July 14, 2020

Volume X, Number 196

July 13, 2020

Subscribe to Latest Legal News and Analysis

Illinois Employers Beware: State Supreme Court Finds No Harm Required Under Biometric Law

Many employers have opted to use technology to their advantage by adopting biometric timekeeping systems or similar systems for workplace access. But adopting such technology is not without risk. Indeed, with data breaches on the rise, employees and consumers have become more vigilant about protecting their personal data and using state privacy laws and the like to do so. The Illinois Biometric Information Privacy Law is one such law that places restrictions on businesses that collect biometric information of individuals. That law defines biometric information as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier [i.e. ‘a retina, iris scan, fingerprint, voiceprint, or scan of hand or face geometry’] used to identify an individual.” 740 ILCS 14/10.

While the Illinois Biometric Information Privacy Law has been on the books for over a decade, there has been a question whether a person could assert a claim under that law without alleging actual harm. That question has now been resolved with the Illinois Supreme Court’s January 25, 2019 decision in Rosenbach v. Six Flags Entertainment Corp., et al. In Rosenbach, the Supreme Court had to consider whether a person whose thumbprint was collected to obtain a season pass at an amusement park, without the necessary consent, was an “aggrieved” person under the biometric statute and therefore could pursue a claim without alleging an actual injury or adverse effect. Using a statutory construction analysis, the Court held that a person is “aggrieved” under the statute even in the absence of an allegation of actual injury, and thus can pursue a claim.

The underlying facts of the Rosenbach case of course don’t relate to employment law or biometric timekeeping systems in particular. But the holding of the case should send a message to Illinois employers that the state biometric law, which provides for liquidated damages and attorney’s fees, cannot be ignored. Indeed, employers who require employees to use a fingerprint to access a timekeeping system or otherwise collect biometric information of employees MUST take the necessary steps to obtain an employee’s consent before that collection. Namely, employers must inform the person in writing that biometric information is being collected or stored, identify the purpose for which it is being collected or stored, and for how long, and obtain the person’s written consent.  740 ILCS 14/15(b). In addition, employers must develop a written policy that establishes a retention schedule and guidelines for permanently destroying the biometric information once it is no longer needed, or within three years of the employee’s last interaction with the employer, whichever occurs first. 740 ILCS 14/15(a).

Illinois employers who have questions about complying with the state biometric law and other state privacy laws should consult counsel.

© 2020 Faegre Drinker Biddle & Reath LLP. All Rights Reserved.National Law Review, Volume IX, Number 25


About this Author

Kelly Petrocelli, Labor and employment lawyer, Drinker Biddle
Senior Attorney

Kelly A. Petrocelli has more than 10 years of experience assisting mid-market to Fortune 500 companies to manage and resolve employment disputes, including those involving compliance with the Family and Medical Leave Act (FMLA), Americans With Disabilities Act (ADA), Fair Labor and Standards Act (FLSA), Title VII, and similar state employment laws. Serving as lead and co-counsel, she appears regularly before state and federal courts in Illinois and Michigan, as well as administrative agencies including the U.S. Equal Employment Opportunity Commission,...