Seventh Circuit dubious of data collection class action

CHICAGO (CN) — A Seventh Circuit panel on Monday appeared apprehensive about whether it was the appropriate venue to adjudicate an underlying biometrics class action against a computer software company.

An Illinois woman brought a class action against Nuance Communications in 2021, claiming that the Massachusetts-based software company wrongfully retained a recording of her voice while serving as a vendor for Charles Schwab bank.

Schwab contracted with Nuance for its voice recognition technology that would allow the bank’s customers to verify their identity on the phone. Nuance, however, failed to disclose that it would collect and store customers’ voiceprints in a database — in violation of the Illinois Biometric Information Privacy Act, or BIPA.

A lower court dismissed the class action against Nuance Communications last year, finding that because Nuance was a technology vendor to Schwab, it should be considered a financial institution and therefore immune to BIPA suits. Financial institutions are considered immune from BIPA due to the Gramm-Leach-Bliley Act, a 1999 federal law that governs how banks collect, store and share customers’ personal information.

Illinois lawmakers enacted the BIPA in 2008 to regulate the use and collection of its citizens’ biometrics, which include finger prints, facial geometry scans and voiceprints. The law requires businesses to obtain written consent to obtain peoples’ biometrics, and it has been the center of thousands of lawsuits against businesses from employees and customers alike.

Plaintiffs’ attorney Michael Wise argued in court Monday that the lower court erred in its interpretation of the GLBA exception as it relates to Nuance Communications, but the three-judge panel wasn’t so sure how his argument could prevail or whether he had sufficient standing to make it.

Wise said, in particular, that Nuance had an independent duty to obtain consent before capturing customers’ biometrics.

“Why? What in the state law requires Nuance to obtain consent when its Schwab who deals with a customer?” U.S. Circuit Judge Frank Easterbrook, a Ronald Reagan appointee, asked.

“The law — BIPA is agnostic whether or not it’s with the customer,” Wise responded.

Annie Kastanek, a Jenner Block attorney representing Nuance, argued in a brief that because the company’s authentication services fall under the GLBA’s definition of financial activity, it should be exempt from BIPA.

The panel of judges repeatedly pressed the attorneys on how Nuance Communications could address the supposed injury of retaining customers data, which neither could answer concretely.

“Can you explain in your own words why you think that’s an injury in fact?” Easterbrook asked Kastanek.

“The allegations of retaining data beyond a period of time that’s allowed and promising to delete that data is akin to an invasion of privacy, cause of action,” she responded.

“Retaining something is not the invasion of privacy,” Easterbrook responded. “If I get a secret fact about you, and I never tell anybody, I’ve retained it in my memory and not purged it from my memory … the getting of it may be a legal wrong, but my retaining it in my head is not illegal wrong.”

Kastenak mentioned a previous opinion from the court, which held that the unlawful retention of biometric data inflicts a privacy injury in the same way that actual collection does.

“So, you think if I know a fact about you and I remember it for the rest of my life, I’m violating your rights for the rest of my life because you were injured for the rest of your life?” Easterbrook said.

Joining Easterbrook on the panel was U.S. Circuit Judge Joshua Kolar, a Joe Biden appointee, and U.S. Circuit Judge Michael Scudder Jr., a Donald Trump appointee. The panel directed the parties to file supplemental briefings within the next two weeks to determine if the court has proper standing to adjudicate the matter, at which point it will take the case under advisement.

Follow @RosenCaitlyn