On June 13, 2019, the U.S. Seventh Circuit Court of Appeals in Miller v. Southwest Airlines, Co., Case 18-3476 (June 13, 2019), ruled that claims asserted under the Illinois Biometric Information Privacy Act (“BIPA”), in the context of a unionized workforce must be resolved pursuant to the strictures of the Railway Labor Act. 

By way of background, BIPA applies to all biometric identifiers or measurements of physiological characteristics, such as finger prints, iris scans and facial geometry.  Crucially, BIPA requires that a private entity inform the subject of biometric data collection or the subject’s “legally authorized representative” in writing about the entity’s biometric data effort including, but not limited to, the method of collection, use, storage, retention and destruction of that data. 

In Miller, which was consolidated with Johnson v. United Airlines, Inc.,  employees complained the airlines’ timekeeping systems violated BIPA due to lack of required consent.  In both cases, Plaintiffs asserted that the employer violated BIPA by using fingerprints of workers to clock in and out.  As articulated by the court, the common issue in Miller and Johnson was “whether persons who contend that air carriers have violated state law by using biometric identification in the workplace must present these contentions to an adjustment board under the Railway Labor Act.”   

The court explained that “[T]here can be no doubt that how workers clock in and out is a proper subject of negotiation between unions and employers – is, indeed, a mandatory subject of bargaining.”  While Plaintiffs contended that a union is not a “legally authorized representative” for purposes of providing consent under BIPA, the court further found that “[n]either the statutory text nor any decision by a state court suggests that Illinois wants to exclude a collective-bargaining representative from the category of authorized agents.”  The Seventh Circuit remanded the matters with instructions to refer the parties to an adjustment board.

Employers using processes involving biometric data or that desire to implement new processes would do well to do so only after developing a comprehensive program, including a written policy, for all aspects of use, collection, storage, retrieval and destruction of the data.  Illinois is not the only state with a statute in this area.  Both Washington and Texas have similar statues, but those do not permit a private right of action.  It is likely more states will follow.  Employers with questions should consult with competent counsel.