Christine Bryant v. Compass Group U.S.A., Inc.

• Court: Court of Appeals for the Seventh Circuit
• Decided: May 5, 2020
• Docket: 20-1443
• Status: Published

Opinion

In the

United States Court of Appeals For the Seventh Circuit ____________________ No. 20-1443 CHRISTINE BRYANT, Plaintiff-Appellee, v.

COMPASS GROUP USA, INC., Defendant-Appellant. ____________________

Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 19 C 6622 — Virginia M. Kendall, Judge. ____________________

ARGUED APRIL 24, 2020 — DECIDED MAY 5, 2020 ____________________

Before WOOD, Chief Judge, and RIPPLE and ROVNER, Circuit Judges. WOOD, Chief Judge. Section 15(b) of Illinois’s Biometric In- formation Privacy Act (BIPA), 740 ILCS 14 (2008), regulates the collection, use, and retention of a person’s biometric iden- tifiers or information. It requires collectors of this material to obtain the written informed consent of any person whose data is acquired. This regime is designed to protect consumers against the threat of irreparable privacy harms, identity theft, 2 No. 20-1443

and other economic injuries arising from the increasing use of biometric identifiers and information by private entities. As a matter of state law, anyone “aggrieved” by a violation of the disclosure and informed consent obligations is entitled to bring a private action against the alleged offender. The ques- tion now before us is whether, for federal-court purposes, such a person has suffered the kind of injury-in-fact that sup- ports Article III standing. We conclude that a failure to follow section 15(b) of the law leads to an invasion of personal rights that is both concrete and particularized. See Spokeo, Inc. v. Rob- ins, 136 S. Ct. 1540 (2016). We therefore reverse the district court’s order remanding this case to state court and remand for further proceedings. I The underlying facts of the case are straightforward. Christine Bryant worked for a call center in Illinois. As a con- venience for its employees, the center had a workplace cafe- teria, in which it had installed Smart Market vending ma- chines owned and operated by Compass Group USA, Inc. The machines did not accept cash; instead, a user had to establish an account using her fingerprint. Accordingly, during her ori- entation Bryant and her coworkers were instructed by their employer to scan their fingerprints into the Smart Market sys- tem and establish a payment link to create user accounts. Once their accounts were active, employees could purchase items and add money to their balance using just their finger- prints. Their fingerprints are “biometric identifiers” within the meaning of the Act. 740 ILCS 14/10. In violation of section 15(a) of BIPA, id. § 15(a), Compass never made publicly available a retention schedule and No. 20-1443 3

guidelines for permanently destroying the biometric identifi- ers and information it was collecting and storing. In addition, in violation of section 15(b), Compass never: (1) informed Bry- ant in writing that her biometric identifier (fingerprint) was being collected or stored, (2) informed Bryant in writing of the specific purpose and length of term for which her fingerprint was being collected, stored, and used, or (3) obtained Bryant’s written release to collect, store, and use her fingerprint. Id. § 15(b). Bryant does not assert that she did not know that her fin- gerprint was being collected and stored, nor why this was happening. She voluntarily created a user account for the Smart Market vending machines and regularly made use of the fingerprint scanner to purchase items from the machines. She contends simply that Compass’s failure to make the req- uisite disclosures denied her the ability to give informed writ- ten consent as required by section 15(b). Compass’s failure to comply with the Act resulted, both for her and others simi- larly situated, in the loss of the right to control their biometric identifiers and information. Seeking redress for that invasion of her personal data, on August 13, 2019, Bryant brought a putative class action against Compass in the Circuit Court of Cook County, pursu- ant to BIPA’s provision providing a private right of action in state court to persons “aggrieved” by a violation of the stat- ute. See 740 ILCS 14/20; Rosenbach v. Six Flags Entm’t Corp., 432 Ill. Dec. 654 (Ill. 2019). Bryant seeks to represent a class of Illi- nois citizens who used Compass’s Smart Market biometric- enabled vending machines after August 2014. She alleges that Compass violated her and class members’ statutory rights un- der BIPA when it collected users’ fingerprints without first 4 No. 20-1443

