A recent Illinois Supreme Court decision appears to have emboldened plaintiffs' lawyers to boost their settlement demands from Illinois employers targeted by an ever rising wave of class action lawsuits under Illinois' biometrics privacy law.
In January, the state Supreme Court laid down a widely anticipated decision, effectively ending efforts by some Illinois employers to use Illinois' workers' compensation law to find relief from the growing burden of the legal actions brought under the Illinois Biometric Information Privacy Act.
For years, employers and other businesses, of many different types and sizes, have become the target of BIPA class actions. The bulk of those lawsuits have accused employers of failing to abide by notice and consent provisions embedded in the law, before they require workers to scan fingerprints or some other biometric identifier to verify their identity when punching the clock at job sites, or when accessing secure facilities.
Todd Maisch, president and CEO of Illinois Chamber
| Illinois Chamber website
The state high court specifically thwarted the attempt by employers to argue those class actions should be removed from court, because the alleged injury suffered by the workers under the BIPA law occurred in the workplace. The court said the workplace "injuries" suffered by workers who must scan their fingerprints to begin and end work shifts, without having first given written consent and without first receiving notices concerning how the company would use the scanned biometrics, are not the same as a typical physical or mental injury that would be covered by the Illinois Workers' Comp Act.
So, workers can continue to bring BIPA class actions, because under a 2019 Illinois Supreme Court decision, they do not need to prove any concrete injury at all to press their BIPA claims, the court determined.
However, though the high court’s unanimous decision rejected the workers' comp defense, Chicago lawyers who have specialized in recent years in defending companies against BIPA lawsuits, say there are other cards on the table for employers.
“There is still an array of defenses that employers can use that run the gamut between arbitration agreements to move a case out of court to private arbitration on a single plaintiff basis,” said Gerald Maatman, partner at Seyfarth Shaw LLP in Chicago.
The Illinois BIPA law protects the collection, use and handling of biometric identifiers – interpreted as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Among other things, it requires an employer to receive written consent from employees before utilizing such biometric identifiers.
Now that the Illinois Supreme Court has declared claims under BIPA are not the same as those filed under workers compensation, there is a clearer roadmap of how these class actions can be handled in the future, Maatman said.
“They successfully steered around [works comp], so some plaintiffs’ lawyers … are contacting defense councils to ask if [they] want to talk settlement, [saying], ‘Whatever my settlement was before, now it’s a bit higher because this defense has been eliminated,’” Maatman said. “The plaintiffs’ bar is somewhat emboldened by the opinion. The defense bar has said, ‘That’s one defense, but there are a lot of other defenses.’ There’s a bit of jockeying back and forth.”
Most notably, employers and plaintiffs' lawyers alike, are waiting to see what the Illinois Supreme Court may say about how the passage of time - known as the statute of limitations - may affect the extent of damages plaintiffs may be able to demand in the lawsuits, said Maatman.
The text of the BIPA law does not specify a statute of limitations period. To that point, the case of Tims v. Black Horse Motor Carriers, Inc., is pending right now at the Illinois Supreme Court to determine whether plaintiffs should be able to levy claims dating back five years, or whether the limitations should be capped at one year.
Defendants have argued the proper time limit for BIPA actions should be the one-year limit for "wrongful publication," established under the state law governing defamation and libel claims, known as Illinois code section 13-201. Plaintiffs, however, argue the standard should be the five year "catch-all" statute of limitations, established under a different law, Illinois code section 13-205, for all civil actions not otherwise provided for.
There’s also a two-year statute of limitations case that could make its way up to the high court, said Erin Bolan Hines, an attorney at the firm of Shook, Hardy & Bacon L.L.P. in Chicago.
“The statute of limitations is still very much in debate,” Hines said.
Because of that debate, some defense lawyers are trying to stave off settlements, which can quickly accrue when the BIPA law allows plaintiffs to demand potentially crippling damages from employers. Under the law, nonintentional violations of BIPA can result in damages of $1,000 per violation, and intentional violations can bring $5,000 per violation. The courts have interpreted the BIPA law to define individual violations as each time an employee scans their fingerprint, for instance. When multiplied across an entire workforce, scanning their prints multiple times a day, the potential payout that could be ordered by a jury could quickly climb into the millions, or even billions of dollars, depending on the size of the company and other factors.
“At this point, because the statute of limitations has such an impact on not just an individual plaintiff’s claim, but the potential size of the class, we continue to think that there’s no reason to jump into a settlement right now,” Hines said. “Many of these cases have been stayed because of all these appeals that are deciding these key issues. Workers compensation is one of them; you also have accrual, HIPA exclusion, labor law preemption – which just happened in federal court, with some briefing going on in appellate court in the state court. Because there’s so much uncertainty, there’s still good reason to continue the stays in these cases.”
