January 25, 2021

Volume XI, Number 25


January 22, 2021

Subscribe to Latest Legal News and Analysis

Same Biometric Story, Different Claim: Employee’s BIPA Lawsuit Survives Employer’s Motion to Dismiss

It is becoming a common trend in litigation involving the Illinois Biometric Information Privacy Act (“BIPA”) – an employee files suit, alleging that their employer failed to provide notice, obtain informed consent, and publish data retention policies in regards to the collection of their biometric information, as required under the statute.  The dispute in Sherman v. Brandt Indus. USA, No. 20-cv-1185, 2020 U.S. Dist. LEXIS 211837 (C.D. Ill. Nov. 12, 2020), is no different.  There, a federal court ruled that an employee’s complaint adequately pled BIPA claims to withstand a motion to dismiss—joining the bandwagon of other disputes concerning challenges to timekeeping practices under BIPA.

As  previously explained, at its core, BIPA protects the “biometric information” of Illinois residents, which is any information based on “biometric identifiers” that identifies a specific person—regardless of how it is captured, converted, stored, or shared.  740 ILCS 14/10.  Biometric identifiers are “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.”  Id. (collectively, with “biometric information,” “biometric data”).

As shown by Sherman, it is increasingly common for employers to collect the biometric identifiers of employees for timekeeping purposes.  In this instance, Plaintiff, a former employee, alleged that Defendant used a fingerprint scanner to collect Plaintiff’s fingerprint and store it in an electronic database.  Plaintiff would then “clock in” using his fingerprint, which would be matched against his stored fingerprints.  Plaintiff also alleged that Defendant failed to provide notice, obtain informed consent, and publish data retention policies, all as required by BIPA.

Defendant’s first line of attack in its motion to dismiss was to argue under Rule 12(b)(1) that Plaintiff did not have standing to bring a claim because he had not suffered a concrete injury, and that any violations of BIPA were procedural.  The Sherman court disagreed, pointing to Seventh Circuit precedent indicating that there is a privacy interest in biometric data.  Biometric data differs from other types of sensitive personal data, like addresses or social security numbers, because “[b]oth the privacy invasion and potential harm are much more serious.”  The court also pointed to the fact that Plaintiff had not only claimed that Defendant failed to develop a written policy concerning the use of biometric data (which might not have been a sufficient claim on its own), but Plaintiff had also asserted that Defendant failed to comply with BIPA’s destruction guidelines.  This was a sufficient harm, as alleged.  The Sherman court also found that Plaintiff had sufficiently alleged a right to seek liquidated damages, as Plaintiff alleged a violation of his privacy rights.

Defendant’s next argument was raised under Rule 12(b)(6), and fared no better.  The Defendant asserted that Plaintiff failed to state a claim because Defendant had not developed a destruction policy (and therefore could not have failed to adhere to one), which the court rejected.  The Sherman court noted that it “need look no further than the statute” to find a baseline destruction policy: the fact that Defendant had further violated the statute by failing to develop its own policy could not shield it from liability.  This will likely be an important precedent for other alleged BIPA violations – failing to create a destruction policy cannot be a workaround for BIPA.

The Sherman court was also unpersuaded by Defendant’s claim that the Illinois Workers’ Compensation Act (“IWCA”) preempted Plaintiff’s BIPA claim because the claim arose in connection with his employment.  While IWCA generally provides the exclusive remedy for injuries suffered by Illinois employees, the Sherman court pointed to a recent decision by an Illinois appellate court recognizing that a claim for liquidated damages under BIPA was “simply not compensable” under IWCA.  It further observed that any claimed damages past statutory liquidated damages would also not be preempted by IWCA, pointing to numerous Illinois decisions rejecting the same preemption argument.

And with that, another BIPA class action proceeds.  We’ll continue to keep an eye on Sherman and other BIPA lawsuits for you as they develop.

© Copyright 2020 Squire Patton Boggs (US) LLPNational Law Review, Volume X, Number 329



About this Author

Christina Lamoureux Litigation Attorney Squire Patton Boggs Washington DC

Christina Lamoureux is an associate in the Litigation Practice in the Washington DC office. She represents a wide variety of clients in complex commercial matters.


  • District of Columbia, 2020

Related Services

  • Litigation
Kristin L. Bryan Litigation Attorney Squire Patton Boggs Cleveland, OH & New York, NY
Senior Associate

Kristin Bryan is a litigator experienced in the efficient resolution of contract, commercial and complex business disputes, including multidistrict litigation and putative class actions, in courts nationwide.

She has successfully represented Fortune 15 clients in high-stakes cases involving a wide range of subject matters.

As a natural extension of her experience litigating data privacy disputes, Kristin is also experienced in providing business-oriented privacy advice to a wide range of clients, with a particular focus on companies handling customers’ personal data. In this...