making the required written disclosures about use and reten- tion and without written authorization. See 740 ILCS 14/15(a)–(b). For purposes of the standing issue before us, we accept Bryant’s allegations as true. Compass removed the action to federal court under the Class Action Fairness Act (CAFA), 28 U.S.C. § 1332(d), on the basis of diversity of citizenship and an amount in controversy exceeding $5 million. Compass is incorporated in Delaware and has its principal place of business in North Carolina; Bry- ant is a citizen of Illinois. This is enough to assure the minimal diversity required by CAFA. The requisite amount in contro- versy is also secure: claims of individual class members are aggregated for purposes of CAFA, see 28 U.S.C. § 1332(d)(6), and here, BIPA authorizes statutory damages of $5,000 for each intentional or reckless violation. 740 ILCS 14/20(1)–(2). Compass asserts, and Bryant does not contest, that the alleged class has at least 1,000 members. Bryant moved to remand the action to the state court, claiming that the district court did not have subject-matter ju- risdiction because she lacked the concrete injury-in-fact nec- essary to satisfy the federal requirement for Article III stand- ing. (State law apparently poses no such problem, we note, as the Illinois Supreme Court pointed out in Rosenbach.) The district court found that Compass’s alleged violations of sections 15(a) and (b) were bare procedural violations that caused no concrete harm to Bryant; accordingly, it remanded the action to the state court. Compass petitioned this court for permission to appeal the remand order under 28 U.S.C. § 1453(c); on March 13, 2020, we accepted the appeal. No. 20-1443 5

II A As the party invoking federal jurisdiction, Compass bears the burden of establishing Bryant’s Article III standing. See Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th Cir. 2018) (per curiam). This fact has occasioned a role reversal in the argu- ments we normally see in these cases, with the defendant in- sisting that Article III standing is solid, and the plaintiff cast- ing doubt on it. For Bryant to have Article III standing, three requirements must be satisfied: (1) she must have suffered an actual or im- minent, concrete and particularized injury-in-fact; (2) there must be a causal connection between her injury and the con- duct complained of; and (3) there must be a likelihood that this injury will be redressed by a favorable decision. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992). Only the first of those criteria is at issue here: any injury she suffered was caused directly by Compass’s failure to comply with BIPA, and the prospect of statutory damages shows that such an in- jury is redressable. In Spokeo, the Supreme Court explained that a “concrete” injury must actually exist but need not be tangible. 136 S. Ct. at 1548–49. A legislature may “elevate to the status of legally cognizable injuries concrete, de facto injuries that were previ- ously inadequate in law.” Id. (quoting Lujan, 504 U.S. at 578). But “a bare procedural violation, divorced from any concrete harm,” does not “satisfy the injury-in-fact requirement of Ar- ticle III.” Id. “Instead, the plaintiff must show that the statu- tory violation presented an ‘appreciable risk of harm’ to the underlying concrete interest that [the legislature] sought to 6 No. 20-1443

protect by enacting the statute.” Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 887 (7th Cir. 2017) (quoting Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 (7th Cir. 2016)). Compass urges that BIPA has elevated to protectible status a person’s inherent right to control her own body, including the associated biometric identifiers and information. The vio- lation or trespass upon that right, it reasons, is a concrete in- jury-in-fact for standing purposes. Compass relies on the Illi- nois Supreme Court’s recent decision in Rosenbach, in which that court decided who qualifies as an “aggrieved” person for purposes of a state-court action pursuant to BIPA. The state supreme court had no cause to consider Article III standing requirements, but Compass argues that its conclusions about the interests BIPA was intended to protect nonetheless shed light on the question before us. In Rosenbach, the plaintiff alleged that defendant Six Flags violated the procedures spelled out in section 15(b). 432 Ill. Dec. at 658–59. Six Flags argued that the plaintiff had to allege more in order to pursue her action—some tangible injury or harm. Id. at 659. The Illinois appellate court agreed with that contention, but the Illinois Supreme Court reversed, explain- ing that it is the well-established understanding in Illinois that “a person is prejudiced or aggrieved, in the legal sense, when a legal right is invaded by the act complained of or his pecu- niary interest is directly affected by the decree or judgment.” Id. at 662 (internal citation and quotation marks omitted). Be- cause section 15(b) of BIPA confers a right to receive certain information from an entity that collects, stores, or uses a per- son’s biometric information, the violation of that right, stand- ing alone, is an actionable grievance. Id. at 663. No. 20-1443 7

