As technology continues to advance, the law needs to evolve to stay abreast of the developments.  Recently, the Illinois Supreme Court tackled a question involving biometric technology.  The Court addressed an issue of first impression relating to the Illinois Biometric Information Privacy Act (“BIPA”).[i]  Attorneys should expect continued similar advances as courts find themselves facing issues involving a broad range of biometric technologies for the first time.

In McDonald v. Symphony Bronzeville Park, LLC, the Illinois Supreme Court answered the following question pursuant to Illinois Supreme Court Rule 308:[ii]

Do the exclusivity provisions of the Workers’ Compensation Act bar a claim for statutory damages under the BIPA where an employer is alleged to have violated an employee’s statutory privacy rights under the BIPA?[iii]

Both the trial and intermediate appellate court answered the question in the negative, and a unanimous Illinois Supreme Court agreed.[iv]

Plaintiff filed a putative class action against Symphony Bronzeville Park, LLC (“SBP”), alleging SBP’s collection, use, and storage of plaintiff’s and the putative class’s sensitive biometric data violated their privacy rights under the BIPA.[v]  As an employee of SBP, plaintiff alleged, she was required to scan her fingerprint as a means of security and tracking her time.  However, SBP never provided plaintiff with a release, nor did she ever sign one, consenting to the storage of her biometric information.[vi]  In addition to injunctive and equitable relief, plaintiff sought to recover liquidated damages of $1,000 per violation for each negligent violation of the BIPA, plus attorneys’ fees and costs.[vii]  SBP moved to dismiss the complaint, arguing the Workers’ Compensation Act was the exclusive remedy for accidental injuries sustained in the workplace and an employee has no common law or statutory right to recover civil damages from an employer for injuries incurred in the course of her employment.[viii]

The Court began its analysis by focusing on the unambiguous language of the BIPA, observing that it was enacted in 2008 to help regulate “the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.”[ix]  A “biometric identifier” is defined in the BIPA as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry” while “biometric information” means “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual.”[x]  The Court further recognized the BIPA imposes specific requirements regarding how private entities like SBP collect, retain, and use biometric identifiers and biometric information; specifically, a private entity must inform the individual, in writing that: (1) her biometric identifier or information is being collected or stored; (2) the specific purpose for collecting the biometric identifier or information; and (3) the length of time for which the biometric identifier or information will be collected, stored and used.[xi]  The entity must also obtain a “written release” from an individual before collecting her biometric identifier or information.[xii]  The BIPA further expressly requires in the employment context the employer obtain a written release “executed by an employee as a condition of employment.”[xiii]

The provisions of the BIPA are enforceable as a private right of action in state court or as a supplemental claim in federal court, as previously recognized by the Court in Rosenbach v. Six Flags Entertainment Corp.[xiv], and a prevailing party may recover:

• against a private entity that negligently violates a provision of this Act, liquidated damages of $1,000 or actual damages, whichever is greater;
• against a private entity that intentionally or recklessly violates a provision of this Act, liquidated damages of $5,000 or actual damages, whichever is greater;
• reasonable attorneys’ fees and costs, including expert witness fees and other litigation expenses; and
• other relief, including an injunction, as the state or federal court may deem appropriate.[xv]

In deciding the Workers Compensation Act did not preclude the plaintiff’s BIPA claims, the Court reasoned the Compensation Act is a no-fault remedial statute designed to provide financial protection for injured workers until they can return to work.[xvi]  Further, the Court recognized that for the exclusivity provisions of the Workers Compensation Act to apply, plaintiff’s and the putative class’s alleged injuries must be “compensable” under the Act.[xvii]  SBP argued plaintiff’s claim could not proceed because it involved an injury that occurred during the course of her employment[xviii], while plaintiff argues only physical or psychological injuries are compensable under the Workers Compensation Act, which does not include privacy violations as alleged in the complaint.[xix]

Ultimately, whether an injury is compensable under the Workers Compensation Act boiled down to “whether there was a harmful change in the human organism – not just its bones and muscles, but its brain and nerves as well.”[xx]  Here, the Court determined that the personal and societal injuries caused by the alleged violation of the BIPA were different in nature and scope from the physical and psychological work injuries that are compensable under the Workers Compensation Act.[xxi]

