are inadequate or not feasible.272Amicus Brief for Cal. Emp. Law Council et al., supra note 176, at 34.
The unique nature of biometric information necessitates a different response to statutory biometric violations than if the violation only concerned data such as one’s address or credit card information. When a statutory biometric violation occurs, the denial of federal jurisdiction is inappropriate. Although Article III standing must be demonstrated, recognition that biometric information is distinct serves as a bridge between arguably procedural violations and concrete injuries. For absent class members who may not be able to show specific instances of harm outside of, for example, unauthorized profiting, the proposed two-tier analysis offers a solution. By analogizing procedural violations of BIPA to the common law tort of conversion, all absent class members can show a concrete harm. Under this framework, absent class member would satisfy standing prior to class certification more readily and thus, recovery will not be precluded.