Compass highlights the fact that the Illinois Supreme Court recognized that “[t]hrough the Act, our General Assem- bly has codified that individuals possess a right to privacy in and control over their biometric identifiers and biometric in- formation.” Id. A key part of the right to control biometric in- formation is “the power to say no by withholding consent.” Id. When an entity fails to adhere to the statutory procedures and thereby denies someone the ability to make an informed decision about whether to provide her biometric identifier, “the right of the individual to maintain his or her biometric privacy vanishes into thin air” and “[t]he precise harm the Il- linois legislature sought to prevent is then realized.” Id. (in- ternal citation and quotation marks omitted). And as Com- pass emphasizes, the court declared that such a violation “is no mere ‘technicality.’ The injury is real and significant.” Id. In Compass’s view, the Illinois Supreme Court’s characteriza- tion of BIPA’s purpose and the nature of the injury is dispos- itive. Helpful though Rosenbach may be, however, we cannot un- critically assume perfect overlap between the question before the state court and the one before us. As we alluded to earlier, standing requirements in Illinois courts are more lenient than those imposed by Article III. See Greer v. Illinois Hous. Dev. Auth., 122 Ill. 2d 462, 491 (1988) (“We are not, of course, re- quired to follow the Federal law on issues of justiciability and standing.”); Duncan v. FedEx Office and Print Servs., Inc., 429 Ill. Dec. 190, 197 (Ill. App. Ct. 2019) (“Illinois courts generally are not as restrictive as federal courts in recognizing the standing of a plaintiff to bring a claim. Although federal law and Illinois law both require an ‘injury in fact’ to find stand- ing, it does not necessarily mean that both forums define that 8 No. 20-1443

requirement in the same way.” (internal citations and quota- tion marks omitted)). As understood by Illinois courts, for an injury-in-fact to be considered “‘actual’ does not mean that a wrong must have been committed and an injury inflicted; ra- ther, the term requires a showing that the underlying facts and issues of the case are not moot or premature.” Messenger v. Edgar, 157 Ill. 2d 162, 170 (1993). In short, federal courts and Illinois courts define “injury- in-fact” differently. With this in mind, we must inde- pendently determine whether the BIPA violations Bryant al- leges suffice to support Article III standing. B There have been only a few BIPA cases in federal circuit courts; none has decided the precise standing question pre- sented here. We describe them briefly in order to show how far they did, or did not, go. In Miller v. Southwest Airlines Co., 926 F.3d 898 (7th Cir. 2019), we held that union airline workers had standing to bring claims of violations of sections 15(a) and (b) of BIPA in federal court. We found that the workers had alleged the “concrete dimension” necessary to establish Article III injury- in-fact because they faced the “prospect of a material change in [their] terms and conditions of employment,” if the em- ployer, in light of the Act, had to bargain with the employee union to obtain employees’ consent or change how employees clocked in. Id. at 902. Additionally, the employees alleged a heightened risk of improper dissemination of biometric infor- mation if the employers were “not following the statutory data-retention limit and … used outside parties to administer their timekeeping systems.” Id. No. 20-1443 9

In Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019), the Ninth Circuit held that plaintiffs alleged a sufficiently con- crete injury for Article III standing purposes when they claimed that Facebook’s use of facial-recognition technology without users’ informed consent violated Illinois’s BIPA. The court concluded that the common-law right to privacy sup- plied a concrete interest that was infringed by an “invasion of an individual’s biometric privacy rights.” Id. at 1273. It also noted that the BIPA provisions at issue were intended “to pro- tect an individual’s ‘concrete interests’ in privacy, not merely procedural rights.” Id. at 1274. In contrast, in a nonprecedential disposition the Second Circuit concluded that a plaintiff bringing Illinois BIPA claims against a video-game company lacked Article III standing be- cause none of the alleged procedural violations raised “a ma- terial risk of harm” to a plaintiff’s interest in “prevent[ing] the unauthorized use, collection, or disclosure of an individual’s biometric data.” Santana v. Take-Two Interactive Software, Inc., 717 F. App’x 12, 15 (2d Cir. 2017) (summary order). The alle- gations showed that the plaintiff had already given as much consent as one could imagine, by agreeing to the scan of his face, sitting still for fifteen minutes while the scan took place, and creating his game avatar for use in online games. All that was left was a bare procedural violation. The majority of the district courts in this circuit have re- jected standing for plaintiffs alleging only violations of sec- tions 15(a) and (b), without some further harm. See Hunter v. Automated Health Sys., Inc., 2020 WL 833180 (N.D. Ill. Feb. 20, 2020); Colon v. Dynacast, LLC, 2019 WL 5536834 (N.D. Ill. Oct. 17, 2019); McGinnis v. United States Cold Storage, Inc., 382 F. Supp. 3d 813 (N.D. Ill. 2019); Aguilar v. Rexnord LLC, 2018 WL 10 No. 20-1443

