Over the last decade, Illinois employers have had to reckon with a barrage of class action lawsuits brought under the state's Biometric Information Privacy Act (BIPA), which prohibits private entities from collecting biometric information without proper disclosures and written waivers. These suits, which typically involve time clocks that use employees' fingerprints, have resulted in countless seven-figure judgments and settlements. A recent court decision, though, provides some reprieve for staffing agencies whose employees use biometric devices at the behest of the staffing agencies' clients.
In Salinas v. Arthur Schuman Midwest, LLC, et al., the plaintiffs were hired by staffing agencies and assigned to work at a food manufacturing facility in Elgin, Illinois. The manufacturing facility used biometric time clocks, which it leased from a third-party vendor, to track the workers' hours. The workers had to scan their fingerprints to use the time clocks, which allegedly stored their biometric information and transferred the biometric information to the third-party's cloud-based servers.
Pursuant to the facility's requirement, as part of the employees' onboarding process, the staffing agencies enrolled the workers in the facility's time clock system and instructed the employees how to use the clocks. Then, throughout their assignment at the facility, the staffing agencies monitored the workers' hours in the time system.
The plaintiffs sued the facility, the staffing agencies, and the third-party vendor for violations of BIPA based on the use of the biometric time clocks. The plaintiffs alleged the staffing agencies collected their fingerprints through the time clocks, without proper notice and consent, in violation of section 15(b) of BIPA.
In response to the lawsuit and before any discovery occurred, the staffing agencies moved for summary judgment. They did not dispute enrolling their employees in the time clock system and instructing them on its use, but argued they did not collect, capture, purchase, receive, or otherwise obtain biometric information within the meaning of Section 15(b). They submitted affidavits demonstrating the facility had exclusive possession of the biometric data from the time clocks, and, while the staffing agencies had limited administrative access to enroll and correct employees' time records, they could not access or control the actual biometric data. The trial court granted summary judgment for the staffing agencies, finding they did not possess, could not access, and had no control over any biometric data. The staffing agencies' limited use and access — consisting of only non-biometric data— was insufficient to establish a question of fact under Section 15(b). Notably, in granting summary judgment, the court denied the plaintiffs' request to conduct discovery on the facts presented in the affidavits, finding that discovery was unnecessary.
The plaintiffs appealed to the Third District, arguing the staffing agencies obtained possession of the biometric data by acting as a "conduit relative to data collection." They noted that Section 15(b) does not require an entity "have possession" of the biometric data to run afoul of the law, whereas other portions of BIPA expressly reference "possession." Thus, they argued, the staffing agencies did not need to actually obtain possession of their biometric data to be liable, they only needed to facilitate its collection.
The appellate court rejected that theory. It held that Section 15(b) "presupposes that a defendant acquires the biometric data, not merely that its conduct facilitates another entity's acquisition," and that it "regulates acquisition of biometric data; not proximity to it." The staffing agencies' conduct – by requiring or implementing the use of the biometric time clocks, when the data was collected by a different entity – was insufficient to establish liability under Section 15(b) as a matter of law. Accordingly, the appellate court affirmed the entry of summary judgment.
The plaintiffs also argued that the trial court erred by denying discovery. Again, however, the Third District affirmed the decision, holding that the summary judgment motion "offered proof that affirmatively disproved" the plaintiffs' claims, since the staffing agencies' "ministerial implementation" of the time clocks did not violate BIPA. Thus, the trial court did not abuse its discretion in denying discovery.
Salinas is a decidedly favorable ruling for staffing agencies that conduct business in Illinois and whose partners collect biometric data from their workers. It is now clear that mere "proximity to" biometric collection, including some degree of implementation and monitoring, does not automatically expose employers to liability under Section 15(b) of BIPA.
To remain compliant with BIPA, employers should review their policies, agreements, and practices related to biometric data collection. If you have any questions regarding your biometric practices or BIPA, please reach out to the authors of this post or your regular Saul Ewing attorney.
