Tag: Illinois

Job Applicant Pay History Inquiries Now Off-Limits in Illinois

As of September 29, 2019, Illinois employers may not ask job applicants or their prior employers about salary history. The change comes after Illinois Governor J.B. Pritzker signed an amendment to the Illinois Equal Pay Act of 2003.

The New Requirements

The Illinois Equal Pay Act of 2003 made it illegal to pay employees differently on the basis of sex or the employee’s status as an African American, subject to exceptions. The impetus behind the law is to address historic pay disparities for the same or substantially similar work. The amendment now takes the law a step further to address the practice of using pay histories of applicants to set wages (including benefits and other compensation). Specifically, the amendment makes the following additions to the Illinois Equal Pay Act of 2003:

  • Employers, including employment agencies, may not screen out applicants on the basis of their current or prior wage history by setting a maximum or minimum wage level that applicants must satisfy.
  • Employers may not request or require disclosure of an applicant’s wage history as a condition of employment.
  • More specifically, employers may not request or require disclosure of an applicant’s wage history as a condition of being considered for employment, being interviewed, continuing to be considered for employment, or receiving a job offer.
  • Employers may not seek the wage history of an applicant from any current or prior employer.

If an applicant voluntarily discloses his or her pay history this does not create a violation. However, the employer cannot then use the voluntarily disclosed pay history in consideration of employment, an offer of compensation, or setting future wages, benefits, and other compensation.

What Are Employers Permitted to Do?

While employers cannot look into the wage histories of applicants, they are still permitted to share salary and benefit information about the position the applicant seeks. Employers can also discuss salary expectations with applicants without running afoul of the law.

Employers with Illinois employees should review their recruitment and compensation practices, including paper applications and online forms, to remove any references and requests regarding an applicant’s pay history. Further, human resources employees should be trained on appropriate recruitment procedures for Illinois employees.

©2019 von Briesen & Roper, s.c

For more state salary history bans, see the National Law Review Labor & Employment law page.

Vimeo Hit with Class Action for Alleged Violations of Biometric Law

Vimeo, Inc. was sued last week in a class action case alleging that it violated the Illinois Biometric Information Privacy Act by “collecting, storing and using Plaintiff’s and other similarly situated individuals’ biometric identifiers and biometric information…without informed written consent.”

According to the Complaint, Vimeo “has created, collected and stored, in conjunction with its cloud-based Magisto service, thousands of “face templates” (or “face prints”)—highly detailed geometric maps of the face—from thousands of Magisto users.” The suit alleges that Vimeo creates these templates using facial recognition technology and “[E]ach face template that Vimeo extracts is unique to a particular individual, in the same way that a fingerprint or voiceprint uniquely identifies one and only one person.” The plaintiffs are trying to liken an image captured by facial recognition technology to a fingerprint by calling it a “faceprint.” Very creative in the wake of mixed reactions to the use of facial recognition technology in the Facebook and Shutterfly cases.

The suit alleges “users of Magisto upload millions of videos and/or photos per day, making videos and photographs a vital part of the Magisto experience….Users can download and connect any mobile device to Magistoto upload and access videos and photos to produce and edit their own videos….Unbeknownst to the average consumer, and in direct violation of…BIPA, Plaintiff…believes that Magisto’s facial recognition technology scans each and every video and photo uploaded to Magisto for faces, extracts geometric data relating to the unique points and contours (i.e., biometric identifiers) of each face, and then uses that data to create and store a template of each face—all without ever informing anyone of this practice.”

The suit further alleges that when a user uploads a photo, the Magisto service creates a template for each face depicted in the photo, and compares that face with others in its face database to see if there is a match. According to the Complaint, the templates are also able to recognize gender, age and location and are able to collect biometric information from non-users. All of this is done without consent of the individuals, and in alleged violation of BIPA.

Although we previously have seen some facial recognition cases alleging violation of BIPA, and there are numerous cases alleging violation of BIPA for collection of fingerprints in the employment setting, this case is a little different from those, and it will be interesting to watch.

Copyright © 2019 Robinson & Cole LLP. All rights reserved.
For more on biometrics & privacy see the National Law Review Communications, Media & Internet law page.

Facebook “Tagged” in Certified Facial Scanning Class Action

Recently, the Ninth Circuit Court of Appeals held that an Illinois class of Facebook users can pursue a class action lawsuit arising out of Facebook’s use of facial scanning technology. A three-judge panel in Nimesh Patel, et al v. Facebook, Inc., Case No. 18-15982 issued an unanimous ruling that the mere collection of an individual’s biometric data was a sufficient actual or threatened injury under the Illinois Biometric Information Privacy Act (“BIPA”) to establish standing to sue in federal court. The Court affirmed the district court’s decision certifying a class. This creates a significant financial risk to Facebook, because the BIPA provides for statutory damages of $1,000-$5,000 for each time Facebook’s use of facial scanning technology was used in the State of Illinois.

This case is important for several reasons. First, the decision recognizes that the mere collection of biometric information may be actionable, because it creates harm to an individual’s privacy. Second, the decision highlights the possible extraterritorial application of state data privacy laws, even those that have been passed by state legislatures intending to protect only their own residents. Third, the decision lays the groundwork for a potential circuit split on what constitutes a “sufficiently concrete injury” to convey standing under the U.S. Supreme Court’s landmark 2016 decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016). Fourth, due to the Illinois courts’ liberal construction and interpretation of the statute, class actions in this sphere are likely to continue to increase.

The Illinois class is challenging Facebook’s “Tag Suggestions” program, which scans for and identifies people in uploaded photographs for photo tagging. The class plaintiffs alleged that Facebook collected and stored biometric data without prior notice or consent, and without a data retention schedule that complies with BIPA. Passed in 2008, Illinois’ BIPA prohibits gathering the “scan of hand or face geometry” without users’ permission.

