The recent Illinois Supreme Court rulings in the Biometric Information Privacy Act could cost businesses operating in Illinois staggering amounts of money and already are having a negative impact on Illinois’ already challenging business climate, economic development and public safety, business leaders have warned.
In recent weeks, the state's high court handed down a pair of decisions cementing the ability of plaintiffs to use class action lawsuits to potentially demand employers pay out many millions or even billions of dollars for mistakes made in the way they require workers to scan their fingerprints to verify their identity when punching the clock at work.
Brad Tietz, vice president of government relations and strategy for the Chicagoland Chamber of Commerce, said the recent rulings could be “detrimental" and “shocking" for Illinois businesses.
Brad Tietz
| Chicagoland Chamber of Commerce
Tietz pointed to recent actions by Gov. JB Pritzker to try to entice the electric vehicle industry to open new plants in Illinois and become better established in the state. But he said the risk of facing potentially massive payouts under class action lawsuits brought under the Illinois Biometric Information Privacy Act has played a role in persuading those companies to look elsewhere.
"There are companies now who were looking at Illinois or were beginning to set up shop in Illinois who after they saw that White Castle decision just pulled up shop and said, ‘We can’t do this anymore,'" Tietz said. "So it is impacting economic development."
In a 4-3 decision, the Illinois Supreme Court said fast food chain White Castle is liable for repeatedly scanning fingerprints of nearly 9,500 employees without their consent. The court ruled BIPA should be interpreted to allow plaintiffs to demand damages of $1,000-$5,000 for each and every scan of a person’s fingerprints or other biometric identifiers, not just the first one.
White Castle has estimated that, under that ruling, a class action lawsuit it is now facing could cost it more than $17 billion, even though no employees were actually harmed and their biometric data never leaked or hacked.
Tietz also said other companies seeking to deploy innovative technologies elsewhere across the country are not looking at Illinois because of the potential risk under the BIPA law. Public safety is a concern for his members, he said, and certain kinds of new cameras could help combat organized retail theft. But such technology isn’t coming to the state because of the court's consistent interpretation of the law to favor demands from trial lawyers, Tietz said.
On the books since 2008, the BIPA law was touted by supporters as a way to govern how companies must collect and protect Illinois’ residents so-called unique biometric identifying data, such as scans of retinas, fingerprints or faces. The law also included provisions designed to punish companies that fail to safeguard that data, or improperly share it with others.
From 2008-2015, no class action lawsuits were filed, 2015-2019 there were 173, and since 2019 there have been 2,000 lawsuits filed, according to Tietz The majority have come after a 2019 Illinois Supreme Court decision in Rosenbach v. Six Flags, which held that a plaintiff need not demonstrate any form of concrete harm beyond a mere technical violation of the law's notice and consent provisions.
In the years since, the courts have consistently shot down most other attempts by most businesses to find ways to defend themselves against the law's potentially "crippling" financial damages, should cases proceed to trial. That has led many employers and other businesses to instead settle, rather than take their chances in court.
Those concerns appear to have been borne out in recent months.
In late 2022, the first BIPA class action case went to trial, with a federal jury ordering railroad operator BNSF to pay more than $238 million to about 45,000 truck drivers who claimed they were wrongly required to scan their fingerprints to access secure rail yards in Illinois. While BNSF has appealed to undo that verdict, plaintiffs' lawyers have followed with a motion to throw out the verdict, because they believe the jury should have ordered BNSF to actually pay at least $800 million.
Then, on Feb. 2, in the case of Tims v. Black Horse Carriers, the Illinois Supreme Court eliminated the possibility of limiting damages to just a one-year statute of limitations for claims under BIPA. Instead, the state high court ruled that a “catchall” five-year statute of limitations applies to these cases, dramatically increasing the timeframe for which complaints can be brought and exponentially multiplying the potential payout.
"With the statute of limitation ruling, even if you’re in compliance now, if you weren’t a couple of years ago, you're a sitting duck basically,” Tietz said.
That decision was then followed by the Supreme Court's ruling in the class action against White Castle, further expanding the potential scope of the law, and the potential danger to businesses operating in Illinois.
The overwhelming bulk of the class action lawsuits have taken aim at smaller companies, a wide range of employers sued for the way in which they require workers to scan fingerprints or other biometric identifiers to clock in and out of work shifts, or to access secure facilities or systems on the job.
Tietz said 94 of his organization's member businesses are either being sued or have been sued under the BIPA law. A 2021 analysis conducted by the Chicagoland Chamber found nearly half of lawsuits were against small businesses, with fewer than 500 employees. Small businesses and non-profits are particulaly vulnerable to these lawsuits that could have a devastating financial impact, but every sector within the Illinois business community is at risk, Tietz said.
To attempt to reduce the danger to the state's economy, the Chicagoland Chamber of Commerce has joined a coalition of other business grous that includes the Illinois Health Care Association, Illinois Health and Hospital Association, Illinois Hotel & Lodging Association, Illinois Manufacturers’ Association, Illinois Retail Merchants Association, Illinois Trucking Association and TechNet, all of which are calling on lawmakers in the Illinois General Assembly to reform the Act.
While noting the general danger to Illinois businesses and employers from the unrestrained risk of massive lawsuit damages, the coalition particularly noted dangers to critical human services providers, such as hospitals, nursing homes and other senior care facilities.
Matt Hartman, executive director of the Illinois Health Care Association, which represents nursing homes and other long-term care facilities throughout the state, declined to reply to repeated messages from The Cook County Record, asking him to reply to questions about the coalition and the risk of BIPA class actions to that industry.
But in a release discussing the calls for reform, Hartman said the litigation risk creates "a real risk of facility closure and a significant impact on access to care if legislative revisions to BIPA are not made."
Karen Harris, senior vice president and general counsel for the Illinois Health and Hospital Association, said she’s aware of at least a dozen class action lawsuits against hospitals for alleged BIPA violations. Many hospitals — and increasingly more in recent years -- use biometric technology to prevent diversion of medications and to improve access to medications.
"I know a lot of hospitals have been investing in this kind of technology and it's not cheap," Harris said. "And now with these decisions everybody is rethinking it and that’s problematic for the patient care side, as well as just good public health policy."
Harris said such lawsuits could be financially devastating to an industry still recovering financially from money spent on responding to the Covid-19 pandemic.
"The federal government did provide for hospitals all across America," Harris said. "However, I don’t think the general public understands really the scope of the financial stress that has been placed on hospitals as a result of the pandemic even with the additional resources. It’s just been tremendous.
"For rural hospitals, safety net hospitals, hospitals that were struggling financially before the pandemic, this has a been a severe strain and a judgment in a BIPA case could be catastrophic," Harris said.
The coalition and others the IHHA are working with have highlighted the problems with BIPA.
"I think they were unintentional," Harris said.
She noted the BIPA law was enacted in 2008, years before many of the current biometric technologies were ever deployed.
While state lawmakers may have been attempting "to be proactive and provide privacy protection," they "didn’t know what the technology would be yet and now that the technology is here and we're actively trying to use it."
Harris said state lawmakers now should "rethink to align (the law) with what’s actually being used."
"This happens frequently, not just with biometrics, the world changes and regulations lag behind. It’s time we update it to what’s currently being used while still maintaining privacy,” Harris said.
Jonathan Bilyk contributed to this report.