Walton v. Roosevelt University: Ill. Supreme Court Issues Rare Defense-Friendly BIPA Opinion

On March 23, 2023, the Illinois Supreme Court issued an opinion in Walton v. Roosevelt University, 2023 IL 128338 that affirms the validity of an important preemption defense for employers facing litigation under the Illinois Biometric Information Privacy Act (“BIPA”). Specifically, the Court ruled that Section 301 of the Labor Management Relations Act, 29 U.S.C. § 185 (“LMRA”) preempts BIPA claims brought by bargaining unit employees covered by a collective bargaining agreement (“CBA”).

BIPA

Approaching its 15-year anniversary, BIPA has become the most litigated biometric privacy statute in the nation. The Illinois Legislature passed BIPA in 2008 to “regulat[e] the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information,” and provided for a private right of action as a means of enforcement.^[1] BIPA sets forth a series of restrictions and requirements for how private entities collect, retain, disclose, and destroy “biometric identifiers,” including fingerprints, retina or iris scans, voiceprints, and scans of hand or face geometry, and information that is derived from biometric identifiers (i.e., “biometric information”). At the highest level, these restrictions and requirements impose the following obligations:

• § 15(a): Development of a publically available written policy, which establishes a retention schedule and guidelines for destroying biometric identifiers and biometric information by the earlier of when the initial purpose for collection is satisfied or within three years of the subject’s last interaction with the private entity;^[2]
• § 15(b): Provide written notice pre-collection and/or pre-storage of biometric identifiers and biometric information, which identifies purpose for collection or storage and the length of time for which the biometric identifiers and biometric information will be collected, stored, and/or used, and obtain a written release from the affected individual or a legally authorized representative;^[3]
• § 15(c): Refrain from selling, leasing, trading, or otherwise profiting from a person’s or a customer’s biometric identifier or biometric information;^[4]
• § 15(d): No disclosure or dissemination (including no re-disclosure) of biometric identifiers or biometric information without consent from the affected individual or a legally authorized representative, unless doing so is required by law, subpoena, or court order, or completes a financial transaction requested or authorized by the affected individual or a legally authorized representative;^[5]
• § 15(e)(1): Use the same standard of care within the private entity’s industry when storing, transmitting, and protecting biometric identifiers and biometric information from disclosure;^[6] and
• § 15(e)(2): Store, transmit, and protect biometric identifiers and biometric information from disclosure in a manner that is at least equally protective to the manner in which the private entity stores, transmits, and protects other confidential and sensitive information.^[7]

Walton v. Roosevelt University

Walton v. Roosevelt University involves a typical BIPA case fact pattern—employees required to scan biometric identifiers for timekeeping purposes. In Walton, a former employee of Roosevelt University alleged that he and similarly situated employees were required to enroll scans of their hand geometry on a biometric timekeeping device to clock in and out of work, but were never informed of their employer’s biometric data retention policy or the specific purpose or length of time for which their information was to be stored, and that they never signed a release consenting to collection, storage, or dissemination of their biometric identifiers or biometric information.^[8] Based on these allegations, the plaintiff alleged that his employer had violated Sections 15(a), (b), and (d) of BIPA, and sought damages, injunctive relief, and reasonable attorney fees.^[9]

At the trial court, Roosevelt University moved to dismiss the class action complaint pursuant to Section 2-619 of the Illinois Code of Civil Procedure, alleging principally that the asserted BIPA claims were preempted by section 301 of the LMRA. In support, Roosevelt University argued that: (1) the plaintiff was a member of SEIU, Local 1, a collective bargaining unit, and thus had agreed to a CBA between his chosen union and Roosevelt University; (2) the CBA had a broad management-rights clause that covered the manner by which employees clock in and out;^[10] and (3) Miller v. Southwest Airlines Co., 926 F.3d 898, 903 (7^th Cir. 2019), held that federal labor law preempts BIPA claims which require interpretation or administration of a CBA.^[11]

The Circuit Court distinguished Miller and denied Roosevelt University’s motion to dismiss, reasoning that a BIPA claim “is not intertwined with or dependent substantially upon consideration of terms of [a] collective bargaining agreement” as a “person’s rights under [BIPA] exist independently of both employment and any given CBA.”^[12] Nonetheless, the Circuit Court subsequently certified for interlocutory appeal the question as to whether Section 301 of the LMRA preempts BIPA claims asserted by bargaining unit employees covered by a CBA.^[13]

