Illinois Appellate Court Eliminates Key Defense to BIPA Claims


On September 18, 2020, the Fifth District Appellate Court in Illinois unanimously held that the exclusivity provision of Illinois’ Workers Compensation Act does not bar employees’ statutory damages claims for violation of Illinois’ biometric privacy law.[1]  The Fifth District’s ruling has eliminated a key defense advanced by employers defending against alleged violations of the Illinois Biometric Information Privacy Act (“BIPA”).[2]

In 2017, plaintiff Marquita McDonald filed a class action lawsuit against her employer Symphony Bronzeville, Park, LLC.  Plaintiff alleged that the defendant-employer required its employees to provide biometric information by scanning fingerprints into a fingerprint-based time clock system.  The lawsuit alleged that the employer violated BIPA by: (1) failing to inform employees in advance and in writing of the specific purpose and length of time for which their fingerprints were being collected, stored, and used; (2) failing to provide a publicly available retention schedule and guidelines for permanently destroying the scanned fingerprints; and (3) failing to obtain a written release from employers prior to collecting their fingerprints. 

The McDonald court examined the impositions of Section 15 of BIPA in relation to the exclusivity provision of Illinois’ Workers’ Compensation Act.  The Workers’ Compensation Act typically provides the exclusive remedy for work-related injuries, albeit with four exceptions: (1) if the injury was not accidental; (2) if the injury did not arise from employment; (3) if the injury did not occur during the course of employment; or (4) if the injury is not compensable under the Workers’ Compensation Act.  In reaching its decision, the McDonald court focused on the fourth exception and relied on Folta v. Ferro Engineering, which requires an analysis of whether or not the type of injury for which a plaintiff seeks recovery categorically fits within the purview of the Workers’ Compensation Act.[3]

In order to address the analysis required by Folta, the McDonald court relied on the Illinois Supreme Court’s opinion in Rosenbach v. Six Flags Entertainment Corp.[4] In Rosenbach, the Supreme Court held that sustaining actual damages is “not necessary to qualify as aggrieved” under BIPA.  The Supreme Court further explained that “. . . when a private entity fails to comply with one of section 15’s requirements, that violation constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose biometric identifier or biometric information is subject to breach. . . . [S]uch a person or customer would clearly be ‘aggrieved’ within the meaning of Section 20 of [BIPA] and entitled to seek recovery under that provision. No additional consequences need to be pleaded or proved. The violation, in itself, is sufficient to support the individual’s or customer’s statutory cause of action.”[5]

The Rosenbach court recognized that once a private entity fails to adhere to BIPA’s statutory requirements, affected individuals have realized the precise harm that the legislature has attempted to prevent, and those individuals have sustained an injury that is real and significant.[6]  In reaching its conclusion, the McDonald court emphasized the Supreme Court’s recognition of the legislative objective that underlies the enactment of BIPA: to protect individuals from the risks associated with the unauthorized and improper compromise of an individual’s biometric information.  The McDonald court further recognized that “other than the private right of action authorized in section 20 of [BIPA], no other enforcement mechanism is available” making it clear that the “legislature intended for this provision to have substantial force.”[7]

In short, the McDonald court concluded that an actual harm is not required to advance a statutory damages claim under BIPA, and that such claims do not “fit within the purview of the Compensation Act, which is a remedial statute designed to provide financial protection for workers that have sustained an actual injury.”[8]  The Fifth District in McDonald further explained that “[t]he [Workers’ Compensation] Act does not apply to anticipated future injuries, and an employee’s rights under the [Workers’ Compensation] Act accrue only at such time when a work related injury occurs.”  Accordingly, the McDonald court held that the exclusivity provision of Illinois’ Workers’ Compensation Act does not bar a claim for statutory damages under BIPA.

The court’s ruling in McDonald has dealt a significant blow to an employers’ ability to reduce potential liability in BIPA lawsuits. While the McDonald court ruled that statutory damage claims are not barred, it refused to address whether claims for actual damages are preempted by the Workers’ Compensation Act, leaving open the possibility of this defense in such cases.  Accordingly, Illinois law will continue to evolve in this area.   

[1] McDonald v. Symphony Bronzeville Park, LLC, 2020 IL App (1st) 192398

[2] Biometric Information Privacy Act, 740 ILCS 14/1 et seq.

[3] Folta v. Ferro Engineering, 2015 IL 118070, ¶36.

[4] Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, ¶30.

[5] Id. at ¶33.

[6] Rosenbach, 2019 IL at ¶ 34.

[7] McDonald, 2020 IL App (1st) at ¶25.

[8] Id. at ¶27.

Get Updates By Email

Blog Contributors