BIPA Update: Class Actions on the Rise in Illinois Courts

Cases brought under the Illinois Biometric Information Privacy Act (BIPA) continue to multiply. This Holland & Knight alert analyzes current trends in BIPA litigation.

Background

Although BIPA (740 ILCS 14) was enacted in 2008, in January 2019 the Illinois Supreme Court decided Rosenbach v. Six Flags Entertainment Corporation, et al., 2019 IL 123186 (Ill. 2019), which held that an individual does not have to demonstrate actual "harm" to establish that he or she is "aggrieved" under BIPA. (See Holland & Knight's alert, "Illinois Supreme Court Expands Potential Liability Under Biometric Information Privacy Act," Jan. 25, 2019.)

According to Courthouse News Service, 213 BIPA cases have been filed in 2018 and 2019 in Illinois state and federal courts. Most are class actions and directed at employers utilizing fingerprint technology for timekeeping purposes. ADP and other suppliers of equipment that utilize fingerprints (or algorithms derived therefrom) for timekeeping purposes have been named as direct defendants in several cases.

Defenses Raised

Defendants have raised several defenses to BIPA claims. With one exception, none of these defenses have resulted in dismissal of a claim.

Two employer defendants have claimed that BIPA is preempted by the Illinois Workers Compensation Act (IWCA). In McDonald, et al. v. Symphony Bronzeville Park, LLC, Case No. 2017-CH-11311 (Cook County), Judge Raymond Mitchell denied a motion to dismiss on IWCA grounds, holding that damages awardable under BIPA are not psychological or physical and, as a consequence, are not compensable under the Act. In Treadwell v. Power Solutions International Inc., No. 1:18-cv-08212 (N.D. Ill.), the defendant has filed a 12(b)(6) motion seeking dismissal based on IWCA preemption. As of this writing, Judge Jorge Alonso has not ruled on this motion.

Several defendants have moved to dismiss BIPA claims on standing grounds. This defense has been successful in federal court. See, e.g., McGinnis v. U.S. Cold Storage, Inc., No. 17-C-08054, 2019 WL 95154, at *3 (N.D. Ill. Jan. 3, 2019). But the validity of the defense is uncertain in Illinois state courts post-Rosenbach. Nonetheless, there is at least one motion to dismiss pending raising this issue.

At least one defendant has asserted in the Circuit Court of Cook County that the one-year statute of limitations applicable to "slander, libel or for publication of matter violating the right of privacy" should apply to actions brought under BIPA. 735 ILCS 5/13-201. The plaintiff in that case has asserted that the five-year "catch-all" limitation period applies.

ADP, in the cases in which it has been named as a direct defendant, has asserted that because it is not an employer, it cannot be held responsible for "collecting" employee biometric information and hence is not responsible for the damages authorized by BIPA. As of this writing, there has not been a ruling on this issue.

Constitutional Challenges

In Young v. World Wide Technologies, LLC, No. 19-cv-46 (S.D. Ill.), the defendant has challenged the constitutionality of BIPA's statutory damages provision on the grounds that such damages are "excessive and disproportionate in light of the absence of any actual harm."

It is expected that a constitutional challenge based on the vagueness of the term "biometric information" is likely, particularly in circumstances where this definition extends to algorithms into which fingerprints are converted in timekeeping devices.

Settlements

Many defendants have chosen to settle BIPA claims filed against them following Rosenbach. The settlement amounts in these cases range from $80 per class member in a class size of approximately 4,000 to $1,300 per class member for a class of 297. This range is likely to continue to expand as numerous additional class action settlement final approval hearings are scheduled in Illinois state court this summer.

Insurance Issues

No published decisions ruling on the insurability of BIPA damages have been located by the authors. As a general rule, coverage, if any, lies with employment practices liability insurance. One or more of those insurance carriers have, however, sought to have the policy exclusion for "civil fines and penalties" applied to BIPA's damages claims, although that position may be at odds with the holding in Standard Mutual Insurance Company v. Lay, 2013 IL 114617 (Ill. 2013) that statutory damages under the Telephone Consumer Protection Act (TCPA) are insurable.

Some directors and officers (D&O) insurance carriers have denied BIPA claims based on exclusions for claims arising out of employment. And commercial general liability (CGL) carriers have denied claims on the grounds that the underlying claims do not constitute an occurrence, or meet the definition of "bodily injury" or "property damage."

Legislative Remedies

Two pieces of legislation now pending may significantly impact the construction of future BIPA claims. The Illinois Senate introduced SB 2134 in February 2019, which would eliminate the private right of action in the present form of the statute. Also in February 2019, the Illinois House of Representatives introduced HB 3024, which would amend the definition of "biometric identifier" to include "an electrocardiography result from a wearable device."

We Can Help

For more information about BIPA or questions about how the recent interpretation of the law could affect your company, contact the authors or Partner Mark Melodia, chair of Holland & Knight's Data Strategy, Security & Privacy Team. 

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem. Moreover, the laws of each jurisdiction are different and are constantly changing. If you have specific questions regarding a particular fact situation, we urge you to consult competent legal counsel.