In a unanimous decision issued on February 3, 2022, the Illinois Supreme Court held in McDonald v. Symphony Bronzeville Park that the Illinois State Workers’ Compensation Act (“WCA”) did not bar claims under the Illinois’ Biometric Information Privacy Act (“BIPA”). In doing so, the court eliminated one significant defense commonly raised in such cases, since many BIPA class actions are brought in the context of employment (many of which were stayed pending the decision in McDonald). Critically, though, the decision does not preclude other potential defenses including claims of federal preemption.
BIPA is one of the most actively litigated privacy statutes in the United States. Among other things, it requires that businesses obtain consent prior to collecting biometric information (fingerprints, facial geometry information, iris scans and the like), issue a publicly available data retention policy, and refrain from certain data sales and disclosures. Because BIPA provides for a private right of action along with statutory damages of $1,000 to $5,000 per violation, it has proved fertile ground for the plaintiff’s bar.
Background of McDonald v. Symphony Bronzeville Park
Similar to many other BIPA lawsuits, the alleged wrongful acts in McDonald arose from an employer’s use of a fingerprint timekeeping system. Plaintiff Marquita McDonald, a former employee of Defendant Symphony Bronzeville Park, LLC’s (“Bronzeville”), filed a putative class action alleging that Bronzeville and certain affiliates violated BIPA through their collection, use and storing of class members’ sensitive biometric data using the clock without first obtaining their written consent or providing them with notice of how the fingerprint data would be used and stored. Bronzeville employed the fingerprint clocks to track McDonald’s and other employees’ work hours. The complaint sought an injunction against future violations of BIPA along with statutory damages of $1000 per violation per class member.
Bronzeville moved to dismiss, arguing that the WCA provided the exclusive remedy for accidental injuries incurred in the workplace. The Circuit Court of Cook County denied the motion, finding that McDonald’s injury involved a loss of privacy rights not the psychological or physical injuries it held were covered by the WCA. Bronzeville appealed, but the decision was affirmed by the Illinois Court of Appeal. While noting the dearth of case law addressing the issue in question, the appellate court concluded that a claim by an employee under BIPA, which was “available without any further compensable actual damages being alleged or sustained and designed in part to have a preventative and deterrent effect,” was not the type of injury that was covered by the WCA. Bronzeville subsequently petitioned the Illinois Supreme Court to review.
The Illinois Supreme Court Affirms the Appellate Court and Trial Court Decisions
In finding that BIPA was not preempted by the WCA, the Illinois Supreme Court noted that although the WCA generally provides the “exclusive means by which an employee can recover against an employer for a work-related injury,” the WCA provides exceptions to such exclusivity if an employee can establish that an injury “was not compensable under the [WCA].” The court agreed with the Plaintiff that the WCA was intended to provide financial protections to address harms like physical injuries that prevent return to the workforce. In contrast, BIPA requires prophylactic measures intended to prevent personal and societal injuries caused by violations of privacy.
The Illinois Supreme Court further noted that as a matter of legislative intent, later-enacted statutes control over earlier enacted statutes and more specific statutes control over more general statutes. Under both criteria, BIPA was not intended by the legislature to be pre-empted by the earlier and broader WCA. The Illinois Supreme Court acknowledged that its decision might enlarge the liability of employers under BIPA but deferred resolution of that consequence to the legislative process. The court then remanded the case to the circuit court for further proceedings.
Key Takeaways
The Illinois Supreme Court’s decision in McDonald certainly increases the risk profile for companies collecting biometric information from their employees. However, although the court eliminated one defense to BIPA, numerous other defenses are still available, including in the context of employment. As one example, in September 2021, the Seventh Circuit held in a unanimous decision in Fernandez, et al. v. Kerry, Inc, 21-1067 (7th Cir. Sept. 20, 2021) that BIPA claims by unionized employees were preempted under the federal Labor Management Relations Act because they required interpretation of a collective bargaining agreement.
Given the risk of liability under BIPA, though, private companies collecting biometric information should take note. Laws similar to BIPA are also currently in place in Texas and Washington state (though, unlike BIPA they do not provide for private rights of action), and numerous other states are considering biometric information privacy laws. As such, companies should carefully monitor their practices for collecting and using biometric information, implement or review policies related to such practices, and ensure that adequate notice is provided to data subjects. Ropes & Gray will continue to monitor and report on developments under BIPA and other biometric privacy laws.