Defense against BIPA eliminated
The Biometric Information Privacy Act (BIPA) [Illinois] has been an extremely impactful law. It has spawned numerous class-action lawsuits. It relates to biometric information. Biometric information is defined in the Act to mean any information based on an individual’s biometric identifier used to identify an individual. A biometric identifier is defined to include: a retina or iris scan, fingerprint, voiceprint, or a scan of hand or face geometry. The BIPA governs private entities’ collection, use, and storage of individuals’ biometric information.
The penalties for violation of the BIPA include $1,000 per negligent violation or $5,000 per reckless or intentional violation. In the context of a class-action lawsuit, these penalties can add up quickly. Many individuals can each suffer numerous violations of the law.
With the threat of such hefty penalties, violating entities were looking for ways to not have the BIPA apply to their activities. One such way to avoid the application of the BIPA to your activities was to assert that it was pre-empted by another law.
Employers whose violating behavior pertained to their employees’ biometric information argued that the BIPA was pre-empted by the Illinois’ Workers Compensation Act (IWCA). They alleged that the privacy violations they committed against their employees were workplace injuries and should be handled under the IWCA rather than the BIPA.
The Illinois Supreme Court has laid those arguments to rest. In its ruling in McDonald v. Symphony Bronzeville Park, LLC, the Illinois Supreme Court determined that the IWCA was not the exclusive remedy for employees whose biometric information was used or collected by their employers.
The Illinois Supreme Court agreed with the trial and appellate courts which rejected the pre-emption defense. One stated reason for the rejection is that the IWCA protects employees from different types of injuries than the BIPA does. The types of injuries protected by the IWCA are “psychological or physical,” whereas the injuries protected by BIPA are “personal and societal.”
Notably, Section 25 of the BIPA addresses another law which does pre-empt BIPA, stating that nothing in the BIPA, “shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 (GLBA) and the rules promulgated thereunder.”
The Latin phrase that legal scholars love, “expressio unius, exclusio alterius” is a strong support for the Illinois Supreme Court’s decision here. The expression of one thing excludes others. By identifying another law that could potentially come into conflict with the BIPA, (GLBA) and specifically stating that it does pre-empt BIPA where they might otherwise conflict, shows that the drafters of the law considered how it would interact with other laws and even considered the issue of pre-emption. They thought the GLBA should pre-empt the BIPA. Regarding the IWCA, they did not so state.
What this means for employers is that if you have Illinois employees, you have to comply with the BIPA. You can’t rely on the IWCA as a safety valve to limit your liability for “workplace injuries” if those workplace injuries are related to your processing of biometric information.
Thankfully, there are compliance solutions to help you gain better understanding and control of the data that you collect. Clarip offers automated data mapping. We can help you identify all of the biometric information stored in your databases, so you can retain it appropriately, delete it if necessary, or verify that it has been properly collected with notice and consent. Clarip also offers website scanning, vendor and consent management, automated data subject request fulfillment, and much more. Visit us at www.clarip.com or call us at 1-888-252-5653 to learn more.
Email Now:
Mike Mango, VP of Sales
mmango@clarip.com