Yesterday, at long last, the Illinois Supreme Court issued a decision making clear that state workers’ compensation law does not preempt employment-based claims arising under the Biometric Information Privacy Act (BIPA). The decision in McDonald v. Symphony Bronzeville Park, which has been pending before the Illinois Supreme Court for over a year, means that employers do not have a powerful weapon at their disposal when it comes to defending the ever-increasing number of privacy claims we are seeing throughout the state. What do you need to know about this decision and what should you do as a result?

What Does BIPA Require?

Before discussing the implications of the case, it is important to consider what BIPA requires. The statute mandates that private entities — including employers — that collect or maintain fingerprints, retinal or iris scans, voiceprints, hand scans, or face geometry must first receive written consent from the individual before such collection. It also requires covered businesses to develop a publicly available policy that establishes the retention schedule for the applicable biometric information, among other things. The statute also contains various data retention requirements concerning individuals’ biometric data.

BIPA states that an individual may be entitled to $1,000 per negligent “violation” and $5,000 per willful “violation,” or actual damages, whichever is greater. The law also provides for attorneys’ fees, costs, and any other relief that a court may deem appropriate.

IWCA Preemption Background

In McDonald v. Symphony Bronzeville Park, the plaintiff alleged that her employer violated BIPA by requiring its employees to scan their fingerprints on a fingerprint-based time clock system without following several of BIPA’s procedural notice and waiver requirements. In response, her employer moved to dismiss the employee’s BIPA claims, arguing that because the employee’s claims arose during the course of her employment with the defendant, the claims were barred by the Illinois Worker’s Compensation Act (IWCA).

To understand the argument that the employer made, it is important to understand the exclusivity provision of the IWCA. This critical part of the law states the IWCA is the exclusive remedy for “accidental injuries sustained by any employee arising out of and in the course of the employment.” It also provides that an “employee has no common law or statutory right to recover damages from the employer … for injury or death sustained by any employee while engaged in the line of his duty as such employee, other than the compensation herein provided.” In other words, if an employee suffers a compensable IWCA injury while working, then the employee’s sole source of compensation from the employer is through the remedial IWCA scheme and, insofar as the defendant argued in McDonald, not vis-à-vis BIPA.

With this backdrop, the Illinois Supreme Court was asked to answer the following question: “Do the exclusivity provisions of the IWCA bar a claim for statutory damages under BIPA where an employer is alleged to have violated an employee’s statutory privacy rights under BIPA?”

On February 3, 2022, the Illinois Supreme Court definitively answered the question, holding unequivocally that an alleged BIPA “injury” is not one that “categorically fits within the purview of the IWCA.”

Implications and State of the Law

The Illinois Supreme Court’s decision in McDonald removes a powerful potential defense from employers defending themselves against the wave of BIPA class actions across Illinois. This decision is but the latest in a series of decisions clarifying the scope and applicability of the statute, with more decisions expected in the coming year.

For example, the First District Appellate Court clarified the applicable statute of limitations period for BIPA claims in a September decision. The court found that claims arising under section 15(c) and (d) of BIPA, which prohibits the sale and disclosure of biometric information, have a one-year statute of limitations period. By contrast, the court held that claims arising under section 15(a), (b), and (e) of BIPA, which requires the development of a written policy on the handling of biometric information, informing a person in writing that biometric information is being collected or stored, and using reasonable care to store and protect biometric information, are subject to a five-year statute of limitations. A petition for leave to appeal to the Illinois Supreme Court has been filed but not yet ruled upon by the court.

In mid-December 2021, the First District Appellate Court held that BIPA claims accrue each time a defendant captures biometric information in violation of the statute, as opposed to only accruing at the first instance of collection. Just a few days later, the Seventh Circuit Court of Appeals issued its decision in Cothron v. White Castle System, Inc. — another appeal involving claim accrual. But rather than decide when a BIPA claim accrues, the Cothron court certified the question to the Illinois Supreme Court to provide definitive guidance.

These decisions are notable because how a BIPA claim accrue may impact when the statute of limitations in a given case begins to run. In addition, if the Illinois Supreme Court concludes that continuing BIPA violations constitute separate, independent claims, then such decision may have a profound impact on the associated statutory damages. At the moment, we do not have a definitive answer on when BIPA claims accrue. However, the issue is now set up to be definitively decided by Illinois’ highest court.

What Should Employers Do?

Now more than ever, Illinois employers or other entities utilizing any form of biometrics should be proactive in complying with BIPA’s requirements. Implementing the necessary policies, procedures, and authorizations before collecting any biometric information is essential to complying with the statute and defending cases pursuant to BIPA. This decision reinforces the need to reevaluate the biometric methodologies currently in place and coordinate with counsel to update them as necessary. As the decision has demonstrated, the implications of not doing so can be of existential importance for any business.