3239715 (N.D. Ill. July 3, 2018); Goings v. UGN, Inc., 2018 WL 2966970 (N.D. Ill. June 13, 2018); Howe v. Speedway LLC, 2018 WL 2445541 (N.D. Ill. May 31, 2018); McCollough v. Smarte Carte, Inc., 2016 WL 4077108 (N.D. Ill. Aug. 1, 2016); but see Figueroa v. Kronos Inc., 2020 WL 1848206 (N.D. Ill. Apr. 13, 2020). These decisions are not binding on us, however, and they did not rest on the nature of the interest BIPA seeks to protect—personal or public (see Spokeo, Thomas, J., concur- ring), informational, or formal. We consider this a question of first impression. C Our starting point is Spokeo itself, which provides substan- tial guidance about cases alleging the kind of intangible harm to personal interests that Bryant asserts. In addition, her right- to-control claim is fundamentally about the informed consent requirement in section 15(b); this gives rise to a question about informational injury, and more broadly about how Compass’s collection, storage, and use of Bryant’s fingerprint, even for purposes of which she was fully aware, might be a concrete injury either because it is closely analogous to histor- ical claims for invasion of privacy or because she lost her right to control her own biometric information and effectively yielded it to Compass. We begin with a closer look at Spokeo, and we then look at other examples of the harm (or lack thereof) from a company’s failure to disclose information it was obligated by law to provide to a consumer. The statute at issue in Spokeo was the Fair Credit Reporting Act (FCRA). Spokeo was a company that called itself a “peo- ple search engine.” Customers could ask it to scour a wide variety of sources for information about someone, and it No. 20-1443 11

would return a report to them. Someone asked Spokeo to pre- pare such a report on plaintiff Robins. It did so, and Robins eventually found out about the report, which he said was rid- dled with inaccuracies. Citing a number of injuries that he al- leged this report had inflicted, or would inflict upon him, no- tably a number of adverse effects on his ongoing job search, Robins filed a suit against Spokeo under FCRA. The district court dismissed his action for lack of Article III standing, but the Ninth Circuit reversed. The Supreme Court took the case to consider the standing issue. In the end, it did not rule one way or the other on Robins’s standing. It found instead that the Ninth Circuit had used the wrong test for injury-in-fact. That court had focused exclu- sively on the question whether Robins had alleged a particu- larized harm, which the Supreme Court was willing to assume that he had. But, while necessary, the Court held that this was not sufficient. 136 S. Ct. at 1548. Article III also requires an in- jury that is concrete. Explaining, the Court said that “[a] ‘con- crete’ injury must be ‘de facto’; that is, it must actually exist.” Id. But, it added, “‘[c]oncrete’ is not, however, necessarily syn- onymous with ‘tangible.’ Although tangible injuries are per- haps easier to recognize, we have confirmed in many of our previous cases that intangible injuries can nevertheless be concrete.” Id. at 1549. In addition, the risk of real harm can suf- fice, id., and injury-in-fact is not defeated just because the in- jury is “difficult to prove or measure,” id. Because the court of appeals failed to address the concrete- ness criterion, the Supreme Court thought it best to remand for application of the proper test. In essence, the task was to decide whether, in the relevant part of FCRA, Congress had identified a concrete injury that met Article III minima and 12 No. 20-1443

