While the emergence of biometric technology in the workplace is not a new phenomenon, employers being sued for utilizing this technology is a new trend. Over the past three months, more than 30 class action lawsuits have been filed in Illinois state and federal courts against employers that use timeclocks that scan an employee’s fingerprint, retina, or iris to clock employees into and out of work (“biometric timeclocks”).1 The lawsuits allege violations of Illinois’ Biometric Information Privacy Act (“BIPA”), which governs the collection, use, and disclosure of biometric data2 by entities in Illinois.
By its own terms, BIPA was designed to regulate the security, storage and handling of biometric data in “biometric-facilitated transactions” which, when the law was enacted in 2008, were becoming more prevalent.3 The class action lawsuits currently being filed against employers do not allege that employees’ biometric data has been unlawfully disclosed, sold or stored in an unsecure manner.4 Instead, the actions focus on employers’ alleged non-compliance with BIPA’s notice and consent requirements; specifically: (1) the employer allegedly failed to provide its employees with written notice that the biometric timeclock would collect their biometric data, and to explain the purpose for the collection, how the biometric data would be stored, and how long it would be retained; and (2) the employer did not obtain employees’ prior, written consent to the collection and use of their biometric data.
BIPA’s requirements of prior notice and consent potentially are an obstacle to employers filing motions to dismiss these actions for failure to state a claim under BIPA, because employees typically will allege lack of notice and consent. However, when these actions are filed in federal court (or removed to federal court), they are susceptible to attack through a motion to dismiss for a lack of standing.
A recent Second Circuit decision affirming the dismissal of a class action lawsuit alleging violations of BIPA’s notice and consent requirements provides a roadmap to obtaining this result in similar cases. Thus, employers that implemented biometric timeclocks without giving notice to, or obtaining consent from, employees as required by BIPA are not necessarily “dead in the water” when swept up in the current wave of class action filings.
The Second Circuit’s Ruling in Vigil v. Take-Two Interactive Software, Inc.5
The case centered on a videogame feature (“MyPlayer feature”) that allowed players to scan their faces and create a personalized avatar, exclusively for in-game play. The named plaintiffs filed a class action against the game’s maker, Take-Two, alleging many of the same types of claims that are currently being asserted against employers that use biometric timeclocks. Specifically, the plaintiffs alleged that Take-Two failed to (1) provide adequate written notice under BIPA; (2) provide a written retention schedule and guidelines for permanently destroying the scans of users’ faces; and (3) obtain users’ written consent before scanning their faces. The district court dismissed the case, with prejudice, noting that these “bare procedural violations” of BIPA were insufficient to confer standing on the plaintiffs.6
On November 21, 2017, the Second Circuit affirmed, in an unpublished “summary order,” the district court’s dismissal of the plaintiffs’ BIPA claims based on a lack of standing. Although the Second Circuit’s opinion has limited precedential value, it offers guidance for employers defending class actions in federal court...
