Powerhouse Points: IL Supreme Ct. Holds Employees May Bring BIPA Actions Against Employers

Written by Partner Joel Bruckman for the Winter 2022 Edition of Powerhouse Points,  A Quarterly Litigation Update.

Read the full issue here.

Powerhouse Points:

• Illinois’ Biometric Information Privacy Act (“BIPA”) is known to be one of the most robust data privacy acts in the country, which imposes statutory liquidated damages of $1,000 - $5,000 per violation, or actual damages (whichever is greater), and allows for other relief such as recovery of attorney’s fees and costs as well as injunctive relief.
• No employer (or other private entity) may collect, capture, purchase, receive through trade, or otherwise obtain a person's biometric identifier or biometric information, unless it first: provide written notice to the subject or their legally authorized representative that (i) a biometric identifier or biometric information is being collected or stored; (ii) the specific purpose and length of term for which the same is being collected; and receives a written release executed by the subject or their legally authorized representative.
• Illinois’ Worker’s Compensation Statute does not limit employees’ rights to bring suits for violation of BIPA.  Accordingly, employees, as a class, have standing to assert violations of BIPA against their employer and may seek either liquidated or actual damages resulting from such violations.  

Illinois’ Biometric Information Privacy Act (“BIPA”) is regarded as one of the most progressive data privacy statutes in the country.¹ Illinois’ BIPA statute went into effect back in 2008 and since then has continued to make Illinois one of the most sought after jurisdiction for plaintiff’s seeking to bring data privacy lawsuits regarding biometric information.  For many, one of the most attractive aspects of Illinois’ BIPA statute is its liquidated damages provisions, which allow for recovery of liquidated damages in the amount of either $1,000 per violation or $5,000 per violation in instances of “reckless” violation(s), as an alternative (not a preclusion) to actual damages.²   BIPA regulates the collection, use and disposal of “Biometric Identifiers” and “Biometric Information”.³

For those who may wonder: “what does and does not constitute biometric information or a biometric identifier,” BIPA defines “Biometric Identifiers” to include information such as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.”⁴  Moreover, BIPA expressly excludes from its definition of “Biometric Identifiers” the following types of information “writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color,” as well as a variety of health information related to medical procedures.⁵  Furthermore, BIPA defines “Biometric Information” as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual.”⁶ 

Since August 2017, the case of McDonald v. Symphony Bronzeville Park, LLC, et al., has been percolating through Illinois courts on resolution of defendants’ motion to dismiss the case, and made its way all the way up to the Illinois Supreme Court.  The seminal issue in the case to be decided was, does the exclusivity provision of the Illinois Worker’s Compensation Act limit, and effectively preempt employees from bringing a cause of action against their employer(s) for violations of BIPA.  On February 3, 2022, the Illinois Supreme Court answered that question in the negative and held that no such preclusion exists, clearing the way for both plaintiffs and employees outside of that case to assert BIPA claims against their respective employer.  

In McDonald, plaintiff, Marquita McDonald, represented a putative class of employees which alleged that their employer, Symphony Bronzeville Park, LLC (“Bronzeville”) and the other defendants “had violated—and continued to violate—various statutory requirements of [BIPA].”⁷   McDonald alleged that while she was employed by Bronzeville from December 2016 to February 2017, that “Bronzeville utilized a biometric information system, which required her to scan her fingerprint, as a means of authenticating employees and tracking their time.”⁸  Moreover, McDonald alleged that “she was never provided with nor signed a release consenting to [Bronzeville’s] storage of her biometric information and had never been informed of the purposes or length of time for which her biometric information was being stored.”⁹

Based on those contentions McDonald brought various causes of action against Bronzeville including several counts under BPA alleging that Bronzeville “negligently failed to obtain written releases from them before collecting, using, and storing their biometric identifiers and biometric information; negligently failed to inform them in writing that their biometric identifiers and biometric information were being collected and stored; negligently failed to inform them in writing of the specific purpose and length of time for which their biometric identifiers or biometric information was being collected, stored, and used; and negligently failed to publicly provide a retention schedule or guideline for permanently destroying the biometric identifiers and biometric information.”¹⁰

