Don’t Run Prints: Illinois’s Biometric Privacy Law Used Against Employers

Bradley Arant Boult Cummings LLP
Contact

Bradley Arant Boult Cummings LLP

Does your company use fingerprinting or some facial recognition scanner as part of its clock-in, clock-out process? If your company has facilities or even some contacts with Illinois (and maybe other states in the future) you should pay heed to Illinois’s Biometric Information Privacy Act (BIPA) that is the subject of a new class action and has been the source of many prior lawsuits.

Illinois’ Biometric Privacy Law

The BIPA states that no private entity may “collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier or biometric information” unless it first:

  • Informs the subject in writing that a biometric identifier or biometric information is being collected or stored;
  • Informs the subject in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and
  • Receives a written release executed by the subject or the subject’s representative.

The BIPA also prohibits businesses from disclosing a person’s biometric information without first obtaining consent and  requires businesses to develop and comply with a publicly available written policy for retention and destruction of the information. The BIPA is recognized as one of the strongest state laws protecting individuals’ biometric data and expressly excludes photographs and information from a patient in a health care setting from the definition of biometric identifier.

Family Dollar Class Action

A putative class of employees recently filed a complaint against Family Dollar and Dollar Tree Inc. in Cook County, Illinois alleging violation of the BIPA. Herron, the representative plaintiff, worked as an hourly employee at Family Dollar in 2017 and had to provide finger scans to clock in and out. The complaint alleges that Family Dollar did not inform the employees in writing of the purpose or obtain consent.

Other Lawsuits and Developments

Lawsuits alleging employer violations of BIPA have become commonplace in Illinois in recent years. Walmart recently settled a BIPA employee class action for $10 million. A case currently before the Illinois Supreme Court could decide whether the exclusive remedies under the workers’ compensation law preclude claims for statutory damages under the BIPA where an employee alleges a violation of statutory rights. A defense victory could have a considerable effect on the pending class actions, including the Herron matter.

BIPA critics suggest the law has been abused and leads to frivolous lawsuits. A bill introduced in the Illinois General Assembly would revise and limit the BIPA’s reach.

As of now, the BIPA provides for statutory damages of $5,000 for each willful and/or reckless violation, or $1,000 for each negligent violation. According to the Illinois Supreme Court, an individual need not allege or prove an actual injury to recover damages; the mere violation will create the statutory liability.

While other states have regulated the use of biometric information, Illinois is currently the only one that creates a private right of action. A National Biometric Information Privacy Act of 2020 was introduced in August 2020 and is pending in the Senate now. As drafted, it includes a private right of action.

If You Are in Illinois or Have Illinois Contacts You should …

If you have facilities in Illinois or some contact with Illinois, you should examine and comply with the BIPA’s requirements. Any clock in, clock out procedures should not involve biometric information unless you have met and documented the consent requirements. Lawsuits alleging BIPA violations have been filed outside of Illinois if a company has sufficient contacts, so you need to be careful. State biometric protection laws may become more common, so carefully examine your practices if fingerprint scanners or any type of biometric recognition technology is part of your operations.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Bradley Arant Boult Cummings LLP | Attorney Advertising

Written by:

Bradley Arant Boult Cummings LLP
Contact
more
less

Bradley Arant Boult Cummings LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.