Illinois Supreme Court Nixes Employer Biometric Privacy Defense

In the latest in a series of setbacks for employers facing claims under the Illinois Biometric Information Privacy Act (BIPA) (740 ILCS 14 et seq.), the Supreme Court of Illinois held last month that the Illinois Workers' Compensation Act (IWCA) (820 ILCS 305/1 et seq.) does not preempt BIPA claims for statutory damages brought by employees. The decision in McDonald v. Symphony Bronzeville Park, LLC, et al. has triggered the resumption of many dozens of BIPA workplace lawsuits which were stayed while the Illinois high court considered the case, and it will likely encourage even more lawsuits from current and former Illinois employees.

What Is BIPA?

BIPA allows Illinois individuals (including employees) to bring a private cause of action with statutory damages against companies that collect, capture, purchase, receive, otherwise obtain, disclose, or disseminate biometrics and negligently or intentionally fail to provide notice in writing and/or fail to obtain a written release prior to such collection. Failure to strictly comply with BIPA's specific requirements is the basis for over 1,000 class action lawsuits filed against businesses across industries in Illinois. The cost of defending BIPA claims is high and the potential liability under the statute could lead many employers to bankruptcy.

The McDonald v. Symphony Bronzeville Park Decision

In the case before the Supreme Court of Illinois, plaintiff Marquita McDonald claimed that her employer, Symphony Bronzeville Park, LLC (Symphony), violated BIPA by scanning employees' fingers for timekeeping purposes. She alleged that Symphony violated the sections of BIPA that impose both restrictions and affirmative obligations on private entities with respect to fingerprints (and other biometric identifiers). In response, Symphony filed a motion to dismiss arguing that the claims were preempted by the IWCA's "exclusive remedy" provision, which generally provides that workplace injuries are the domain of the IWCA.

Numerous Illinois circuit and appellate courts had already held that the IWCA does not preempt BIPA claims. In McDonald, the Illinois Supreme Court laid the issue to rest by affirming the appellate court. The appellate court's analysis included the following:

[W]e fail to see how a claim by an employee against an employer for liquidated damages under [BIPA]—available without any further compensable actual damages being alleged or sustained and designed in part to have a preventative and deterrent effect—represents the type of injury that categorically fits within the purview of the [IWCA], which is a remedial statute designed to provide financial protection to workers that have sustained an actual injury.

McDonald v. Symphony Bronzeville Park Ltd. Liab. Co., 2020 IL App (1st) 192398, ¶ 27, 447 Ill. Dec. 561, 569, 174 N.E.3d 578, 586, aff'd McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511, ¶ 54. The Illinois Supreme Court also recognized the "substantial consequences" of BIPA for businesses and employers, but stated that any recalibration of the burdens and penalties should come from the legislature, not the courts.

Takeaways

Although the outcome was largely expected, the Illinois Supreme Court decision in McDonald is nevertheless a disappointment for Illinois employers. A defense ruling could have defeated the many pending BIPA class actions and would have provided employers with added predictability and assurances regarding the risks of using employee biometric information.

The ruling also provides an important reminder for any Illinois employer: if it collects any biometric information (including but not limited to fingerprints, face/eye scans, or voiceprints), it should perform a critical analysis to ensure compliance with the potent and lengthy list of BIPA requirements. The failure to fully comply with BIPA, even when such a failure results in no actual injury to an individual, can easily lead to significant liability.

© 2022 Perkins Coie LLP