The district court previously denied Facebook’s numerous motions to dismiss the BIPA action on both procedural and substantive grounds and certified the class. In moving to decertify the class, Facebook argued that any BIPA violations were merely procedural and did not amount to “an injury of a concrete interest” as required by the U.S. Supreme Court’s landmark 2016 decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016).

In its ruling, the Ninth Circuit determined that Facebook’s use of facial recognition technology without users’ consent “invades an individual’s private affairs and concrete interests.” According to the Court, such privacy concerns were a sufficient injury-in-fact to establish standing, because “Facebook’s alleged collection, use, and storage of plaintiffs’ face templates here is the very substantive harm targeted by BIPA.” The Court cited with approval Rosenbach v. Six Flags Entertainment Corp., — N.E.3d —, 2019 IL 123186 (Ill. 2019), a recent Illinois Supreme Court decision similarly finding that individuals can sue under BIPA even if they suffered no damage beyond mere violation of the statute. The Ninth Circuit also suggested that “[s]imilar conduct is actionable at common law.”

On the issue of class certification, the Ninth Circuit’s decision creates a precedent for extraterritorial application of the BIPA. Facebook unsuccessfully argued that (1) the BIPA did not apply because Facebook’s collection of biometric data occurred on servers located outside of Illinois, and (2) even if BIPA could apply, individual trials must be conducted to determine whether users uploaded photos in Illinois. The Ninth Circuit rejected both arguments. The Court determined that (1) the BIPA applied if users uploaded photos or had their faces scanned in Illinois, and (2) jurisdiction could be decided on a class-wide basis. Given the cross-border nature of data use, the Court’s reasoning could be influential in future cases where a company challenges the applicability of data breach or data privacy laws that have been passed by state legislatures intending to protect their own residents.

The Ninth Circuit’s decision also lays the groundwork for a potential circuit split. In two cases from December 2018 and January 2019, a federal judge in the Northern District of Illinois reached a different conclusion than the Ninth Circuit on the issue of BIPA standing. In both cases, the Northern District of Illinois ruled that retaining an individual’s private information is not a sufficiently concrete injury to satisfy Article III standing under Spokeo. One of these cases, which concerned Google’s free Google Photos service that collects and stores face-geometry scans of uploaded photos, is currently on appeal to the Seventh Circuit.

The Ninth Circuit’s decision paves the way for a class action trial against Facebook. The case was previously only weeks away from trial when the Ninth Circuit accepted Facebook’s Rule 23(f) appeal, so the litigation is expected to return to the district court’s trial calendar soon. If Facebook is found to have violated the Illinois statute, it could be held liable for substantial damages – as much as $1000 for every “negligent” violation and $5000 for every “reckless or intentional” violation of BIPA.

BIPA class action litigation has become increasingly popular since the Illinois Legislature enacted it: over 300 putative class actions asserting BIPA violations have been filed since 2015. Illinois’ BIPA has also opened the door to other recent state legislation regulating the collection and use of biometric information. Two other states, Texas and Washington, already have specific biometric identifier privacy laws in place, although enforcement of those laws is accomplished by the state Attorney General, not private individuals. A similar California law is set to go into effect in 2020. Legislation similar to Illinois’ BIPA is also currently pending in several other states.

The Facebook case will continue to be closely watched, both in terms of the standing ruling as well as the potential extended reach of the Illinois law.

© Polsinelli PC, Polsinelli LLP in California

For more in biometric data privacy, see the National Law Review Communications, Media & Internet law page.

Chicago and Cook County Amusement Tax

In previous posts, we have explored several local Illinois taxes, including the Chicago Personal Property Lease Transaction Tax and Cook County Parking Lot Tax. Also notable is the Chicago and Cook County Amusement Tax, which can apply more broadly than taxpayers often anticipate. Specifically the scope of the amusement tax has been expanded over the last few years to non-traditional amusements, including electronically transferred television shows, movies, videos, music, and games.

Imposition of The Amusement Tax

Although the Chicago and Cook County amusement tax are imposed similarly on taxpayers, they are independently administered taxes that feature key differences. Both the Chicago Amusement Tax Ordinance (“Chicago Ordinance”) and Cook County Amusement Tax Ordinance (“Cook County Ordinance”) impose the tax “upon the patrons of every amusement” within the city or county, but require the owner, manager, or operator of the amusement to collect the tax from each patron and remit the tax to the Chicago Department of Finance (“Chicago Department”) or the Cook County Department of Revenue (“Cook County Department”).[1] Further, both Ordinances define “amusement” as “any exhibition, performance, presentation or show for entertainment purposes”.[2]

Where the Chicago and Cook County Ordinances deviate, however, are the examples used to define “amusement”, the rates of tax, and applicable exemptions. For example, although the Ordinances provide similar examples of qualifying amusements, including a motion picture show, athletic contest, or any theatrical, musical or spectacular performance, the Chicago Ordinance also includes “paid television programming” viewed within or outside the home.[3] In contrast, the County Ordinance does not include such language. Additionally, whereas the Chicago Ordinance imposes the amusement tax at a rate of 9 percent of the admission fees or other charges paid for the privilege to enter, witness, view or participate in the amusement, the County Ordinance imposes the tax at a rate of 3 percent (unless a lower rate applies, as addressed below).[4]

Further, the Chicago and Cook County Ordinances often exempt different activities. For example, although both Ordinances exempt admission fees to witness in person “live theatrical, live musical or other live cultural performances that take place in any auditorium, theater or other space”[5] with a certain limited capacity (“Small Venue Exemption”), the Ordinances include a different capacity limitation. Under the Chicago Ordinance, the Small Venue Exemption renders the amusement tax inapplicable where the maximum capacity of the venue, including all balconies and all sections, is not more than 1,500 persons.[6] In contrast, under the Cook County Ordinance, the Small Venue Exemption only applies where the venue has a capacity of not more than 750 persons.[7] Further, if the venue has a capacity of more than 750 persons, but fewer than 5,000 persons, the Cook County amusement tax applies at a rate of 1 percent rather than the general rate of 3 percent.[8] This serves as a notable example of where the Ordinances may appear to be substantially similar but in fact feature key differences. Additionally, whereas the City clarified in a 2004 Amusement Tax Ruling that “primarily educational” activities are not taxable amusements, Cook County has not released similar guidance.[9] The result is that depending on the nature of the activity, amusement tax may apply in one but not both jurisdictions.

