In a landmark decision, a Chicago federal jury found that BNSF Railway Co. (“BNSF”) violated the Illinois Biometric Information Privacy Act (“BIPA” or the “Act” (740 ILCS 14/1 et seq.) resulting in a judgment of $228 million against BNSF. The speed in which the jury delivered its verdict, and the scope of the damages calculated by the Court, should give pause to any employer or entity facing BIPA claims.

The Rogers v. BNSF Railway Co. Verdict and Judgment

In the Rogers case, lead plaintiff Richard Rogers sued BNSF in April 2019 on behalf of a class of about 45,000 truck drivers who claim BNSF illegally required them to scan their handprints to verify their identity when entering secured railyards without first obtaining their consent or providing them notices about what might happen with their scanned prints.¹ Specifically, the plaintiff alleged that BNSF violated Section 15(b) of the Act. That Section of the Act places affirmative obligations on private entities with respect to biometric identifiers (such as fingerprints, voiceprints, retinal scans and facial geometry) and biometric information (e.g., information based on biometric identifiers to the extent used to identify an individual), including the following:

Private entities which collect, capture, purchase, receive or otherwise obtain biometric identifiers or biometric information must first inform the subject of that fact in writing, as well as the specific purpose and length of time for which the information will be retained, and must obtain a written release executed by the subject. 740 ILCS 14/15(b).

In response, BNSF argued that it was not involved in the collection or use of any biometric data, and thus did not violate the Act. Instead, BNSF asserted that it contracted with a third-party vendor, Remprex LLC (“Remprex”), to install and operate the equipment that collected plaintiff’s and the more than 44,000 other class members’ finger scans.

Following a five-day trial, the jury took approximately one hour to reject BNSF’s arguments and find in favor of the plaintiff and the certified class of truck drivers. The jury was only tasked with determining if BNSF was liable for violating the Act and, if so, how many times BNSF violated the Act negligently or recklessly/intentionally. Under BIPA, the distinction between a negligent violation and a reckless or intentional violation is significant. BIPA provides for an award of $1,000 for each negligent violation of the Act. (740 ILCS 14/20(1).) However, the award of liquidated damages increases to $5,000 for each reckless or intentional violation of the Act. (740 ILCS 14/20(2).) The jury found that BNSF recklessly or intentionally violated BIPA 45,600 times, an amount equal to the defense expert’s estimated number of truck drivers in the class who had their fingers scanned from April 4, 2014 through January 25, 2020.

Following the jury’s verdict, U.S. District Judge Matthew Kennelly calculated and awarded damages in the amount of $228 million. Judge Kennelly’s calculation of damages appears to be a straightforward application of the jury’s finding that 45,600 reckless or intentional violations of the BIPA occurred and the Act’s provision allowing awards of $5,000 for each reckless or intentional violation.

The Rogers Ruling’s Impact on Your Business

The impact of the Rogers verdict and judgment are significant in several respects. First, a one-hour deliberation following a five-day jury trial is a strong indicator that the jury did not view the issue of liability as a tough call. It appears that from the jurors’ perspective, BNSF’s failure to comply with BIPA’s affirmative obligations appeared obvious. Second, the Court and the jurors rejected BNSF’s defense—that it was not liable for third-party Remprex’s conduct which means that employers and other entities may be vicariously liable in the context of BIPA claims. Third and finally, the staggering amount of the damages award will likely further embolden the plaintiffs’ bar and may result in an increase of new BIPA claims. Moreover, the way by which the Court calculated the damages award will likely serve as a baseline during settlement negotiations of pending and future BIPA claims, effectively increasing the cost to resolve these class actions.

Ultimately, every business should perform a critical analysis as to any business practice that potentially concerns biometrics—including employee timekeeping, identification procedures or security protocols. The failure to fully comply with BIPA, even when such a failure results in no actual injury to an individual, may lead to significant liability.

FOOTNOTES

¹ Although Plaintiff filed his complaint in the Circuit Court of Cook County, BNSF removed the action to the United States District Court for the Northern District of Illinois in May 2019