A recent decision from the Northern District of Illinois highlights new legal hurdles for employers using AI-powered video interview technologies under Illinois’ Biometric Information Privacy Act (BIPA), 740 ILCS 14/15. In Deyerler v. HireVue, initially filed over two years ago in January 2022, a class of plaintiffs alleged that HireVue’s AI-powered facial expression and screening technology violated BIPA. According to the complaint, HireVue collected, used, disclosed, and profited from “biometric identifiers” without complying with the requirements of BIPA. In a published decision, issued February 26, 2024, the court largely denied HireVue’s motion to dismiss, allowing most claims to proceed, and addressed several legal questions relevant to AI hiring tools and the use of video interviewing software.
In its decision, the court first considered HireVue’s argument that the court lacked personal jurisdiction because HireVue has no meaningful corporate presence in Illinois and the applicable software was not developed in Illinois. The court rejected that argument and found that plaintiffs sufficiently pleaded personal jurisdiction by alleging that HireVue marketed and sold its software to at least one company headquartered in Illinois, and the HireVue software was used to capture at least one of the plaintiff’s biometric identifiers.
The court next turned to HireVue’s two “statutory interpretation” arguments under BIPA. First, the court rejected HireVue’s argument that facial scans are not “biometric identifiers” because they are not used to affirmatively identify specific individuals. The court pointed to the language of the statute, which includes “facial geometry,” and found that plaintiffs’ allegation that HireVue used “facial expression and screening technology…to identify and assess candidates by collecting their facial geometry” was sufficient to survive a motion to dismiss. Second, the court rejected HireVue’s argument that plaintiffs’ BIPA claims were “precluded” by the Illinois Artificial Intelligence Video Interview Act (AIVIA), 820 ILCS 42/1, which, according to HireVue, more specifically addressed the use of AI video interviewing tools. The court disagreed and found that AIVIA and BIPA impose different but “concurrent” obligations and therefore plaintiffs’ BIPA claims were not precluded.
After addressing HireVue’s personal jurisdiction and statutory interpretation arguments, the court addressed HireVue’s arguments that the plaintiffs failed to state a claim under BIPA §§ 15(a), (b), (c) and (d). Assuming the facts as alleged by the plaintiffs were true, the court found that plaintiff adequately pleaded violations of BIPA §§ 15(a) and (b) based on the plaintiffs’ allegation that HireVue collected, captured, and used plaintiffs’ facial geometry and did not make publicly available any biometric retention policy. The court also found that plaintiffs’ allegation that HireVue’s software “results in the dissemination of biometrics to third parties, such as data storage vendors” was sufficient to establish a violation of § 15(d), which prohibiting the disclosure or redisclosure of biometric identifiers.
HireVue was successful, however, in dismissing plaintiffs’ claims under BIPA § 15(c), which regulates the sale of, and profiting from, biometric identifiers. In short, the court agreed with HireVue that the sale of its software does not equate to the sale of biometric identifiers.
Courts in Illinois have continued to enforce BIPA under its broad statutory terms, which can result in significant damages to employers. This decision is a reminder that plaintiffs will continue to assert new and creative claims under biometric privacy laws, including as it relates to the use of AI software vendors. And while, Illinois has the most prominent biometric privacy law in the country, numerous other states have or are considering passing biometric privacy laws that can be applicable to employers. Considering this decision, employers and businesses should continue to vet HR and other software vendors, including those marketing the use of AI, to understand the potential risks and take measures to mitigate those risks. Additionally, vendors of AI technology should understand the acts and practices that can result in the application of various state laws, especially when marketing and selling to customers.
[View source.]