Identifying Taxable “Admission Fees”

A contested issue in applying the amusement tax in both Chicago and Cook County is the amount that compromises the taxable “admission fees or other charges paid for the privilege to enter, witness, view” such amusement.[10] For example, in 2014, the Illinois Court of Appeals held that under the Cook County Ordinance, for club seats and luxury suites to Chicago Bears home football games, “admission fees or other charges” include the amenities available to holders of club seat tickets and tangible personal property included in the luxury suite admission price, not just the value of the home seat games.[11] The Court determined that because a fan cannot witness a game from a club seat without paying the club privilege fee and annual licensing fee, it is not possible to separate the “other charges” from the fee paid to enter the stadium.[12] As a result, the Illinois Appellate Court determined the full price paid by club seat holders and luxury suite licensees is subject to the County’s amusement tax. This decision may lead to efforts by the Chicago Department and Cook County Department to expand a taxpayer’s taxable base beyond the mere value of a “seat”. For example, both the County and the City have been aggressive in their application of the amusement tax to service fees despite clear language in the Ordinances that exempts separately stated optional charges.[13]

Expanding the Scope to Electronically Transferred Amusements

The Chicago Department has recently become aggressive in its expansion of the scope of the Chicago Ordinance. In a 2015 Amusement Tax Ruling, the Chicago Department asserted that the amusement tax is imposed “not only [on] charges paid for the privilege to witness, view or participate in amusements in person but also charges paid for the privilege to witness, view or participate in amusements that are delivered electronically.”[14] As a result, the Chicago Department intended to clarify that the Chicago amusement tax applies to fees or charges for the following if delivered in the City: (1) watching electronically delivered television shows, movies or videos; (2) listening to electronically delivered music; and (3) participating in games, on-line or otherwise.[15] Although treated with resistance by taxpayers[16], the implication is that the City Department has the authority to impose the amusement tax on users of streaming services such as Netflix and Spotify, and online gaming, such as PlayStation. Following the Mobile Telecommunication’s Sourcing Conformity Act[17], the amusement tax applies to customers whose residential street address or primary business address is in Chicago, as reflected by their credit card billing address, zip code or other reliable information.[18]

Further, as explored briefly above, the Chicago Ordinance treats “paid television programming” as a taxable amusement.[19] “Paid television” means programming that can be viewed on a television or other screen, and is transmitted by cable, fiber optics, laser, microwave, radio, satellite or similar means to members of the public for consideration.[20] Additionally, an “owner” includes “any person operating a community antenna television system or wireless cable television system, or any other person receiving consideration from the patron for furnishing, transmitting, or otherwise providing access to paid television programming.”[21]

In 2014, the Chicago Department began auditing and assessing amusement tax on a number of restaurants and bars located through the City who subscribed to paid satellite television programming and who did not collect the amusement tax[22]. In a move to clarify the application of the tax, in November 2016, the Chicago Department released an Informational Bulletin that provided additional information to business subscribers of satellite television regarding their obligation to collect and remit the Chicago amusement tax. As a result, bars, restaurants and any other businesses that subscribe to satellite television are required to remit the Chicago amusement tax on charges paid for satellite television services used in Chicago.

Applicability to Ticket Resellers and Agents

An area of uncertainty within both the Chicago and Cook County amusement tax is the potential applicability to ticket resellers and agents. The issue dates back to 2006 when the Chicago Department amended the Chicago Ordinance to require not only a “reseller” but also a “reseller’s agent” to collect and remit amusement tax.[23]This amendment set the stage for the Chicago Department to attempt to collect the tax from StubHub as a reseller’s agent. StubHub is an internet auction listing service that operates a “platform” where it charges buyers and sellers a fee to buy and sell ticket to various events.

On appeal to the Illinois Supreme Court, the Court entered a significant decision for online auctioneers, holding that municipalities may not require electronic intermediaries to collect and remit amusement taxes on resold tickets.[24] The basis of the Court’s ruling is that although the Illinois Ticket Sale and Resale Act (the “Act”) [25]gives municipalities the authority to require sellers and resellers of tickets to collect the amusement tax, municipalities do not have the authority to require internet auction listing services, such as StubHub, to collect the tax.[26] Although both the Chicago and Cook County Ordinance still define an “operator” as a person who “sells or resells a ticket”, the Stubhub decision resulted in the removal of the term “reseller’s agent” and “auctioneer” from the Chicago Ordinance.[27]

Conclusion

Although the Chicago and Cook County amusement tax are similarly imposed, there are notable differences between the applicability of the Chicago and Cook County Ordinances. These differences are particularly noteworthy with respect to potential exemptions and electronically transferred amusements. Accordingly, taxpayers should not assume that because the amusement tax applies in one locality, it applies in both Chicago and Cook County.

[1] Municipal Code of Chicago (“M.C.C.”) § 4-156-020(A), 4-146-030(A); Cook County Ordinance (“C.C.O.”) § 74-392(a), 74-395(a).

