An appellate court has ruled companies must gain workers' informed consent before requiring them to scan fingerprints or other biometric identifiers, not afterward, as claimed by a Rockford business caught up in a suit that alleges it violated Illinois' stringent biometric privacy law.
The Nov. 30 decision was penned by Justice Ann Jorgensen, with concurrence from justices Liam Brennan and Mary Schostok, of Illinois Second District Appellate Court in Elgin. The decision favored plaintiff Trinidad Mora in his action against J&M Plating, which cited the Illinois Biometric Information Privacy Act (BIPA).
Mora started working for J&M in 2014, clocking in regularly with a fingerprint scan. The company did not institute a written retention and destruction schedule for employees' biometric data until 2018, at which time Mora gave his written consent for the collection and use of his data. Mora left J&M in 2021 and J&M soon destroyed his data.
Carl Malmstrom
| Wolf Haldenstein
One month after Mora's departure, he sued in Winnebago County Circuit Court, alleging J&M did not establish the retention and destruction schedule until four years after Mora joined J&M. Mora claimed BIPA required the schedule be in place before biometric information is collected.
Judge Donna Honzel found BIPA set no deadline for when a schedule needs to be in place and, at any rate, J&M did eventually establish a schedule while Mora was still in its employ.
"There’s no harm here. They ultimately did comply. There is no timing language in the statute," Honzel determined.
On appeal, Justice Jorgensen concluded Honzel was wrong.
"The Biometric Act requires a private entity such as defendant to develop a retention-and-destruction schedule upon possession of biometric data," Jorgensen said.
Jorgensen rejected J&M's argument that "the statutory duty is satisfied so long as a schedule exists on the day that the biometric data possessed by a defendant is no longer needed or the parties’ relationship has ended."
Instead, "the duty to develop a schedule upon possession of the data necessarily means that the schedule must exist on that date, not afterwards," Jorgensen wrote.
As far as Honzel's conclusion Mora suffered no harm, Jorgensen pointed out the Illinois Supreme Court ruled, in a 2019 biometric case, that '“a person need not have sustained actual damage beyond violation of his or her rights under [the Biometric Act] in order to bring an action under it."' In other words, the alleged violation itself is enough to sustain a lawsuit, Jorgensen explained.
Jorgensen returned Mora's suit to circuit court for further proceedings.
Mora is represented by Carl V. Malmstrom, of Wolf, Haldenstein, Adler, Freeman & Herz, of Chicago. Mora is also represented by Max S. Roberts, of Bursor & Fisher, of New York City.
J&M Plating is defended by Joshua G. Vincent, Michael F. Iasparro and Stephen D. Mehr, of Hinshaw & Culbertson, of Chicago.
The stakes are considerable in BIPA actions.
In October, a federal jury in Chicago rendered a $238 million verdict against rail carrier BNSF for breaching BIPA. Most of the money is to go to around 45,000 truck drivers who had to scan their handprints to verify their identities when entering BNSF rail yards, without BNSF first securing their consent and telling them what would be done with their scans. The verdict was the first to be delivered under BIPA.
Lawyers have typically claimed around one third of all money paid to plaintiffs through settlements to end class actions under the BIPA law.
On Nov. 9, BNSF asked the judge in the case to grant a new trial or at least reduce the verdict, contending the truckers were not harmed and BNSF's vendor, Remprex, rather than BNSF, furnished the technology and handled the scanning.
Attorneys for the truck drivers claimed the $238 million was too low and the amount should be in the neighborhood of $800 million, based on the number of times the truckers were required to scan their fingerprints.