CHICAGO – Illinois employers who collect biometric information on their employees may have good reason to be on edge following a state appellate court's decision last month to side with employees in a class action against an upscale Chicago hotel.
The ruling signals a trend toward what companies can and can't do with biometric data, said Michael J. Faley, a partner in SmithAmundsen's Chicago office and member of the firm's labor and employment practice group.
"The ruling reflects an overall trend of increasingly tougher policing of privacy rights through civil enforcement actions in the area of collecting, storing and using people’s biometric information," he said. "This is particularly playing out in the employment setting right now.
Michael J. Faley, partner in SmithAmundsen's Chicago office
| Photo courtesy of SmithAmundsen
Faley also offered tips for Illinois businesses who'd rather not be on the receiving end of a biometric information-based lawsuit, as he cautioned efforts by the state legislature to address the legal issue have generally been weak.
"Class action waivers have been closely scrutinized by Illinois courts," he said. "Nonetheless, employers should still consider working with their attorney to craft an appropriate class action waiver to their employment agreements. More generally, the Illinois General Assembly has recently focused its attention on statutory waivers and arbitration agreements. So it wouldn’t be surprising to see movement on the class action front."
Last month, Illinois' First District Appellate Court found in Liu v. Four Seasons Hotel that employees of the Four Seasons Hotel in Chicago who had brought a class action suit against the hotel were not required to pursue arbitration as sought by the Four Seasons.
The Four Seasons employees claimed Four Seasons violated the Illinois Biometric Information Privacy Act (BIPA) when it collected, used, stored and disclosed their biometric data - their fingerprints - for logging their work hours with a so-called biometric time clock.
Employees were required to scan a fingerprint when punching in and out of work shifts.
Illinois' BIPA requires Illinois businesses to notify and obtain consent for biometric information collection and to protect biometric data "using the reasonable standard of care within [its] industry."
Four Seasons sought to compel arbitration, arguing that the employees had signed off on employment agreements that required wage or hour violation claims be submitted to an arbitrator. A Cook County Circuit Court judge denied the motion, saying the state's BIPA is not the type of dispute the parties had agreed to arbitrate, and the appellate court agreed.
"Plaintiffs' claim does not involve a 'wage or hour violation' subject to arbitration," the appellate court decision said. "Further, under the employment agreement, which limits the types of disputes that must be arbitrated, arbitrability lies within the domain of the trial court."
Faley offered nine points to help Illinois businesses avoid or at least minimize BIPA issues or potential liability.
He said employers should review policies and procedures to identify if, and when, biometric data, such as retina or iris scans, fingerprints, voiceprints, or scans/pictures of hand or face geometry are being used.
They should then establish a written policy that addresses the purpose of biometric data use, how it will be collected and how it will be stored.
He said employers should be prepared to address any requests for reasonable accommodations based on disability, religious or other valid reasons and ensure proper safeguards are in place, including contractual liability shifting.
He said employers must also ensure employees whose biometric data is used acknowledge the policy, and authorize its use and collection. Further, he said employers should train supervisors on the company’s policies and practices to ensure consistency and audit their biometric data systems to ensure that data is not open to the public or a systems breach.
Finally, he said employers should consult with employment attorneys to regularly review policies, procedures and agreements for compliance, to keep up with the law and court rulings related to BIPA and other biometric privacy matters.
And he warned employers to not count on state lawmakers to relieve their burden.
"There are some efforts in the Illinois General Assembly to curtail an individual's private right of action," he said. "Other efforts to limit the BIPA have provoked a lot of controversy."