[2] M.C.C. § 4-156-010; C.C.O. § 74-391.

[3] M.C.C. § 4-156-010.

[4] M.C.C. § 4-156-020; C.C.O. § 74-392.

[5] The Chicago and Cook County Ordinance define “live theatrical, live musical or other live cultural performance” identically as a “live performance in any of the disciplines which are commonly regarded as part of the fine arts, such as live theater, music, opera, drama, comedy, ballet, modern or traditional dance, and book or poetry readings. The term does not include such amusements as athletic events, races, or performances conducted as adult entertainment cabarets.” M.C.C. § 4-156-010; C.C.O. § 74-391. In this regard, the Chicago Department and Cook County Department appear to play the role of an art critic, defining which activities qualify as “fine arts”. See a prior post exploring the issue in the context of disc jockeys.

[6] M.C.C. § 4-156-020(D).

[7] C.C.O. § 74-392(d).

[8] C.C.O. § 74-392(f)(1).

[9] Chicago Amusement Tax Ruling #1, ¶ 2.

[10] M.C.C. § 4-156-020; C.C.O. § 74-392.

[11] Chi. Bears Football Club v. Cook County Dep’t of Revenue, 16 N.E.3d 827, 835 (2014).

[12] Id. at 834. In determining the full price paid by club seat ticket holders and luxury suite licensees is subject to the amusement tax, the Court affirmed the reasoning of the court in Stasko v. City of Chicago, 997 N.E.2d 975, 993 (2013)(holding that the Chicago Ordinance applied because purchasing the permanent seat license was a prerequisite to viewing the game).

[13] M.C.C. § 4-156-020(H); C.C.O. § 74-392(e)(3).

[14] Chicago Amusement Tax Ruling #5.

[15] Chicago Amusement Tax Ruling #5, ¶ 8.

[16] The Chicago amusement tax, as it applies to certain electronically delivered amusements, such as paid television, was challenged but held by the Cook County Circuit Court to be constitutional in Labell v. City of Chicago, Case No. 15 CH 13399 (Cook Cnty. Cir. Ct. May 24, 2018). In this application, the amusement tax is often derisively referred to as the “ Cloud Tax” or the “Netflix Tax“.

[17] 35 ILCS 638.

[18] Chicago Amusement Tax Ruling #5, ¶ 13.

[19] M.C.C. § 4-156-010.

[20] Id.

[21] Id.

[22] For additional background regarding the Department’s efforts to collect the Chicago amusement tax from satellite providers, see a prior post.

[23] Under the Chicago Ordinance, a reseller’s agent is a “person who, for consideration, resells a ticket on behalf of the ticket’s owner or assists the owner in reselling the ticket. The term includes but is not limited to an auctioneer, a broker or a seller of tickets for amusements, as those terms are used in 65 ILCS 5/11-42-1, and applies whether the ticket is resold by bidding, consignment or otherwise, and whether the ticket is resold in person, at a site on the Internet or otherwise.” M.C.C. § 4-156-010 (amended May 24, 2006).

[24] City of Chicago v. Stubhub, Inc., 979 N.E.2d 844, 845 (2011).

[25] 720 ILCS 375/0.01 et seq. (2010).

[26] Stubhub, Inc., 979 N.E.2d at 857.

[27] M.C.C. § 4-156-010; C.C.O. § 74-391.

 

© Horwood Marcus & Berk Chartered 2019. All Rights Reserved.

Six Flags Raises Red Flags: Illinois Supreme Court Weighs In On BIPA

On January 25, the Illinois Supreme Court held that a person can seek liquidated damages based on a technical violation of the Illinois Biometric Information Privacy Act (BIPA), even if that person has suffered no actual injury as a result of the violation. Rosenbach v. Six Flags Entertainment Corp. No. 123186 (Ill. Jan. 25, 2019) presents operational and legal issues for companies that collect fingerprints, facial scans, or other images that may be considered biometric information.

As we have previously addressed, BIPA requires Illinois businesses that collect biometric information from employees and consumers to, among other things, adopt written policies, notify individuals, and obtain written releases. A handful of other states impose similar requirements, but the Illinois BIPA is unique because it provides individuals whose data has been collected with a private right of action for violations of the statute.

Now, the Illinois Supreme Court has held that even technical violations may be actionable.  BIPA requires that businesses use a “reasonable standard of care” when storing, transmitting, or protecting biometric data, so as to protect the privacy of the person who provides the data. The rules are detailed. Among other things, BIPA requires businesses collecting or storing biometric data to do the following:

  • establish a written policy with a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information;
  • notify individuals in writing that the information is being collected or stored and the purpose and length of time for which the biometric identifier will be collected, stored, and used;
  • obtain a written release from the individual; and
  • not disclose biometric information to a third party without the individual’s consent.

The Illinois Supreme Court has now held that a plaintiff may be entitled to up to $5,000 in liquidated damages if a company violates any of these requirements, even without proof of actual damages.

In Rosenbach, the plaintiff’s son’s fingerprint was scanned so that he could use his fingerprint to enter the Six Flags theme park under his season pass. Neither the plaintiff nor her son signed a written release or were given written notice as required by BIPA. The plaintiff did not allege that she or her son suffered a specific injury but claimed that if she had known that Six Flags collected biometric data, she would not have purchased a pass for her son. The plaintiff brought a class action on behalf of all similarly situated theme park customers and sued for maximum damages ($5,000 per violation) under BIPA. The Illinois appellate court held that plaintiff could not maintain a BIPA action because technical violations did not render a party “aggrieved,” a key element of a BIPA claim.