Finally, the Court observed the legislature was obviously aware BIPA claims could arise in the employment context by virtue of the provision requiring a written release signed by an employee as a condition of employment.  As a result, if the legislature intended to preclude BIPA claims in the Workers Compensation Act, it could have – and would have – expressly stated as much in the BIPA; the legislature did not do so.[xxii]

As a result, the Court concluded plaintiff could pursue her BIPA claims on her behalf and on behalf of the putative class in circuit court rather than through the Workers’ Compensation Commission.[xxiii]

Takeaway

The McDonald decision creates a roadmap for future plaintiffs asserting BIPA claims to avoid alleging a compensable injury, which would be subject to the exclusivity provisions of the Workers Compensation Act and restrict the proceedings to the Industrial Commission.  Indeed, as the concurring opinion noted, plaintiff amended her complaint to eliminate her original claim of mental anguish.  Had such a claim not been withdrawn, the exclusivity provisions would most certainly bar her BIPA claims.[xxiv]  So, future BIPA claims will likely be modeled after plaintiff’s so they avoid characterization as a physical or psychological injury.

On the other hand, McDonald serves as a reminder to private entity employers who collect biometric identifiers or biometric information from their employees that protections are embedded in the BIPA to protect the employer as well.  The employer must inform the employee, in writing, that his/her biometric identifiers or biometric information will be collected or stored; the specific purpose of the collection; and the length of time the biometric identifier or information will be collected, stored, and used.  Then, the employer must secure the employee’s consent using a written release. Following these rigid, but certainly doable, requirements should avoid a BIPA claim in the future and the potentially significant recoverable statutory damages permitted by the BIPA.

[i] (750 ILCS 14/1 et seq. (West 2016)).

[ii] McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511 at ¶1.

[iii] Id. at 1.

[iv] Id. at 1.

[v] Id. at 3.

[vi] Id.at 4.

[vii] Id. at 6.

[viii] Id. at 7

[ix] Id. at 20.

[x] Id.

[xi] Id. at 21 (citing §15(b) of the BIPA).

[xii] Id. (citing §15(b)(3) of the BIPA).

[xiii] Id. (citing §10 of the BIPA).

[xiv] Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, §21.

[xv] Id. at 23 (citing §20 of the BIPA).

[xvi] McDonald at 29.

[xvii] Id. at 32.

[xviii] Id. at 33.

[xix] Id.at 34.

[xx] Id. at 42.

[xxi] Id. at 43-44.

[xxii] Id. at 45.

[xxiii] Id. at 50.

[xxiv] Id. at 58-59.

Keep Reading

Cannabis Workers Allege Quota to Trim 4 Pounds a Day Violates the California Labor Code The Ninth Circuit Reminds Us: Every Word Matters NO WAY, PRO SE! The Consequences of Abusing the Judicial System as a Pro Se Litigant in Colorado Victim of Financial Mismanagement or Unlawful Retaliation? New Jersey City University Program Founder Claims School Retaliated After Reporting Alleged Sexual Harassment “Real Housewives” Gets a Reality Check Missing a Chapter: Insufficiency of Expert Deposition Testimony in Medical Malpractice Litigation Crash Course: Why Summary Judgment Misses the Mark in Illinois Multi-Cause Limousine Crash Collision Bitter Truths: Lead, Cadmium, and Defective Pleadings in California Chocolate Class Action The Law of Unintended Consequences: Including Insurance Brokers in Litigation Strategy Communication May Waive the Attorney-Client Privilege

More by this author

Crash Course: Why Summary Judgment Misses the Mark in Illinois Multi-Cause Limousine Crash Collision To Defend and Indemnify, or Not to Defend and Indemnify Start Small, but Think Big: Attorneys’ Fees Can Add Up There’s No Such Thing as A Free Bite Not All Arbitration Clauses Are Created Equally Exclusivity Provisions of Illinois Workers Compensation Act Do Not Shield Employer From Claims Under Biometric Information Privacy Ac Protections Against Implied Warranty of Habitability Claims Broadened in Illinois Illinois Practice Note: Amendment to Rule 23 Can a Home Office Establish Venue in Illinois?