Influx of Class Actions Expected Against Employers Who Use Biometric Information

The Illinois Biometric Privacy Act has been around since 2008, but a recent Illinois Supreme Court opinion has breathed new life into the statute. The Act governs private entities' use of "biometric identifiers," which include a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. The most common use of such information in the employment context is for timekeeping purposes, such as using employee fingerprint scans to clock in and clock out of work (a handy tool to avoid time theft).

In late 2017, the Illinois Court of Appeals held that an individual could not bring a claim pursuant to the Act unless they alleged that some “actual harm” resulted from a violation of the Act. In 2019, the Illinois Supreme Court reversed that holding, finding that plaintiffs do not need to allege actual harm to recover under the statute, all they need to allege is a technical violation of the statute.

The Supreme Court’s decision will no doubt result in an influx of class action litigation against employers who use employees’ biometric information and do not comply with the provisions of the Act. As a violation of the Act can result in hefty damages, we recommend that employers do the following:

• Maintain a written policy within your employee handbook that explains the company’s use of biometric information, how long the biometric information will be retained, and how the biometric information will ultimately be destroyed.
• Obtain a written release from each employee authorizing the company to collect, use, and store their biometric information.
• Protect employees’ biometric information once you have collected it. Employers should treat biometric information in the same manner it treats other confidential information and may not sell or profit from a person’s biometric information.
• Select a vendor well-versed in the requirements of the Act. A vendor installing a biometric time clock, for example, should be aware of the requirements of the Act and represent to the employer that it is complying with those requirements in a provider agreement.
• Keep apprised of biometric data laws in other states. Biometric data is a hot topic and other states are following Illinois’ lead. Employers with employees outside of Illinois should be aware that some states have already passed such laws (including Texas and Washington) and others are in the process of passing and implementing such laws.
• Be mindful of medical issues which may affect an employee’s ability to use a biometric timeclock. Although unlikely to occur, if a situation arises in which an employee has a medical issue that precludes the use of their biometric information (for example, an employee missing an index finger for a fingerprint scan, or an eye for a retinal scan), the employer must offer that employee an accommodation or risk running afoul of the Americans with Disabilities Act.

For further assistance with these issues, contact Elizabeth M. Pall at 312/840-7099 or Rachel E. Yarch at 312/840-7029.