Illinois’ Biometric Information Privacy Act (BIPA) has spawned a tsunami of class actions against employers who utilize biometric timekeeping or security systems. Now, the Illinois Supreme Court in McDonald v. Symphony Bronzeville Park, LLC has eliminated a defense invoked by employers facing claims under BIPA: the exclusivity of workers’ compensation.

IN DEPTH

BIPA protects Illinois residents’ biometric information—including fingerprints, voice prints, retina scans and face scans—by regulating its collection and disclosure by private entities. It has become popular for class actions because it provides liquidated damages for technical violations, including damages of $1,000 per negligent violation or $5,000 per reckless or intentional violation—even if there is no actual harm to an individual.

In contrast, Illinois’ Workers Compensation Act (IWCA) provides damages according to a set fee schedule, in administrative proceedings but without class actions. Thus, until McDonald, employers could argue that alleged work-related privacy violations under BIPA were work-related injuries, and so preempted by IWCA.

In McDonald, both the trial and appellate courts rejected this preemption defense. The Illinois Supreme Court agreed, explaining that BIPA offers remedies for different types of injuries. IWCA only covers certain types of work-related injuries: those that are “psychological or physical.” BIPA, meanwhile, protects against injuries that are “personal and societal.”

WHAT SHOULD EMPLOYERS EXPECT AFTER MCDONALD?

• Resumption of stayed cases: The McDonald decision was not unexpected, but dozens of BIPA cases were paused in the lower courts pending the issuance of this decision. Those cases will now resume, and employer-defendants will have one less defense available to answer them.

• More pleading amendments: McDonald initially pled “mental anguish” as an injury to gain standing but removed it from her complaint when it became clear that she needed to de-emphasize her psychological injury to win. Although Justice Burke described this move as “gamesmanship,” the Court’s decision will likely reinforce this practice.

• Possible legislative reform: The McDonald decision invited the legislature to intervene, noting that if a “different balance” should be struck under BIPA, that is a question for the legislature. Currently, there are six BIPA amendments currently pending in the Illinois Legislature; two are bipartisan.

WHAT ABOUT OTHER BIPA DEFENSES?

The Illinois Supreme Court is expected to rule on other BIPA defenses in the coming months: limiting accrual and the statute of limitations. Each of those is even more significant now that McDonald has eliminated the workers’ compensation defense. Let’s preview each:

• Accrual: The Illinois Supreme Court has yet to define what constitutes a “collection” of biometric information. Do claims accrue each time a company collects biometric data or only from the first instance? This question is critical for calculating damages. The Court is expected to decide the issue this year in Cothron v. White Castle.

• Statute of limitations: Should it be the five-year limitation, which is the Illinois Code of Civil Procedure’s general default for civil actions, or the one-year limitation established by the Code for privacy-related suits? The Illinois Supreme Court has agreed to hear an appeal of Tims v. Black Horse Carriers (App. No. 1-20-0563), which held that different limitations periods apply to different sections of the act. Specifically, that decision applied a one-year limitations period to claims relating to unlawful sales or disclosures of biometric information, but a five-year limitations period to all other claims. Since most BIPA claims brought against employers concern failure to maintain certain written policies or to obtain consent, these would fall under the five-year statute of limitations under Tims.

• Labor law preemption: In late February 2022, an Illinois appellate panel preserved a BIPA defense for employers who are party to a collective bargaining agreement. In Walton v. Roosevelt University, answering a certified question, the panel held that federal labor law preempts BIPA privacy claims asserted by employees covered by a collective bargaining agreements. This, too, is a case in which the Illinois Supreme Court may now be asked to review.