In yet another blow to employers facing claims under the Illinois Biometric Information Privacy Act (“BIPA” or the “Act”) (740 ILCS 14/1 et seq.), the Illinois Supreme Court held that the Illinois Workers’ Compensation Act (“IWCA”) (820 ILCS 305/1 et seq.) does not preempt BIPA claims for statutory damages brought by employees.  The Court’s holding in McDonald v. Symphony Bronzeville Park, LLC, et al. awas not unexpected by most BIPA practitioners, and will likely trigger the resumption of many dozens of BIPA workplace lawsuits which were stayed while the Illinois justices considered the case.

The McDonald v. Symphony Bronzeville Park, LLC, et al. Decision

In the McDonald case, plaintiff Marquita McDonald sued Symphony Bronzeville Park, LLC (“Symphony”) in August 2017, alleging that Symphony violated BIPA when it scanned the fingers of its employees, including plaintiff, for timekeeping purposes.^[1]  Specifically, plaintiff alleged that Symphony violated Sections 15(a) and (b) of the Act.  Those Sections of the Act place both restrictions and affirmative obligations on private entities with respect to biometric identifiers (such as fingerprints, voiceprints, retinal scans and facial geometry) and biometric information (e.g., information based on biometric identifiers to the extent used to identify an individual), including the following:

• Private entities in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for destroying the information. 740 ILCS 14/15(a).

• Private entities which collect, capture, purchase, receive or otherwise obtain biometric identifiers or biometric information must first inform the subject of that fact in writing, as well as the specific purpose and length of time for which the information will be retained, and must obtain a written release executed by the subject. 740 ILCS 14/15(b).

In response, Symphony filed a motion to dismiss arguing that plaintiff’s claims were barred by the exclusive remedy provision of the IWCA.  The McDonald trial court and intermediate appellate court both held that the IWCA does not preempt BIPA claims for damages, as have dozens of other Illinois courts to consider the issue.

The Illinois Supreme Court’s analysis in McDonald broke no new ground.  The Court reviewed the IWCA’s exclusivity provisions and applicable exceptions, including the fourth exception, which states that the IWCA is not the exclusive remedy where an employee suffers an injury which is not compensable under the IWCA.  The Court determined that the exclusivity issue turns on the type of injury sustained, and analyzed whether a statutory BIPA injury is the type of injury which categorically fits within the purview of the IWCA.  Holding that the IWCA covers injuries that affect an employee’s capacity to perform employment-related tasks, the McDonald Court relied on its own January, 2019 decision in Rosenbach v. Six Flags Entertainment Corp. and noted that statutory BIPA injuries are different:

The personal and societal injuries caused by violating [BIPA’s] prophylactic requirements are different in nature and scope from the physical and psychological work injuries that are compensable under the [IWCA].  [BIPA] involves prophylactic measures to prevent compromise of an individual’s biometrics.  Rosenbach, 2019 IL 123186, ¶ 36.  McDonald’s claim seeks redress for the lost opportunity to “say no by withholding consent.”  Id. ¶ 34.  McDonald alleges that Bronzville has violated her and the class’ right to maintain their biometric privacy.

McDonald, 2022 IL 126511 ¶ 43.

The McDonald Court, thus, concluded that BIPA statutory injuries are not compensable under the IWCA, and that BIPA claims are thus not preempted by the IWCA.

In order to further support its decision, the Court relied on BIPA’s definition of the term “written release” which includes “a release executed by an employee as a condition of employment.”  740 ILCS 14/10.  Based on this definition, the Court concluded that the legislature foresaw that BIPA claims could arise in the context of employment and, as a result, the legislature did not intend claims under the Act to be preempted by the IWCA.

In a concurring opinion, Justice Michael Burke pointed out that plaintiff had saved her claims through “gamesmanship in pleading,” because she had amended her complaint to remove allegations of mental anguish, an injury that would be covered under the IWCA.  Justice Burke went so far as to state that plaintiff had not suffered any injury and that the possibility of a future injury could be alleviated via injunctive relief.

The McDonald Ruling’s Impact on Your Business

The McDonald decision will have far-reaching application, as the great majority of the approximately 1,000 BIPA suits brought to date concern the use of biometrics in the workplace, most often in the context of time clocks, security, and more recently temperature scans.  McDonald was far from the only BIPA litigant to engage in the type of gamesmanship Justice Burke noted in his concurring decision, and the likely result of the Court’s ruling will be to further cement this  practice.  The allegations of mental anguish and other injuries made by numerous BIPA plaintiffs in an attempt to secure standing will likely be eliminated altogether in favor of allegations of technical violations designed to avoid IWCA preemption.

While the McDonald decision answered the question as to whether the IWCA preempts BIPA claims, there are other critical questions that remain unresolved.  For example, still to be decided by the Illinois Supreme Court is what constitutes a collection of a person’s biometrics for purposes of calculating specific BIPA violations and liquidated damages.  That issue is presented in Cothron v. White Castle, which the Court is expected to decide later this year.  Given BIPA’s provisions allowing awards of liquidated damages of up to $5,000 for each violation of the Act, a finding of multiple violations per day for each class member would prove catastrophic for Illinois defendants.  The McDonald Court seemingly invited the legislature to intervene, holding that whether a “different balance” should be struck under the Act with respect to claims based solely on a statutory violation, is “a question more appropriately addressed to the legislature.”  It remains unclear if the legislature will seize the opportunity to clarify the Act.

Ultimately, every business should perform a critical analysis as to any business practice that potentially concerns biometrics—including employee timekeeping, identification procedures or security protocols.  The failure to fully comply with BIPA, even when such a failure results in no actual injury to an individual, may lead to significant liability.  Vedder Price attorneys are at the forefront in defending BIPA claims and counseling clients on BIPA-related policy and disclosure language.  Please contact members of our BIPA defense team or your Vedder Price attorney with any questions you may have or assistance you may need.

FOOTNOTES

[1] Plaintiff eventually amended her complaint to name two additional defendants, Symcare Healthcare LLC and Symcare HMG LLC.