On appeal, the appellate court concluded that Section 301 of the LMRA actually does preempt BIPA claims asserted by bargaining unit employees covered by a CBA, even where the CBA does not specifically mention biometric information.^[14] The appellate court held that the Seventh Circuit had already rightfully decided the same question in Fernandez v. Kerry, Inc., 14 F. 4^th 644, 646 (7th Cir. 2021), which post-dates and cites to Miller, and explained that “when the employer invokes a broad management rights clause from a [CBA] in response to a [BIPA] claim, the claim is preempted because it requires an arbitrator to determine whether the employer and the union bargained about the issue or the union consented on the employees’ behalf.”^[15] Additionally, the appellate court found that because BIPA makes reference to obtaining consent from a “legally authorized representative” of an impacted individual, BIPA contemplates the role of a collective bargaining unit acting as an intermediary on issues relating to employee biometric information.^[16]

The Illinois Supreme Court subsequently granted leave to appeal. In chief, the plaintiff argued to the Illinois Supreme Court that the panels of the Seventh Circuit that decided Miller and Fernandez had illogically concluded that BIPA claims were preempted because they “erroneously believed the dispute in each case centered on the employers’ implementation of a timekeeping device, when the actual issue raised, as in all actions brought under [BIPA], was whether the entities collected, stored, and disseminated employee biometric data without informed consent—an issue entirely separate from the use of the device itself.”^[17] The Illinois Supreme Court disagreed with Walton and unanimously affirmed the appellate court decision:

Given the language in the CBA and the LMRA, it is both logical and reasonable to conclude any dispute [under BIPA] must be resolved according to federal law and the agreement between the parties. Therefore . . . we defer to the uniform federal case law on this matter and find that when an employer invokes a broad management rights clause from a CBA in response to a [BIPA] claim brought by bargaining unit employees, there is an arguable claim for preemption. Accordingly, because we do not believe the federal decisions were wrongly decided, and here the CBA contained a broad management rights clause, we find Walton’s [BIPA] claims are preempted by the LMRA.^[18]

Significance of Walton

The significance of the Illinois Supreme Court’s Opinion in Walton is principally three-fold. First, at the most obvious level, Walton affirms the validity of a preemption defense for employers that have agreed to CBAs with sufficiently broad clauses to cover mandated actions that involve employer collection, storage, usage, and/or dissemination or disclosure of employee biometric identifiers and/or information. In such instances, employee claims under BIPA must proceed according to the procedures set forth in the applicable CBAs, which may include private arbitration on an individual, rather than class-wide, basis. This in turn reduces the risk of massive class damages awards from juries, such as the $228 million awarded in Rogers v. BNSF Railway Co., U.S.D.C. N.D. Ill. Case No. 19 C 3083.

Second, Walton provides a ray of hope for defendants in what has thus far been a series of plaintiff-friendly BIPA rulings from the Illinois Supreme Court. By affirming the appellate court’s decision and maintaining consistency with the Seventh Circuit’s preemption holdings in Miller and Fernandez, the Illinois Supreme Court has signaled that it will not automatically accept and agree to plaintiff interpretations of BIPA.

Third, Walton further clarifies the landscape necessary for employer assessment of risk with respect to potential BIPA liability. After Walton, private parties now have three definitive rulings from the Illinois Supreme Court this year to further guide them:

1. Tims v. Black Horse Carriers, Inc., 2023 IL 127801,¶ 42 (Feb. 2, 2023) provides that “the five-year limitations period . . . controls claims under [BIPA].”
2. Cothron v. White Castle Sys., Inc., 2023 IL 128004, ¶ 45 (Feb. 17, 2023) teaches that “a claim accrues under [Sections 15(b) and (d) of BIPA] with every scan or transmission of biometric identifiers or biometric information without prior informed consent.”
3. Walton v. Roosevelt University, 2023 IL 128338, ¶ 31 (Mar. 23, 2023) affirms that BIPA claims cannot be litigated in court on a class-wide basis where a CBA applies and sets forth specific alternative grievance procedures.

Steps You Can Take To Mitigate Risk

In light of Walton and other BIPA jurisprudence, if your company collects, stores, uses, discloses, and/or disseminates biometric information from employees in Illinois, there are several steps your company can and should take right now to mitigate exposure to potentially significant damages under BIPA. These include:

(1) Consult with legal professionals and advisors experienced with BIPA compliance and emerging case law;

(2) Closely review existing CBAs to determine whether they cover activities implicated by BIPA, such as clocking in and out for work, and provide for private grievance procedures that may preclude pursuit of BIPA claims on a class-wide basis;

(3) Carefully negotiate and draft CBAs and amendments to CBAs to include clauses that cover BIPA-regulated activities and provide for private resolution and/or class action waivers;

(4) Audit and, as appropriate, draft or update privacy and retention policies to comply with the requirements of BIPA; and

(5) Review and, as appropriate, revise notices and consents to conform to the requirements of BIPA.