created a right for people in Robins’s position to sue on that claim, or if Robins was complaining about no more than a “bare procedural violation,” id. at 1550, which would not be enough to engage the judicial power.1 Justice Thomas joined the majority’s opinion, but he added a concurrence that drew a useful distinction between two types of injuries. The first, he said, arises when a private plaintiff asserts a violation of her own rights; the second oc- curs when a private plaintiff seeks to vindicate public rights. As examples of the first, he mentioned actions for trespass, infringement of intellectual property rights, and unjust en- richment, id. at 1551; as examples of the second, he pointed to actions seeking to abate a public nuisance, or disputes over the use of public land, id. at 1551–52. Applying Justice Thomas’s rubric, we have no trouble con- cluding that Bryant was asserting a violation of her own rights—her fingerprints, her private information—and that this is enough to show injury-in-fact without further tangible consequences. This was no bare procedural violation; it was an invasion of her private domain, much like an act of trespass would be. Each individual person has distinct biometric iden- tifiers. The common interest in robust protections of personal privacy, however, is the same as the shared support for the types of laws Justice Thomas mentioned. A direct application of Spokeo, in our view, leads to the result that Bryant satisfied the injury-in-fact requirement of Article III.

1 On remand, the Ninth Circuit concluded that Robins had adequately

alleged both a concrete and a particular interest for Article III purposes, and so it found that he had standing to sue. Robins v. Spokeo, Inc., 867 F.3d 1108, 1118 (9th Cir. 2017), cert. denied, 138 S. Ct. 931 (2018). No. 20-1443 13

If we instead analyze this case as a type of informational injury, we come to the same conclusion. Usually these cases arise when information that is required by statute to be dis- closed to the public is withheld. See, e.g., Fed. Election Comm’n v. Akins, 524 U.S. 11, 19–25 (1998). The injury inflicted by non- disclosure is concrete if the plaintiff establishes that the with- holding impaired her ability to use the information in a way the statute envisioned. See Bensman v. U.S. Forest Serv., 408 F.3d 945, 955–56 (7th Cir. 2005); see also Akins, 524 U.S. at 20– 21 (plaintiffs’ inability to obtain information with which they could more effectively evaluate candidates for public office “is injury of a kind that [the Federal Election Campaign Act] seeks to address”); Pub. Citizen v. U.S. Dep’t of Justice, 491 U.S. 440, 449 (1989) (“[R]efusal to permit appellants to scrutinize the [American Bar Association] Committee’s activities to the extent [the Federal Advisory Committee Act] allows consti- tutes a sufficiently distinct injury to provide standing to sue.”). Our recent decisions on informational injuries are instruc- tive. In Groshek v. Time Warner Cable, the plaintiff argued that his prospective employer violated FCRA’s requirement that an employer seeking to obtain a consumer report on a pro- spective employee had to give the applicant a stand-alone written disclosure stating that a consumer report may be ob- tained. 865 F.3d at 884–89. Instead of a stand-alone disclosure document, Time Warner provided Groshek with a document that contained the required disclosure as well as other infor- mation. Groshek signed the form, thereby authorizing Time Warner to obtain his consumer report. We concluded that Time Warner’s violation of the stand-alone disclosure require- ment inflicted only “a statutory violation completely removed from any concrete harm or appreciable risk of harm.” Id. at 14 No. 20-1443

887. Critically, FCRA “does not seek to protect Groshek from the kind of harm he claims he has suffered, i.e., receipt of a non-compliant disclosure.” Id. at 888. Instead, the purpose of FCRA is “to decrease the risk that a job applicant would un- knowingly consent to allowing a prospective employer to procure a consumer report.” Id. Groshek did not allege that he was unable to give knowing and informed consent because the disclosure document he received also contained other in- formation; thus, he did not allege a concrete injury that Con- gress made cognizable. In Robertson v. Allied Solutions, LLC, 902 F.3d 690 (7th Cir. 2018), in contrast, a company failed to provide a prospective employee with a copy of her background report before re- scinding her employment offer on the basis of information contained in that report. We held that this omission consti- tuted an injury-in-fact for a FCRA claim. Robertson’s informa- tional injury was both particularized and concrete because she had a “substantive interest,” protected by FCRA, in being able to “review the reason for any adverse decision and to re- spond.” Id. at 696. The critical question, we said, is whether “the plaintiff is entitled to receive and review substantive in- formation.” Id. at 697 (emphasis added). “Article III’s stric- tures are met not only when a plaintiff complains of being de- prived of some benefit, but also when a plaintiff complains that she was deprived of a chance to obtain a benefit.” Id. Ac- cordingly, it was “immaterial” that Robertson did not plead what she would have done if she had been given the chance to respond. Id. It was sufficient that Robertson, unlike Groshek, was wholly deprived of the information necessary to respond in the way FCRA contemplated. No. 20-1443 15

