With many millions or even billions of dollars at stake, the Illinois Supreme Court will give business owners a chance to persuade the court to put a brake on the onslaught of biometric privacy class actions across the state, as the court hears arguments over how far into the past plaintiffs can claim damages.
For the past several years, businesses in Illinois have been hit with a multitude of lawsuits alleging violations of the Biometric Information Privacy Act (BIPA). The bulk of these class actions have largely targeted employers, claiming they failed to get consent from workers, as the BIPA law requires, before requiring them to scan their fingerprints, and did not inform them as to how scans will be collected, stored, shared and disposed. Businesses that scan employee prints generally do so to accurately track work hours and control access to secure areas in a workplace, such as cash rooms or medicine lockers.
The lawsuits also have left businesses facing potentially big financial risk.
Ryan Stephan of Stephan Zouras LLP
| stephanzouras.com
Under the BIPA, plaintiffs may demand $1,000 to $5,000 per violation. The law has been interpreted to define individual violations as each time a worker scans their fingerprints without notice and consent, as specified by the law.
When multiplied across entire workforces, the risk to businesses from such lawsuits could quickly run into the many millions of dollars or more, amounts business advocacy groups and lawyers have called potentially "crippling."
To avoid such risk, settlements paid by employers targeted by BIPA class actions have ranged from hundreds of thousands of dollars to $50 million.
On Sept. 22, the state's highest court will hear a case that could potentially limit that payout risk, and make the lawsuits much less lucrative for plaintiffs lawyers.
The lawsuit was brought in 2019 by Jorome Tims and Isaac Watson, who had worked for Black Horse Carriers Inc., a trucking company in suburban Carol Stream. Black Horse was bought in late 2020 by Penske Logistics.
Tims and Watson claimed Black Horse improperly shared biometric information with the payroll vendor used by Black Horse.
There is no statute of limitations in the BIPA law. Consequently, Tims and Watson said the state's five-year default "catch-all" statute was in effect, letting them include in the suit anyone who worked for Black Horse since 2014.
Black Horse countered by arguing the controlling time limit should be one year, as found in state law governing disclosure of secret information and defamation.
In written arguments to the Illinois Supreme Court, Black Horse contended the "true character" of the suit involves an allegation of privacy invasion, with the actual or potential "publication" — in other words, dissemination — of secret data, putting the suit under the defamation statute's one-year limitation.
"Maintaining secrecy is the essence of the action, which is why the complaint specifically cites both the actual exposure of plaintiffs’ biometric information to third parties and plaintiffs’ 'ongoing' concern that defendant’s failure to properly safeguard their biometric data will result in further disclosures," Black Horse asserted.
In addition, Black Horse said the BIPA law "focuses on preserving a plaintiff’s ability to control the secrecy of their biometrics."
Black Horse contended plaintiffs focus on how the BIPA was allegedly breached, instead of the nature of the alleged harm.
In Black Horse's view, a one-year statute better serves the purpose of the BIPA.
"A shorter statute of limitations comports with the legislative history of the Privacy Act because it was designed to address biometric data protection at the outset. Prompt action on a Privacy Act violation – particularly where inadequate safeguards against publication are at issue – is essential to securing the protections the Act was intended to provide. A policy that permits a five-year delay to redress the improper collection, use and storage of biometric data dramatically increases the risk that the data will be compromised," Black Horse maintained.
Plaintiffs ridiculed Black Horse's arguments as "nonsense," "puzzling," "nonsensical" and, at one point, as "offensive" and going on "ad nauseum."
Plaintiffs contended Black Horse "contorts the actual nature of Plaintiffs’ claims under the Act into something they are not, engaging in rhetorical gymnastics to argue that the nature of the injury stemming from Defendant’s non-consensual collection, use and dissemination actually results from the publication (or potential publication) of biometrics."
Plaintiffs added that "publicizing biometric data is not how private entities typically run afoul" of the BIPA, and in their suit, they claim Black Horse took the data without consent, not that Black Horse publicized it. Furthermore, the BIPA does not prohibit transfer of data between private parties, unless notification is not given and consent not secured.
Plaintiffs continued, quoting from statute: "The Act does not contain its own limitations period. For this reason, and as at least 34 state and federal courts universally held," "including the trial court in this case, the default five-year limitations period for 'all civil actions not otherwise provided for applies."
According to plaintiffs, "A shorter statute of limitations period would simply benefit the entity that is violating the law by encouraging noncompliance and limiting exposure, necessarily prejudicing those whom the Act is intended to protect."
The plaintiffs, Timms and Watson, are represented by Ryan F. Stephan, James B. Zouras, Paige L. Smith, Teresa M. Becvar and Catherine T. Mitchell, of the Stephan Zouras firm, of Chicago.
Black Horse is defended by David M. Schultz, John P. Ryan, Joshua G. Vincent and Louis J. Manetti Jr., of Hinshaw & Culbertson, of Chicago.
The case also drew interest from outside organizations concerned about the outcome.
The Illinois Trial Lawyers Association, the Illinois chapter of the National Employment Lawyers Association and the Employment Law Clinic filed friend-of-the-court arguments for the plaintiffs.
The Illinois Chamber of Commerce filed friend-of-the-court arguments in support of Black Horse.
The Illinois Supreme Court has ended its summer recess. Its September term runs from Sept. 13 to Sept. 22, with 23 cases on the schedule.