A HARD TIME FIGHTING BACK
In the 2022 edition of the Seyfarth Shaw annual Workplace Class Action Litigation Report, of which Maatman is general editor, sources predicted an uptick in class action litigation across the board this year, but also specifically within biometric privacy law.
The report noted that the top 10 settlements in private plaintiff statutory workplace class actions “increased exponentially” last year, totaling $1.67 billion in 2021, as opposed to $219.93 million in 2020 and $319.65 million in 2019.
Four of those largest settlements involved biometric privacy lawsuits. Of note is the settlement in Lark, et al. v. McDonald’s USA, LLC, in which $50 million was granted to settle a class action claiming McDonald’s collected fingerprint data without worker consent.
Not all BIPA cases are so high profile. Many, if not most, affect smaller businesses like assisted living facilities and safety net hospitals that have employees scan their thumbprints to clock in and out of work or access sensitive medicines, said Todd Maisch, president of the Illinois Chamber of Commerce.
Overall, Illinois employers have been hit with more than 1,600 BIPA lawsuits since the law was enacted in 2008, and most of those employers didn’t know the law existed, Maisch said.
Now, even if they do know, they're having a hard time fighting back.
"To the extent that employers have [worked] to comply with wage and hour law, the BIPA wave hit them next," Hines said. "It's not across-the-board noncompliance from every employer. They all have their unique circumstances, but there are defenses to all their cases, so we just have to find out the facts, basically, and then we can advise them after that."
Maatman believes not only will the cases currently awaiting settlement see an increase in compensation requests, but the sheer number of cases will increase as well.
“We’re going to see more employers hit, but we’ll see more consumer product BIPA cases as the plaintiffs bar gets more inventive and tries to employ BIPA in more nontraditional ways,” he said.
While employers are learning to be more proactive to avoid litigation by providing consent forms and the like, consumer product bases still aren’t thinking about technology being covered by BIPA status, he said.
Hines agrees that BIPA litigation will, if anything, continue to rise.
“All I can say is the filings have not slowed down since that [Supreme Court workers compensation decision] happened,” Hines said. “And maybe they are even up a bit.”
OUT OF STEP WITH THE COUNTRY
While lawyers await decisions from the high court, Illinois employers await legislation that could provide overarching relief from BIPA law.
Increased knowledge of BIPA and its requirements has been the best insulation from additional lawsuits, Maisch said.
But a “very aggressive trial bar that [is] simply trying to get paid” keeps changing its method of attack, making it difficult for small businesses in particular to keep up, he said.
“It’s a moving target for employers,” Maisch said. “It started out with … timing in, timing out for your employees. If you used a thumbprint to say you’re on the job, that is where most of the lawsuits started … . The last permutation is, BIPA also says you have to update employee manuals. If you [don’t] have exactly the right verbiage in your manual, boom, you’re privy to a lawsuit. The target keeps moving, and as employers decide how to defend themselves, the trial bar keeps trying to move to other areas.”
Maisch said the best future defense for employers is comprehensive BIPA reform.
“We recognize this law is very onerous to employers,” he said. “It would be nice if the legislature would help.”
Currently, there are several pieces of legislation that attempt to address the liability concerns that employers are subjected to under BIPA, Maisch said.
Last year, House Republican Leader Jim Durkin, R-Westmont, and Rep. Keith Wheeler, R-Oswego, introduced separate bills that, among other changes to BIPA, would allow employers to receive electronic consents and releases for biometric data and restructure the damages allotted to claimants.
“The Chamber, for three or four years, has said, ‘OK, if you think this is real harm, we may not agree with you, but let’s diminish the cost because right now, it’s $1,000 per violation, and that adds up,’” Maisch said. “We would recommend that if indeed there needs to be some liability loss exposure from employers, the penalty should be much much lower. [Rep.] Durkin has that [type of] legislation … so we’re not bankrupting employers when no one can demonstrate that there’s been any actual harm in taking that thumbprint.”
Apart from liability protection, Maisch also notes that BIPA reform could help Illinois businesses, by bringing the state's law more in line with national biometric safety measures.
“One of the problems with the Illinois BIPA bill is we are the only state that doesn’t have a personal safety or law enforcement exemption for BIPA,” Maisch said.
Currently, for instance, some convenience stores utilize facial recognition technology to determine if potential shoppers have been convicted of store-related crimes. If a person previously has been caught stealing, for example, he or she might not be allowed immediate entrance.
Similarly, some big box retailers employ systems which scan customers' faces, and as long as those customers haven’t stolen from one of those stores elsewhere, they can open a display case for an expensive item, like a video game console, without calling an associate over to unlock the case, Maisch said.
“That’s another example of how Illinois cannot employ those technologies because of BIPA, when 49 other states allow these safety options for consumers and employers,” he said.
While the Chamber would like to see both liability and safety measures passed in BIPA reform bills, it’s more likely that the safety options will gain more traction, Maisch said.
Jonathan Bilyk contributed to this report.