It is becoming a common trend in litigation involving the Illinois Biometric Information Privacy Act (“BIPA”) – an employee files suit, alleging that their employer failed to provide notice, obtain informed consent, and publish data retention policies in regards to the collection of their biometric information, as required under the statute.  The dispute in Sherman v. Brandt Indus. USA, No. 20-cv-1185, 2020 U.S. Dist. LEXIS 211837 (C.D. Ill. Nov. 12, 2020), is no different.  There, a federal court ruled that an employee’s complaint adequately pled BIPA claims to withstand a motion to dismiss—joining the bandwagon of other disputes concerning challenges to timekeeping practices under BIPA.

As  previously explained, at its core, BIPA protects the “biometric information” of Illinois residents, which is any information based on “biometric identifiers” that identifies a specific person—regardless of how it is captured, converted, stored, or shared.  740 ILCS 14/10.  Biometric identifiers are “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.”  Id. (collectively, with “biometric information,” “biometric data”).

As shown by Sherman, it is increasingly common for employers to collect the biometric identifiers of employees for timekeeping purposes.  In this instance, Plaintiff, a former employee, alleged that Defendant used a fingerprint scanner to collect Plaintiff’s fingerprint and store it in an electronic database.  Plaintiff would then “clock in” using his fingerprint, which would be matched against his stored fingerprints.  Plaintiff also alleged that Defendant failed to provide notice, obtain informed consent, and publish data retention policies, all as required by BIPA.

Defendant’s first line of attack in its motion to dismiss was to argue under Rule 12(b)(1) that Plaintiff did not have standing to bring a claim because he had not suffered a concrete injury, and that any violations of BIPA were procedural.  The Sherman court disagreed, pointing to Seventh Circuit precedent indicating that there is a privacy interest in biometric data.  Biometric data differs from other types of sensitive personal data, like addresses or social security numbers, because “[b]oth the privacy invasion and potential harm are much more serious.”  The court also pointed to the fact that Plaintiff had not only claimed that Defendant failed to develop a written policy concerning the use of biometric data (which might not have been a sufficient claim on its own), but Plaintiff had also asserted that Defendant failed to comply with BIPA’s destruction guidelines.  This was a sufficient harm, as alleged.  The Sherman court also found that Plaintiff had sufficiently alleged a right to seek liquidated damages, as Plaintiff alleged a violation of his privacy rights.

Defendant’s next argument was raised under Rule 12(b)(6), and fared no better.  The Defendant asserted that Plaintiff failed to state a claim because Defendant had not developed a destruction policy (and therefore could not have failed to adhere to one), which the court rejected.  The Sherman court noted that it “need look no further than the statute” to find a baseline destruction policy: the fact that Defendant had further violated the statute by failing to develop its own policy could not shield it from liability.  This will likely be an important precedent for other alleged BIPA violations – failing to create a destruction policy cannot be a workaround for BIPA.

The Sherman court was also unpersuaded by Defendant’s claim that the Illinois Workers’ Compensation Act (“IWCA”) preempted Plaintiff’s BIPA claim because the claim arose in connection with his employment.  While IWCA generally provides the exclusive remedy for injuries suffered by Illinois employees, the Sherman court pointed to a recent decision by an Illinois appellate court recognizing that a claim for liquidated damages under BIPA was “simply not compensable” under IWCA.  It further observed that any claimed damages past statutory liquidated damages would also not be preempted by IWCA, pointing to numerous Illinois decisions rejecting the same preemption argument.

And with that, another BIPA class action proceeds.  We’ll continue to keep an eye on Sherman and other BIPA lawsuits for you as they develop.