In a unanimous decision, the Illinois Supreme Court disagreed. The court held that “an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Act, in order to qualify as an ‘aggrieved’ person and be entitled to seek liquidated damages and injunctive relief pursuant to the Act.” Even more pointedly, the court held that when a private entity fails to comply with BIPA’s requirements regarding the collection, retention, disclosure, and destruction of a person’s biometric identifiers or biometric information, that violation alone – in the absence of any actual pecuniary or other injury—constitutes an invasion, impairment, or denial of the person’s statutory rights.

This decision – along with the 200 class actions already filed – shows how important it is for vendors and companies using fingerprint timeclocks or other technologies that may collect biometric information to be aware of BIPA’s requirements.

 

© 2019 Schiff Hardin LLP

Scan Your Practices: Illinois Supreme Court to Resolve Biometric Privacy Standard

Fingerprinting, retina scans, and voiceprints – practices once reserved for FBI agents, criminals, and Jason Bourne – are now widely used by companies of all sizes. These “biometric identifiers” are collected, often by employers, to provide for workplace efficiencies such as clocking time and ensuring secure access to sensitive locations. Or they may be used by businesses looking to track and identify customers. Whatever the case may be, collection and use of biometric identifiers are landing companies in legal hot water.

There has been a frenzy of class action lawsuits filed under the Illinois Biometric Information Privacy Act (BIPA) in recent weeks, in anticipation of a pending decision from the Illinois Supreme Court regarding the statute’s scope. BIPA provides a roadmap for how to lawfully gather, store, and destroy biometric data. When companies flout these requirements, they expose themselves to legal liability.

Compliance with BIPA is not terribly difficult. A private entity must: 1) develop a written policy, available to the public, that establishes a retention schedule and guidelines for permanently destroying biometric data; 2) provide information to the subject in writing, and obtain a written release before collecting and using biometric information; 3) safely store and prevent disclosure or dissemination of the biometric data to unauthorized third parties; and 4) destroy the biometric data when there is no longer a reason for keeping it, or within three years of the individual’s last interaction with the entity, whichever comes first.

The statute provides that “any person aggrieved by a violation” of these rules can bring suit. The tricky question, which the Illinois Supreme Court will soon answer, is who is a person aggrieved? Is someone aggrieved if a private entity technically violates the statute, but does not otherwise cause harm to the individual through unauthorized dissemination or disclosure of his or her biometric data? If a company forgets to obtain written authorization, but otherwise posts appropriate notices and protects the security of the data, are its employees or customers aggrieved persons?

The answer once appeared favorable to companies. In Rosenbach v. Six Flags Entertainment Corporation, the Second District Appellate Court held that “a plaintiff who alleges only a technical violation of the statute without alleging some injury or adverse effect is not an aggrieved person” under BIPA. In other words, technical violations of the statute, without any accompanying harm, did not pave the way for litigation.

At the end of 2018, however, the First District Appellate Court, in Sekura v. Krishna Schaumburg Tan, Inc., signaled a more relaxed, plaintiff-friendly standard by agreeing that an injury to a privacy right may be enough to maintain a lawsuit. Though that case also involved allegations of actual harm (unauthorized disclosure of the data to third parties), it created a fissure and undermined whatever comfort came from knowing that technical violations alone would not produce viable lawsuits. And, while the federal courts sitting in Illinois continue to dismiss these cases for lack of constitutional standing, the majority of BIPA cases are filed and remain in state court, where state precedent controls. Companies will seldom find themselves in the more favorable federal venue.

Meanwhile, the plaintiffs in Rosenbach appealed to the Illinois Supreme Court, which heard oral arguments on this issue at the end of November 2018. The central question the court will soon answer is what type of harm must be alleged in order for a plaintiff to maintain suit under BIPA: Are allegations of mere technical violations enough, or must a plaintiff allege a more particular harm? BIPA aficionados across the state are waiting with bated breath to learn the answer.

In the meantime, companies would be wise to review their biometric data notification, collection, storage, and destruction practices. In many ways, regardless of Rosenbach’s outcome, companies need to be extremely vigilant in deciding whether to collect biometric data in the first place and, if so, in developing and implementing careful practices to ensure full compliance with BIPA. Even if the Illinois Supreme Court ultimately concludes that technical violations alone are not actionable, shrewd plaintiffs and their attorneys will not hesitate to articulate allegations of harm beyond mere technicalities. Now is the time to scan your practices.

 

© 2019 Much Shelist, P.C.
This post was written by Laura A. Elkayam and James L. Wideikis of Much Shelist, P.C.
Read more on emerging employment law issues at the National Law Review’s Employment Law Resources Page.

Illinois Adopts A New Remote Seller Nexus Law

We should have a Wayfair decision by then, but IL adopted a South Dakota remote seller nexus rule effective October 1, 2018.

For purposes of the Use Tax Act, the definition of “retailer maintaining a place of business in this state” is amended, and for purposes of the Service Use Tax Act, the definition of “serviceman maintaining a place of business in this state” is amended. Beginning October 1, 2018, such a retailer will include a retailer making sales of tangible personal property and a serviceman making sales of service to purchasers in Illinois from outside of Illinois if the cumulative gross receipts from sales of tangible personal property and sales of service to purchasers in Illinois are $100,000 or more, or the retailer or serviceman enters into 200 or more separate transactions for the sale of tangible personal property or sales of service to purchasers in Illinois. The retailer or serviceman will determine on a quarterly basis, ending on the last day of March, June, September, and December, whether he or she meets this criteria for the preceding 12-month period. If the criteria are met, the individual is considered a retailer or serviceman maintaining a place of business in this state and is required to collect and remit use tax or the service use tax, respectively, and file returns for one year. At the end of the 1-year period, the retailer or serviceman will determine whether he or she met the criteria during the preceding 12-month period, and, if so, the individual is considered a retailer or serviceman maintaining a place of business in this state and is required to collect and remit use tax or the service use tax, respectively, and file returns for the subsequent year. If at the end of a 1-year period a retailer or serviceman that was required to collect and remit use tax or service use tax, respectively, determines that he or she did not meet the criteria during the preceding 12-month period, the retailer or serviceman subsequently will determine on a quarterly basis, ending on the last day of March, June, September, or December, whether he or she meets the criteria for the preceding 12-month period.

