On February 17, 2023, in Cothron v. White Castle System, Inc., 2023 IL 128004, the Illinois Supreme Court issued a sweeping decision concerning the Illinois Biometric Information Privacy Act (“BIPA”), which restricts the collection, retention, and disclosure of any “retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10, 15(b), 15(d).
As a result, all construction companies doing business in Illinois should re-evaluate their business practices to ensure compliance with Illinois privacy laws.
In Cothron, a proposed class of plaintiffs were employees of White Castle restaurants who used their fingerprints to access pay stubs and log onto company computers. The plaintiffs alleged this was done in violation of BIPA. The question before the Court was whether violations accrued with each scan of a class member’s fingerprint, or with only the first scan. 2023 IL 128004, ¶ 1. In a 4-3 split decision, the Court ruled that each scan is a separate violation, which could have massive implications for damages as BIPA provides for, among other relief, statutory damages of between $1,000 and $5,000 for each violation, plus reimbursement of attorneys’ fees. 740 ILCS 14/20.
BIPA went into effect in 2008 following legislative findings such as, the “use of biometrics is growing in the business and security screening sectors,” biometrics may be “used to access finances and other sensitive information,” and the “overwhelming majority of members of the public are weary of the use of biometrics.” 740 ILCS 14/5. On this record, the legislature saw fit to restrict the collection, retention, and disclosure of any “retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10, 15(b), 15(d).
While BIPA has been in place for nearly fifteen years, it is only in the past few that it has triggered much litigation. A 2021 report by the tort-reform-minded Institute for Legal Reform noted that between 2008 and 2016 only 15 BIPA class action lawsuits were filed, but that ballooned to approximately 900 BIPA-related actions between 2015 and the first quarter of 2021. See A Bad Match: Illinois and the Biometric Information Privacy Act, Institute for Legal Reform, available at Institute for Legal Reform. The report goes on to note that cases had been filed against defendants of all stripes – from a family-run regional chemical company, to a local HVAC contracting firm, to a global hotel chain. Id.
There are myriad ways in which a construction-related business might run afoul of BIPA. Are employees’ faces photographed or capture by video while on job sites? Photographs and videos may qualify as “biometric identifiers” under BIPA. Wilk v. Brainshark, Inc., No. 1-212-cv-4794, 2022 WL 4482842 (N.D. Ill. Sept. 27, 2022). Are facial-scans utilized for site security? Those too may constitute “biometric identifies” under BIPA. Sosa v. Onfido, Inc., 600 F. Supp. 3d 859 (N.D. Ill. 2022). And, obviously, any use of employee fingerprints could have BIPA implications.
As this remains an emerging area of the law, there are few hard and fast rules to follow to avoid potential liability. However, BIPA is clear that companies should develop written policies for dealing with biometric identifiers, make those policies widely available, inform employees of the policies, and get the employees’ informed consent in writing before collecting any such data. 740 ILCS 14/15(a).