It is possible, however, to plead oneself out of court. That is what happened in Casillas v. Madison Avenue Associates, 926 F.3d 329 (7th Cir. 2019). In that case, a debt collector failed to inform a debtor that any response to its debt collection notice needed to be in writing, as the Fair Debt Collection Practices Act required. We drew a contrast between the substantive in- formation the plaintiff in Robertson was denied—information on which her prospective employer relied when rescinding her employment offer—and the purely procedural flaw in Casillas’s case. Casillas pointed to nothing that hinged on the difference between oral and written notice and gave no reason to think that any harm resulted from the type of notice she received. Id. at 334–35. Indeed, she admitted that no amount of notice or information would have changed her behavior. In those circumstances, Casillas lacked standing to sue the debt collector for its technical violation of the Act. Id. at 335. Returning to the facts presented here, the substantive and personal nature of the information Compass was obligated under BIPA to disclose to consumers such as Bryant makes this case more like Robertson than Casillas for purposes of her claim under section 15(b). As the Illinois Supreme Court rec- ognized in Rosenbach, the informed-consent regime laid out in section 15(b) is the heart of BIPA. The text of the statute demonstrates that its purpose is to ensure that consumers un- derstand, before providing their biometric data, how that in- formation will be used, who will have access to it, and for how long it will be retained. The judgment of Illinois’s General As- sembly is that the sensitivity of biometric information and the risk of identity theft or other privacy or economic harm that may result from its dissemination, necessitates that people be given the opportunity to make informed choices about to whom and for what purpose they will relinquish control of 16 No. 20-1443

that information. Compass’s failure to abide by the require- ments of section 15(b) before it collected Smart Market users’ fingerprints denied Bryant and others like her the oppor- tunity to consider whether the terms of that collection and us- age were acceptable given the attendant risks. This was not a failure to satisfy a purely procedural re- quirement. Rather, as in Robertson, Compass withheld sub- stantive information to which Bryant was entitled and thereby deprived her of the ability to give the informed consent section 15(b) mandates. Equipped with the missing information, she may have chosen not to use the vending machines and instead brought her own lunch or snacks. Or she may have opted for the convenience of the machines. She did not realize that there was a choice to be made and what the costs and benefits were for each option. This deprivation is a concrete injury-in-fact that is particularized to Bryant. She thus meets the require- ments for Article III standing on her section 15(b) claim. D Bryant’s claim under section 15(a) is a separate matter. Sec- tion 15(a) obligates private entities that collect biometric in- formation to make publicly available a data retention sched- ule and guidelines for permanently destroying collected bio- metric identifiers and information. In contrast to the obliga- tions set forth under section 15(b), the duty to disclose under section 15(a) is owed to the public generally, not to particular persons whose biometric information the entity collects. This provision is not part of the informed-consent regime, and Bry- ant alleges no particularized harm that resulted from Com- pass’s violation of section 15(a). No. 20-1443 17

We conclude that Bryant did not suffer a concrete and par- ticularized injury as a result of Compass’s violation of section 15(a). She therefore lacks standing under Article III to pursue that claim in federal court. As we noted earlier, we have no authority and no occasion to address her state-court standing to bring this claim. III Recognizing the privacy and economic risks involved in the wide use of biometric information, the Illinois General As- sembly mandated in section 15(b) of BIPA that private entities make certain disclosures and receive informed consent from consumers before obtaining such information. As alleged, Compass did not make the requisite disclosures to Bryant or obtain her informed written consent before collecting her fin- gerprints. By failing to do so, Compass inflicted the concrete injury BIPA intended to protect against, i.e. a consumer’s loss of the power and ability to make informed decisions about the collection, storage, and use of her biometric information. This injury satisfies the requirements for Article III standing, and so Bryant’s claim under section 15(b) may proceed in federal court. We therefore REVERSE the judgment of the district court re- manding the action to the Circuit Court of Cook County, and REMAND this case to the district court for further proceedings consistent with this opinion.