A state appeals panel says class action lawsuits filed under the state’s biometrics privacy law can cover claims from five years before the lawsuit was filed, not just one, advancing swarms of class action lawsuits, primarily targeting hundreds of Illinois employers accused of improperly scanning their workers’ fingerprints.
The decision in the closely watched case deals yet another blow to Illinois employers and other businesses operating in the state, who continue to seek some way to limit the reach of the thousands of class actions brought under the Illinois Biometric Information Protection Act (BIPA) – lawsuits that employers and their advocates have told the courts could leave targeted employers across the state crippled or even bankrupt.
The decision centered on a class action brought in Cook County Circuit Court against trucking and logistics operator, Black Horse Carriers Inc.
Illinois First District Appellate Court Sheldon A. "Shelly" Harris
| harrisforjustice.com
The lawsuit was filed in 2019 by attorneys with the firm of Stephan Zouras LLP, of Chicago, on behalf of named plaintiffs Jorome Tims and Isaac Watson, who at one time worked for Black Horse.
The complaint was similar in many ways to the thousands of class actions brought against employers of all types and sizes, operating in Illinois, since 2015.
In the lawsuit, Tims and Watson accused Black Horse of violating the BIPA law in the way it required workers to scan their fingerprints when punching the clock to begin and end work shifts.
Specifically, the lawsuit accused Black Horse of requiring workers to scan their fingerprints without first securing written consent from the workers, and without providing them with notices concerning why the fingerprint scans were needed, and how the company would store, share, use, and ultimately, destroy, the scanned biometric data.
Under the BIPA law, the complaint said, Black Horse allegedly violated Section 15(a) of BIPA by “failing to institute, maintain and adhere to a retention schedule for biometric data;” violated BIPA Section 15(b) by “failing to obtain informed written consent and release before obtaining biometric data;” and allegedly violated Section 15(d) of the law by allegedly “disclosing or disseminating biometric data without first obtaining consent.”
Employers are typically accused of violating Section 15(d) by allegedly sharing the employee data with other companies who may install and support an employer’s “biometric timeclocks,” or the timeclocks on which workers scan their fingerprints to verify their identity when beginning or ending shifts.
The lawsuit vs Black Horse seeks to expand the action to include nearly everyone who worked for Black Horse since 2014, or five years before they filed suit.
The stakes in the Black Horse case and other similar BIPA class actions can be high. Under the BIPA law, plaintiffs are allowed to demand payouts of $1,000-$5,000 per violation. Courts have defined individual violations as each time a worker scans their fingerprint. Multiplied over potentially hundreds of workers, scanning their fingerprints multiple times each day, the potential damages could easily soar into the many millions, or even billions of dollars.
To avoid such risk, a growing number of employers have opted to settle, rather than fight the lawsuits to trial. Typical settlements have ranged from hundreds of thousands of dollars to more than $25 million, depending on the size of the company being sued and the extent of the possible damages.
Some defendants, however, have continued to contest the actions, trying to find ways to either win dismissal or at least limit their potential liability under the law.
In response to the lawsuit from Tims and Watson, Black Horse argued the plaintiffs cannot seek damages for fingerprint scans dating back more than a year.
Because the BIPA law itself contained no statute of limitations – or legal language limiting how far back in time plaintiffs can claim they were injured – Black Horse argued the appropriate limits should be found in Illinois’ law governing defamation and libel claims.
Since the BIPA violation claims involve the collection and sharing of information, and alleged violations of people’s secrecy rights, the one-year limit for lawsuits over the wrongful “publication” of secret, protected information contained in the law, generally known as Section 13-201, should apply to BIPA claims, as well.
Plaintiffs, however, argued BIPA claims should be considered under the state’s general five-year “catch-all” statute of limitations contained in the law known as Section 13-205.
In Cook County court, Judge David B. Atkins shot down Black Horse’s arguments, saying he believed the plaintiffs were arguing Black Horse had merely violated the technical notice and consent provisions within BIPA, and were not accusing the trucking firm of violating any privacy rights or publishing information improperly.
So, Atkins ruled, the five-year statute of limitations should apply to the case, since BIPA did not include any specific time limits.
Atkins, however, allowed Black Horse to take the question over the proper statute of limitations to the Illinois First District Appellate Court in Chicago.
At the appellate level, Black Horse met with mixed results.
A three-justice panel of the First District court said they believed the accusations brought under Section 15(d), concerning how Black Horse may have shared the scanned fingerprint data with tech vendors or other third parties, should be governed by the one-year statute of limitations within Illinois defamation law. Those alleged violations involved a "publication" of the information, and a possible violation of privacy rights.
But the justices rejected Black Horse’s attempt to apply that one-year limit to the notice and consent provisions in Sections 15(a) and 15(b), saying those provisions “have absolutely no element of publication or dissemination.”
“A plaintiff could therefore bring an action under the Act (BIPA) … without having to allege or prove that the defendant private entity published or disclosed any biometric data to any person or entity beyond or outside itself,” the justices wrote.
Therefore, they said, claims under Sections 15(a) and 15(b) fall under the “catch-all” statute of limitations imposed under Illinois law.
The opinion was authored by Justice Sheldon A. Harris. Justices Mary L. Mikva and Sharon Oden Johnson concurred in the decision.
The Black Horse case had attracted attention from other courts and parties involved in BIPA litigation. They particularly were watching how the appellate court would rule on the question of the statute of limitations over the notice and consent claims.
Claims under those sections of the BIPA law have typically formed the backbone of most class actions brought under BIPA, particularly when employers are the targets.
One particularly interested party is the human resources vendor Kronos, a major supplier of biometric timeclocks to employers in Illinois and elsewhere. The company is facing a potentially massive class action on its own, as plaintiffs have argued Kronos was also obligated to secure consent from potentially many thousands of workers employed by the companies to which Kronos sells its services, before allowing those employers to require workers to use biometric timeclocks supplied and supported by Kronos.
Kronos has argued it could not possibly be required under the law to secure consent and provide notice to people who work for someone else. But judges have rejected their attempt to escape from the lawsuit.
Kronos has argued the class action it faces should be halted while Illinois courts sort out key legal questions, including those presented by Black Horse over the statute of limitations. In court filings, Kronos noted a one-year time limit would significantly reduce the scope of the case against it, and drastically reduce the amount of money plaintiffs could demand.
The U.S. Seventh Circuit Court of Appeals is also considering whether damages under BIPA-related class actions can be restricted to just one injury per employee, not potentially hundreds or thousands per worker.
Black Horse could yet seek to appeal the First District’s decision to the Illinois Supreme Court.
Plaintiffs are represented by attorneys Ryan F. Stephan, James B. Zouras and Catherine T. Mitchell, of the Stephan Zouras firm.
Black Horse has been represented in its case by attorneys David M. Schultz, John P. Ryan, Adam R. Vaught and Louis J. Manetti Jr., of the firm of Hinshaw & Culbertson, of Chicago.