 

© Horwood Marcus & Berk Chartered 2018. All Rights Reserved.

BIPA Claims Against United Airlines Must be Arbitrated Due to Collective Bargaining Agreement

Last month a federal district court dismissed a putative class action lawsuit against United Airlines challenging its use of fingerprint scanning timeclocks. The lawsuit brought by United employee David Johnson alleged that the company’s collection and use of employees’ fingerprints violated the Illinois Biometric Information Privacy Act (BIPA) because the company failed to get the requisite consent from its employees for fingerprint collection and use.

In dismissing the lawsuit, the court found it lacked federal jurisdiction to resolve the dispute on two grounds. In the first instance, the court observed that the federal Railway Labor Act (RLA) creates a mandatory and exclusive arbitration process for resolving labor disputes that require interpretation of a collective bargaining agreement (CBA). The CBA between United and its employees gave United the “sole and exclusive right to manage, operate, and maintain the efficiency” of the workplace. Therefore, any resolution of Plaintiff’s challenge under BIPA of United’s collection and use of fingerprints as part of its timekeeping technology necessarily requires interpretation of the scope of the CBA. And, thus, “[b]ecause there is no way for the Plaintiff to pursue a BIPA claim without interpreting the existing CBA,” the court concluded that its resolution of Plaintiff’s BIPA claim was preempted by the RLA’s mandatory arbitration requirement, and that the court lacked jurisdiction to decide the claim.

In the second instance, echoing two other recent federal BIPA cases, the court concluded that violation of BIPA’s notice and consent requirement alone is not adequate injury to establish standing to sue in federal court under Article III of the U.S. Constitution. The court found that a lack of consent, while a technical violation of the statute, does not itself alone increase the risk of disclosure that could result in injury or harm to the individual. Absent any actual compromise of the biometric information, or an increased risk of such compromise, there was no injury-in-fact, and thus no federal jurisdiction. While the court’s ruling in this regard continues the trend of other federal courts, it’s worth noting that standing to sue in Illinois state court is unaffected by these decisions. Whether a plaintiff or class action may succeed in state court based upon a mere technical violation of BIPA’s requirements—without more—remains an open question the Illinois Supreme Court is expected to answer in its next session.

Putting it Into Practice: Companies negotiating collective bargaining agreements should be aware that the right language may allow for resolution of many labor disputes, including disputes arising under BIPA, through mandatory arbitration rather than through the courts. When collecting and using biometric information, companies should continue to pay attention to BIPA’s requirements regarding consent, notice, and disclosure because although federal courts have dismissed suits predicated only on mere technical violations of the statute, other avenues of recourse may still be available to plaintiffs in state court and via arbitration.

Copyright © 2018, Sheppard Mullin Richter & Hampton LLP.

Navigating a Cook County Department of Revenue Audit and the Procedure for a Formal Protest

A recent national trend in the practice field of state and local tax has been the uptick in local jurisdictions’ audit activity. The Cook County Department of Revenue (“Cook County” or “Department”) is no exception to this trend where in recent years, the Department has increased its audit activity, and much to the chagrin of taxpayers, has taken aggressive positions in the interpretation of its tax ordinances. Consequently, this has led to increased litigation in the administrative proceedings before the Cook County Department of Administrative Hearings (“D.O.A.H.”). This post provides an overview of the Department’s audit and ensuing D.O.A.H. processes and will highlight some of the procedural differences compared to other jurisdictions such as Chicago and Illinois. This background should assist any taxpayer in navigating the pitfalls and traps they will likely face if they receive a notice of Tax Assessment and Determination (“Assessment”).

Authority to Tax

The Illinois Constitution grants a home rule unit, which includes a county that has a chief executive officer elected by electors of the county, with authority to exercise any power and perform any function pertaining to its government and affairs, including the power to tax.  Ill. Const. Art. VII, § 6(a), 55 ILCS 5/5-1009. For taxes that are measured by income or earnings or that are imposed upon occupations, Cook County only has the power provided by the General Assembly.  Ill. Const. Art. VII, § 6(e). Cook County, however, is not preempted from imposing a home rule tax on (1) alcoholic beverages; (2) cigarettes or tobacco products; (3) the use of a hotel room or similar facility; (4) the sale or transfer of real property; (5) lease receipts; (6) food prepared for immediate consumption; or (7) other taxes not based on the selling or purchase price from the use, sale or purchase of tangible personal property.  55 ILCS 5/5-1009.

Audit Overview

Cook County, like the Illinois Department of Revenue and the City of Chicago Department of Finance, initiates an audit by issuing an individual or business a notice of audit to the taxpayer. The notice will generally identify the taxes subject to review, the periods under audit, and the time and location where the Department will undertake the audit. The notice will likely also include document requests and/or questionnaires that the Department has requested to review as part of audit. In some instances, however, if the Department believes that a taxpayer is not reporting a tax that the Department believes it is subject to, the Department will skip the audit and issue a “jeopardy assessment.” A jeopardy assessment assesses liability based on the books and records of who the Department deems to be similarly situated taxpayers.

