On February 3, the Illinois Supreme Court held that the state’s Workers’ Compensation Act (WCA) does not preempt claims for statutory damages under the Illinois Biometric Information Privacy Act (BIPA), significantly limiting a key defense used by employers in BIPA litigation.
Below we provide some background on the BIPA and WCA, and explain why this decision matters for organizations across the globe handling the biometric identifiers and information of Illinois residents.
BIPA & WCA Background
BIPA, which has been in effect since 2008, regulates how private entities collect, use, and store “biometric identifiers” and “biometric information” belonging to Illinois residents. Although hotly contested in the courts, BIPA has been used extraterritorially to apply to organizations outside of Illinois and also where the Illinois resident is not currently living in Illinois.
A “biometric identifier” is defined under BIPA as a “retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” “Biometric information” is defined as any “information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual.”
Private entities covered under BIPA must: (1) have a publicly available written policy containing certain statutory requirements around the collection, use, and storage of biometric identifiers and information; (2) obtain the individual’s written consent before collecting said information; and (3) comply with the statute’s restrictions on use, sale, and storage of biometric identifiers or information.
BIPA provides for a private right of action, allowing for the recovery of $1,000 in statutory damages (or $5,000 for intentional or reckless violation) or actual damages, whichever is greater. Prevailing plaintiffs may also recover reasonable attorneys’ fees and “other relief.”
The WCA is the state’s workers’ compensation law, governing workplace injuries. Like other states, the WCA states that workers’ compensation is the exclusive remedy for workplace injuries and damages that occur during the course of employment.
IL Supreme Court Ruling
As BIPA litigation has exploded in recent years, so too have the number of defenses asserted by defendants, including employers. Specifically, where the BIPA claim is based on an employment practice (e.g., using a fingerprint to sign-into the time keeping system), employers often argue that the WCA provides the exclusive remedy for damages as the injury is allegedly one that arises under the course of work.
On February 3, the Illinois Supreme Court effectively closed the door on a version of that defense and held that as a general matter the WCA exclusivity provision does not preclude a BIPA claim. Specifically, the court stated: “The personal and societal injuries caused by violating [BIPA’s] prophylactic requirements are different in nature and scope from the physical and psychological work injuries that are compensable under the [WCA].”
Why This Matters
The Illinois Supreme Court’s ruling further demonstrates the need for organizations covered under BIPA to ensure their collection, use, and storage of biometric information and identifiers of Illinois residents is carefully planned and executed.
The best defense to BIPA claims remains proactive compliance. Organizations currently using biometric identifiers or information, or considering doing so in the future, should carefully examine their collection, usage, and storage practices around that information, and think through potential coverage under BIPA. Employment and non-employment practices need to be considered.
Biometric information can be used for a variety of purposes, and has the potential to transform how organizations do business. As more states and cities implement biometric specific regulation, such as New York City, it’s critical that organizations to think through smart and strategic data strategies around biometrics to not only ensure compliance but also drive increasing market share.