In Bradenberg v. Meridian Senior Living, LLC, No. 20-cv-03198 (C.D. Ill. Sept. 30, 2021), another BIPA complaint this year proceeded past the complaint stage, as the Court found that Plaintiff’s allegations were sufficient to state a claim.  While open ended questions remain regarding the statute’s scope and damages provisions (some of which may be shortly addressed by the Seventh Circuit), this trend underscores ongoing litigation risk for entities regulated under the statute.

As a short recap, BIPA protects the “biometric information” of Illinois residents, which is any information based on “biometric identifiers” that identifies a specific person—regardless of how it is captured, converted, stored, or shared.  740 ILCS 14/10.  Biometric identifiers are “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.”  Id. (collectively, with “biometric information,” “biometric data”).  The statute includes a private right of action and liquidated statutory damages.

Plaintiff’s allegations were relatively typical of BIPA actions, particularly those arising in the employment context: Plaintiff was an employee of defendant, a senior living facility that required its employees to scan their fingerprints at the beginning and end of each shift. Plaintiff alleged that each time she scanned her fingerprint, her personal identifying information (“PII”) was disclosed to defendant’s timekeeping vendor without her consent.

Defendant claimed that Plaintiff had failed to plead the requisite state of mind for BIPA violations, based on the four remedies available in Section 14/20 of BIPA that are available to plaintiffs who prevail on their claims. Two out of the four remedies—both liquidated damages—are available when a defendant acts with a specific state of mind, either negligently or willfully. The Court noted that the four types of remedies available were only a “menu” of remedies, and not a list of the necessary elements of a BIPA claim. Two of the remedies—attorney’s fees and costs and “other relief, including an injunction”—could be awarded without any state of mind requirements.

The Bradenberg Court additionally found that Plaintiff’s claims were timely brought. While defendant had claimed that Plaintiff’s state law claims either fell under a one-year statute of limitations—for publication of matter violating the right to privacy—or a two-year statute of limitations—for personal injury suits—the Court found that BIPA claims did not fit neatly into either of those two categories of suit, and instead found that Illinois’ general five-year statute of limitations applied. Because Plaintiff alleged violations beginning in 2017 and she filed her claims in 2020, those claims were timely.

As the Central District of Illinois has previously found, the Bradenberg Court also affirmed that Plaintiff’s BIPA claims were not preempted by the Illinois Workers Compensation Act (“IWCA”), as Plaintiff claimed an injury to her right to privacy and only physical or psychological injuries were compensable under the IWCA. Lastly, the Court found that defendant’s implied assumption of risk defense did not apply because BIPA is a strict liability statute.

Bradenberg is the latest to uphold a five-year statute of limitations for certain BIPA claims, and rejects a somewhat creative defense in affirming that Section 14/20 of BIPA is a list of remedies, rather than a list of necessary elements for a claim.