Additionally, as my colleague Samantha Breslow discussed in ” Navigating a Chicago Audit and the Procedure for a Formal Protest“, taxpayers should take the Department’s information requests seriously.  It is especially important that the taxpayer stays engaged and responsive to Department auditors as a failure to do so may result in the Department issuing a jeopardy assessment. Cook County Code of Ordinances (“C.C.O.”) § 34-63(c)(2).[1]

Protest

While the Department’s audit process is very similar to Illinois, Chicago, and most other jurisdictions for that matter, the Department’s tax appeals process differs significantly. Unlike the Chicago Department of Finance which affords taxpayers 35 days to protest a notice of tax assessment, and the Illinois Department of Revenuewhich affords taxpayers 30-60 days to protest a notice of tax assessment, a taxpayer subject to a Department tax assessment must file its protest within 20 days of the Department’s mailing the notice of tax determination and assessment. C.C.O § 34-80. The taxpayer must either personally serve the Department with its protest, or place its protest in an envelope, properly addressed to the Department and postmarked within twenty days of the Department’s mailing of the protest. C.C.O. 34-79. At a minimum, a protest must identify the date, name, street address of the taxpayer, tax type, tax periods, the amount of the tax determination and assessment, and the date the county mailed the notice of assessment. The protest should also include an explanation of reasons for protesting the assessed tax and penalties. The Department has published a ” Protest and Petition for Hearing” form which must be used by a protesting taxpayer.  The form must be signed, and must include a power of attorney if the taxpayer is represented by someone other than the taxpayer.

Taxpayers should pay attention to the extremely short time frame in which to a protest must be filed. When considering the Department is only required to serve this notice by United States registered, certified or first class mail, a taxpayer is often left with less than 15 calendar days to file its protest. This is especially true for corporate taxpayers whose headquarters may differ from the address of its tax or legal department or the individual responsible for protesting tax assessments.

Administrative Proceedings

Upon timely receipt of a taxpayer protest, the Department will determine whether any revisions to the Assessment are warranted. This stage may result in a continuation of the audit where the Department will request additional documentation from the taxpayer and the Director of the Department does have the authority to amend the Assessment. While nothing prohibits the Department from increasing the Assessment during this stage, generally if a revision to the Assessment is made, the result is a reduction in the Assessment.[2]

If the parties are unable to resolve the audit, the Department then institutes an administrative adjudication proceeding by forwarding a timely filed protest to the D.O.A.H. C.C.O. § 34-81; C.C.O. § 2-908. The Director of the D.O.A.H. is appointed by the President of the County Board, and is subject to approval by the County Board of Commissioners. C.C.O. § 2-901(b).The Director appoints hearing officers, or administrative law judges (“ALJ”), who are independent adjudicators authorized to conduct hearings for the Department.C.C.O. § 2-901(a). The ALJ has authority to hold settlement conferences, hear testimony, rule upon motions, objections and admissibility of evidence. C.C.O. § 2-904. Note, however, the ALJ is prohibited from hearing or deciding whether any ordinance is facially unconstitutional. C.C.O. § 34-81.

At all proceedings before the ALJ, the Department will be represented by the State’s Attorney. The ALJ will set the matter for an initial pre-hearing status where the parties should be prepared to provide the ALJ with a brief overview of the facts and issues in dispute. The parties will then work to narrow the issues for presentment of findings by the ALJ. This will likely be accomplished by pre-hearing motion practice and the parties’ attempt to stipulate to facts and legal issues to be decided by the ALJ. Ultimately, the taxpayer and the Department will participate in a hearing, or trial, before the ALJ prior to the ALJ issuing a final order with findings of fact and conclusions of law. C.C.O. §  2-904.

Most taxpayers and practitioners are surprised to learn that the D.O.A.H. has no formal discovery. In fact, the parties are only entitled to conduct discovery with leave of the ALJ. Cook County D.O.A.H. General Order No. 2009-1 (“General Order”), Rule 6.3.In our experience,the ALJ will occasionally permit limited interrogatories and requests to admit, but requests to produce have been denied, and depositions arestrictlyprohibited. This is true even where a party intends on introducing an expert witness at the hearing.  Notably, because the Illinois Supreme Court rules do not apply, there is also no corresponding requirement that an expert submit its conclusions and opinions of the witness and bases thereof to the adverse party. See  Ill. S. Ct. R. 213(f). The ALJ may subpoena witnesses and documents which the ALJ deems necessary for the final determination. General Order, Rule 6.4. The lack of procedure naturally increases the likelihood of surprise at final hearing.

After the completion of any pre-hearing motions and the narrowing of the issues, the parties proceed to a hearing where each party will present its case. This is where the record is made for purposes of appeal. No additional evidence is permitted to be introduced at the Circuit Court. The Petitioner, often the Department, must present its case first and bears the initial burden.[3] However, the Department’s Assessment is deemed to be prima facie correct. C.C.O. § 34-64.Thus, a taxpayer has the burden of proving with documentary evidence, books and records that any tax, interest or penalty assessed by the Department is not due and owing.  C.C.O. § 34-63. The formal and technical rules of evidence do not apply at the hearing. C.C.O. § 2-911. A taxpayer can also present fact and expert witnesses in support of its position and may wish to call Department personnel such as the auditor and supervisor as adverse witnesses to support its case.

After both parties have concluded their case, each may request an opportunity to present a closing argument. General Order, Rule 9.4. In lieu of, or in addition to a closing argument, the ALJ may request the parties to file post hearing briefs. It is during the closing argument and/or brief, that the parties will have the opportunity to present its legal and factual defense to the Assessment.

After the hearing and review of post-trial briefs, the ALJ will issue a final order which includes findings of fact and conclusions of law. The findings of the ALJ are subject to review in the Circuit Court of Cook County pursuant to the Administrative Review and the aggrieved party has 35 calendar days to file an appeal. C.C.O. 2-917.