Bronzeville filed motions to dismiss McDonald's class action complaint and asserted, “that McDonald and the putative class alleged claims which were barred by the exclusive remedy provisions of the Illinois Worker’s Compensation Act (820 ILCS 305/1 et seq.) (the “Compensation Act”).”¹¹  In its motion, Bronzeville argued that “the Compensation Act is the exclusive remedy for accidental injuries transpiring in the workplace and that an employee has no common-law or statutory right to recover civil damages from an employer for injuries incurred in the course of her employment.”¹² 
        
First, the Circuit Court of Cook County denied defendant’s motion, holding  that “McDonald's injury involved the loss of the ability to maintain her privacy rights, which was neither a psychological nor physical injury and not compensable under the Compensation Act.”¹³   Next, the Illinois Court of Appeals for the First District affirmed the Circuit Court’s dismissal of Bronzeville’s motion, concluding that “a claim by an employee against an employer for liquidated damages under [BIPA]—available without any further compensable actual damages being alleged or sustained and designed in part to have a preventative and deterrent effect—[does not] represent the type of injury that categorically fits within the purview of the Compensation Act, which is a remedial statute designed to provide financial protection for workers that have sustained an actual injury.”¹⁴   Accordingly, the appellate court “conclude[d] that the exclusivity provisions of the Compensation Act do not bar a claim for statutory, liquidated damages, where an employer is alleged to have violated an employee's statutory privacy rights under [BIPA], as such a claim is simply not compensable under the Compensation Act.”¹⁵ 

Bronzeville then appealed to the Illinois Supreme Court.  Delivering the opinion for the Court, Justice Overstreet held that while Bronzeville had correctly noted in its petition to the Court that precedent existed in which the Illinois Supreme Court had previously “applied the plain language of the exclusivity provisions of the Compensation Act to preclude an employee's statutory cause of action against his employer in the circuit court, See Gannon v. Chicago, Milwaukee, St. Paul & Pacific Ry. Co., 13 Ill. 2d 460, 463, 150 N.E.2d 141 (1958) (supreme court held that workmen's compensation statute barred employee's statutory action pursuant to the scaffold statute against his employer in the circuit court for injuries he sustained when he fell from a ladder while climbing to a scaffold in the course of his employment), we find that the physical injury that the plaintiff in Gannon suffered as a result of falling from a ladder in the course of, and arising from, his employment is distinguishable from the injury McDonald alleges…on behalf of herself and the class.¹⁶ 

The Supreme Court went on to discuss the history of both BIPA and the Compensation Act in order to analyze the plain meaning and intent of each statute, and concluded that the exclusivity challenge at issue ultimately depends upon the type of injury sustained because “[w]hether the exclusivity provision bars an employee's civil claims depends upon the nature of the injury because the exclusivity provisions, by their express language, only apply if the injury is one that is covered by the Compensation Act.”¹⁷   The Supreme Court went on to note that “The Compensation Act's main purpose is to provide financial protection for injured workers until they can return to the workforce.”¹⁸ 

Conversely, the Supreme Court found that “[t]he personal and societal injuries caused by violating the Privacy Act's prophylactic requirements are different in nature and scope from the physical and psychological work injuries that are compensable under the Compensation Act. The Privacy Act involves prophylactic measures to prevent compromise of an individual's biometrics.  McDonald's claim seeks redress for the lost opportunity ‘to say no by withholding consent.’  McDonald alleges that Bronzeville has violated her and the class's right to maintain their biometric privacy.”¹⁹  

Ultimately, the Supreme Court found that “the circuit court correctly reasoned that McDonald's loss of the ability to maintain her privacy rights was not a psychological or physical injury that is compensable under the Compensation Act. Likewise, the appellate court correctly held that a Privacy Act violation is not the type of injury that categorically fits within the purview of the Compensation Act and is thus not compensable under the Compensation Act…  Accordingly, McDonald's Privacy Act claim for liquidated damages is not categorically within the purview of the Compensation Act.”²⁰  

The outcome of McDonald lifts a significant ambiguity in the ability of employees to initiate litigation against their employer(s) in connection with BIPA violations.  Such clear precedent from Illinois’ highest court will only make Illinois an even more attractive jurisdiction for the plaintiff’s privacy bar.  It is critical that any employer contemplating the use of biometric technology to track their employees work or whereabouts ensure that they are in compliance with BIPA before instituting such policies.  

For more information about BIPA, recent BIPA litigation or to seek consultation regarding the threat or initiation of BIPA litigation against you, contact Joel Bruckman at [email protected] or another member of Freeborn’s Litigation Practice Group.