August 6, 2018

New Employer Guidance for Illinois Biometric Information Litigation

Holland & Knight Alert
Phillip M. Schreiber

HIGHLIGHTS:

  • The number of class actions brought under Illinois' Biometric Information Privacy Act (BIPA) has increased substantially each year since its passage in 2008.
  • One of the main issues facing litigants is what constitutes an injury under the Act sufficient to give rise to an actionable claim, with plaintiffs often arguing that even technical violations of BIPA by employers – without regard to any actual harm – create an actionable claim under BIPA.
  • In its recent decision in Johnson v. United Airlines, Inc., the U.S. District Court for the Northern District of Illinois viewed the mere violation of BIPA's notice and consent provisions alone as insufficient to support a claim.

Since its passage in 2008, the number of class actions brought under Illinois' Biometric Information Privacy Act (BIPA) has increased substantially each year. Several issues of statutory interpretation continue to plague BIPA and affect how the parties involved litigate the cases.

One of the main issues facing litigants is what constitutes an injury under the Act sufficient to give rise to an actionable claim. BIPA states that "[a]ny person aggrieved by a violation of [the Act] shall have a right of action ...." Plaintiffs often argue that even technical violations of BIPA, without regard to any actual harm, create an actionable claim under BIPA. Employers have taken the contrary position that mere technical violations are not sufficient to create a claim.

Northern District of Illinois Decision

This issue most recently was addressed in Johnson v. United Airlines, Inc., No. 1:17-cv-08858 (N.D. Ill. July 31, 2018). There, the plaintiff, an airline baggage handler represented by a union, sued United Airlines on behalf of himself and others similarly situated, alleging that United had violated BIPA by requiring employees to clock in and out of work using a fingerprint scanner without providing the required notice and consent under BIPA. The collective bargaining agreement United entered into with the union representing the plaintiff and other class members supported the use of the fingerprint scanner. Notably, there were no allegations that United sold or otherwise shared any employee's biometric information with any third party, or that the devices storing the employees' biometric information was hacked or otherwise compromised.

United filed a motion to dismiss the plaintiff's claims, arguing that 1) the Railway Labor Act (RLA) and the parties' collective bargaining agreement pre-empted the claims, and 2) the plaintiff lacked a cognizable injury under BIPA that would grant him standing to bring his claims.

The U.S. District Court for the Northern District of Illinois granted United's motion to dismiss on both grounds. First, the court held that the RLA pre-empted the claims because resolution would require interpretation of the collective bargaining agreement.

Of more interest to most employers was the court's alternative basis for dismissal – lack of standing. As held by the court:

[A]lthough injuries may be intangible harms, or purely statutory procedural harms, the harm alleged by [the plaintiff] fails to rise to the level of an injury-in-fact without more. This is because the legislative intent underscoring the passage of BIPA was to protect "[t]he public welfare, security, and safety" of an individual's biometric information through "regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information."

Because the plaintiff pled only a "notice and consent" violation under BIPA, he did not set forth an injury sufficient to establish an injury in fact to maintain his claim in federal court. The failure to provide the requisite notice or obtain the requisite consent did not create a "risk of disclosure" to third parties.

Johnson's alterative holding focuses on standing to bring a claim in federal court, not specifically whether BIPA gives rise to a claim merely for a violation of the notice and consent provisions. But the language of the opinion suggests that the court viewed the mere violation of the notice and consent provisions alone as insufficient to give rise to a claim. Johnson is in line with the recent state appellate court decision in Rosenbach v. Six Flags Entertainment Corp., 2017 IL App (2d) 170317, which held that a mere technical violation (failure to provide notice and obtain consent) without any actual injury or adverse effect does not make a person aggrieved under BIPA. There are additional state appellate cases on the docket that are poised to clarify further what harm is sufficient to trigger a claim under BIPA.

The bottom line is that plaintiffs who litigate BIPA claims in federal or state court need to allege more than a mere violation of BIPA's notice and consent provisions. They must allege a disclosure of their biometric information or some other real harm.

Best Practices for Employers

Litigation under BIPA likely will continue. Thus, Illinois employers should be mindful of the following best practices.

  • Identify whether biometric information is collected and for what purpose.
  • Determine whether BIPA's notice and consent requirements apply – and whether existing processes satisfy those obligations.
  • Verify that existing data retention and destruction policies satisfy BIPA.
  • Take steps to protect any collected biometric information from being disclosed in a matter that violates BIPA.
  • When working with a vendor who is involved in the collection or storage of biometric information, ensure that the vendor is aware of and compliant with BIPA.
  • Be prepared to answer questions from employees about the collection and retention of their biometric information.

  

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem. Moreover, the laws of each jurisdiction are different and are constantly changing. If you have specific questions regarding a particular fact situation, we urge you to consult competent legal counsel.


Related Insights