CHICAGO — As they face a growing number of class action lawsuits from workers accusing them of improperly collecting and storing their fingerprints and other biometric data, employers should not ignore the litigation threat arising from a growing number of state laws protecting biometric privacy.
"Companies should consult with their lawyers and... adopt policies and procedures to comply with these [and other] requirements," said attorney Steve Gold, with McguireWoods in Chicago. "It is also important for a company to work with its lawyers and its information technology personnel to take steps to maintain the security and privacy of private information including biometrics so as to reduce any possible harm to the individuals whose information is collected."
In the Chicago area, two recent cases highlight the risk. First, in March, former Mariano's supermarket employee Norman Baron sued Roundy's, an affiliate of Kroger, the parent company of Mariano's, alleging the supermarket chain's policy requiring employees to use a unique fingerprint to clock in or out of their shifts violated the Illinois Biometric Information Privacy Act (BIPA),
The law was enacted in 2008, purportedly to protect the security of biometric data belonging to Illinois residents, including fingerprints and retinal data.
For Mariano's system to work, the company allegedly had to scan and store each employee's unique fingerprint. However, the company never acquired the express written consent of its employees before storing the data, according the to the lawsuit.
Shortly after, Intercontinental Hotel Group was also hit with a similar lawsuit in Chicago, as employees there similarly alleged the hotel chain had also improperly collected and stored employee biometric data.
Gold said Illinois has unusually strict guidelines when it comes to the manner by which companies handle employee biometric data.
"In Illinois [and a few other states], there is a specific statute addressing biometric information, such [as] a fingerprint," he said. "That law provides that no private entity may collect such information unless it first follows certain guidelines."
Gold said these guidelines include three key rules.
"The company must inform the person in writing that it is collecting the biometric information; it must inform the person in writing of the purpose and length of time for which it is collecting the information; and obtain an informed written consent, which must, in the context of employment, be signed as a condition of employment," he said.
Baron's class action suit, which was originally filed in the Cook County Circuit Court, was removed to the U.S. District Court for the Northern District of Illinois.
In its request for removal, the supermarket chain estimates that the total cost of damages could surpass $5 million.