Conclusion and Takeaways:

The D.O.A.H. presents some unique litigation and procedural challenges for a taxpayer wishing to protest a Department Assessment. The major takeaways for a taxpayer protesting an assessment are (1) a taxpayer must file its protest within 20 days of the Department’s mailing of the assessment; (2) the D.O.A.H. has limited discovery rules and prohibits the use of depositions which can inhibit a taxpayer’s ability to build a case. Accordingly, a taxpayer must present adequate witnesses and documentation to support its case at hearing; and (3) a taxpayer must build a record at the administrative proceeding because it will be foreclosed from doing so at the circuit court if an appeal is necessary. These takeaways can go a long way in assisting a taxpayer’s chances of success in what is at times, an unpredictable venue.

[1] If a Taxpayer believes that it has paid a prior amount of tax, interest, or penalty in error to the department, in addition to amending its return, the taxpayer must file a claim for credit or refund in writing on forms provided by the Department. Cook County Code of Ordinances (“C.C.O.”) § 34-90.  The claim for refund must be made not later than four years from the date on which the payment or remittance in error was made. Id.  

[2] If the assessment is revised, the Taxpayer should determine whether the revisions are documented in an official “Revised Notice of Assessment and Determination” or alternatively, whether the revisions were documented in something less formal such as revised schedules or workpapers.  If it is the former, while the Ordinance does not expressly require an Amended Protest to be filed, the issue of whether a revised protestmust be filedwithin 20 daysof the Revised Assessment has been raised in administrative proceedings before the Department. 

[3] We have seen instances where the Taxpayer is identified as the Petitioner in the captioned matter.  In fact, the Taxpayer is identified as Petitioner in the Department’s Protest and Petition for Hearing Form.  However, because the Department submits the matter to DOAH, the taxpayer has no choice on whether it is identified as Petitioner or Respondent in the proceeding, and the Department’s inconsistency often leads to confusion regarding burden of proof issues.

 

© Horwood Marcus & Berk Chartered 2018. All Rights Reserved.
This post was written by David W. Machemer of Horwood Marcus & Berk Chartered 2018.

Illinois Employers Face A Recent Rash of Class Action Lawsuits Filed Under State Biometric Information Privacy Law

Illinois enacted its Biometric Information Privacy Act (“BIPA”) in 2008 to regulate, among other things, employer collection and use of employee biometric information.  Biometrics is defined as the measurement and analysis of physical and behavioral characteristics.  This analysis produces biometric identifiers that include things like fingerprints, iris or face scans, and voiceprints, all of which can be used in a variety of ways, including for security, timekeeping, and employer wellness programs.

Illinois is not the only state with a biometrics privacy law on its books, however, its version is considered the nation’s most stringent.  BIPA requires a business that collects and uses biometric data to protect the data in the same manner it protects other sensitive or confidential information; to establish data retention and destruction procedures, including temporal limitations of three years; to publish policies outlining its biometric data collection and use procedures; and to obtain prior, informed consent from any individuals from whom it plans to obtain and use biometric data.   The statute also requires  businesses to notify employees in the event of a data breach.

Protection of biometric data is viewed as critical because, unlike passwords comprised of letters, numbers, or typographical characters, biometric data is unique and cannot be replaced or updated in the event of a breach.  Technology now allows biometric data to be captured surreptitiously, such as recording a voice over the phone, or face mapping individuals in a crowd or through photographs, increasing the risk for its theft or unauthorized or at least, unknown, use.  In fact, these more furtive methods of collecting and using biometric data is what led to the filing of five BIPA class action lawsuits in 2015 – four against Facebook, and one against online photo website Shutterfly – that alleged these companies used facial recognition software to analyze online posts, but did not comply with BIPA’s consent or other procedural requirements.  These first lawsuits brought attention to the private right of action authorized under BIPA, which provides that any “aggrieved” person may sue and recover $1,000 for each negligent violation and $5,000 for each intentional or reckless violation, or, in both circumstances, actual damages if greater than the statutory damages.  Prevailing parties may also recover their attorneys’ fees and costs.

The plaintiffs’ employment bar recently has gotten seriously into the BIPA class action game; since August 2017, approximately 30 lawsuits have been filed in Cook County, Illinois (where Chicago is), alone.  These putative class actions have been filed against employers in many industries including gas stations, restaurants, and retail, and typically involve the employer’s use of fingerprint operated time clocks.  The cases allege that the defendant employers failed to obtain proper informed consent or fail to maintain and inform employees about policies on the company’s use, storage, and destruction of biometric data.  Many of these lawsuits also allege the employer companies have improperly shared employee biometric data with third-party time clock vendors, and some even name the vendor as a defendant.

In addition to the obvious cost of class action litigation, these suits present additional legal challenges because many aspects of BIPA remain untested.  For example, the statutory term “aggrieved” person leaves open the question whether a plaintiff must be able to prove actual harm in order to recover.  The U.S. District Court for the Northern District of Illinois and U.S. District Court for the Southern District of New York both have dismissed BIPA suits for lack of standing where the plaintiffs did not allege actual harm.  The latter case, Santana v. Take-Two Interactive Software, is currently before the United States Court of Appeals for the Second Circuit, which heard oral argument in October 2017, but has not yet issued its ruling.   Other aspects of BIPA also remain in flux – such as whether facial recognition through photography is biometric data, as defined under the statute, and what forms of consent are compliant.  On the other side, defendants are challenging the constitutionality of the damages provisions, arguing that their potentially disproportionate nature to any actual harm violates due process.  As these issues are flushed out under BIPA, they are certain to affect other states who have already enacted, or may seek to enact, laws regarding use of biometric data.

This post was written by Daniel B. Pasternak of Squire Patton Boggs (US) LLP., © Copyright 2017
For more Labor & Employment legal analysis go to The National Law Review