Illinois Employers Face A Recent Rash of Class Action Lawsuits Filed Under State Biometric Information Privacy Law

Illinois enacted its Biometric Information Privacy Act (“BIPA”) in 2008 to regulate, among other things, employer collection and use of employee biometric information.  Biometrics is defined as the measurement and analysis of physical and behavioral characteristics.  This analysis produces biometric identifiers that include things like fingerprints, iris or face scans, and voiceprints, all of which can be used in a variety of ways, including for security, timekeeping, and employer wellness programs.

Illinois is not the only state with a biometrics privacy law on its books, however, its version is considered the nation’s most stringent.  BIPA requires a business that collects and uses biometric data to protect the data in the same manner it protects other sensitive or confidential information; to establish data retention and destruction procedures, including temporal limitations of three years; to publish policies outlining its biometric data collection and use procedures; and to obtain prior, informed consent from any individuals from whom it plans to obtain and use biometric data.   The statute also requires  businesses to notify employees in the event of a data breach.

Protection of biometric data is viewed as critical because, unlike passwords comprised of letters, numbers, or typographical characters, biometric data is unique and cannot be replaced or updated in the event of a breach.  Technology now allows biometric data to be captured surreptitiously, such as recording a voice over the phone, or face mapping individuals in a crowd or through photographs, increasing the risk for its theft or unauthorized or at least, unknown, use.  In fact, these more furtive methods of collecting and using biometric data is what led to the filing of five BIPA class action lawsuits in 2015 – four against Facebook, and one against online photo website Shutterfly – that alleged these companies used facial recognition software to analyze online posts, but did not comply with BIPA’s consent or other procedural requirements.  These first lawsuits brought attention to the private right of action authorized under BIPA, which provides that any “aggrieved” person may sue and recover $1,000 for each negligent violation and $5,000 for each intentional or reckless violation, or, in both circumstances, actual damages if greater than the statutory damages.  Prevailing parties may also recover their attorneys’ fees and costs.

The plaintiffs’ employment bar recently has gotten seriously into the BIPA class action game; since August 2017, approximately 30 lawsuits have been filed in Cook County, Illinois (where Chicago is), alone.  These putative class actions have been filed against employers in many industries including gas stations, restaurants, and retail, and typically involve the employer’s use of fingerprint operated time clocks.  The cases allege that the defendant employers failed to obtain proper informed consent or fail to maintain and inform employees about policies on the company’s use, storage, and destruction of biometric data.  Many of these lawsuits also allege the employer companies have improperly shared employee biometric data with third-party time clock vendors, and some even name the vendor as a defendant.

In addition to the obvious cost of class action litigation, these suits present additional legal challenges because many aspects of BIPA remain untested.  For example, the statutory term “aggrieved” person leaves open the question whether a plaintiff must be able to prove actual harm in order to recover.  The U.S. District Court for the Northern District of Illinois and U.S. District Court for the Southern District of New York both have dismissed BIPA suits for lack of standing where the plaintiffs did not allege actual harm.  The latter case, Santana v. Take-Two Interactive Software, is currently before the United States Court of Appeals for the Second Circuit, which heard oral argument in October 2017, but has not yet issued its ruling.   Other aspects of BIPA also remain in flux – such as whether facial recognition through photography is biometric data, as defined under the statute, and what forms of consent are compliant.  On the other side, defendants are challenging the constitutionality of the damages provisions, arguing that their potentially disproportionate nature to any actual harm violates due process.  As these issues are flushed out under BIPA, they are certain to affect other states who have already enacted, or may seek to enact, laws regarding use of biometric data.

This post was written by Daniel B. Pasternak of Squire Patton Boggs (US) LLP., © Copyright 2017
For more Labor & Employment legal analysis go to The National Law Review 

Employees Sue for Fingerprint Use

Employees of Peacock Foods, an Illinois-based food product manufacturer, recently filed a lawsuit against their employer for alleged violations of Illinois’ Biometric Information Privacy Act. Under BIPA, companies that collect biometric information must inter alia have a written retention policy (that they follow). As part of the policy, the law states that they must delete biometric information after they no long need it, or three years after the last transaction with the individual. Companies also need consent to collect the information under the Illinois law, cannot sell information, and if shared must get consent for such sharing.

According to the plaintiff-employees, Peacock Foods used their fingerprints for a time tracking system without explaining in writing how the saved fingerprints would be used, or if they would be shared with third parties. According to the employees, this violated BIPA’s requirement for explaining -in the consent request- how information would be used and how long it would be kept. The employees also alleged that Peacock Foods did not have a retention schedule and program in place for deleting biometric data. The employees are currently seeking class certification.

Putting it Into Practice: This case is a reminder that plaintiffs’ class action lawyers are looking at BIPA and possible complaints that can be brought under the law. To address the Illinois law – and similar ones in Texas and Washington – companies should look at the notice and consent process they have in place.   

This post was written by Liisa M. Thomas & Mukund H. Sharma of Sheppard Mullin Richter & Hampton LLP., Copyright © 2017

For more Labor & Employment legal analysis, go to The National Law Review

Recording Conversations with Your Cellphone: with Great Power Comes Potential Legal Liability

In the cellphone age, nearly everyone walks around with a multi-tasking recording device in their pocket or purse, and it comes in handy for many of our modern problems: Your dog suddenly started doing something adorable? Open your video app and start rolling. Need to share that epic burger you just ordered with your foodie friends? There’s an app for that. Want to remember the great plot twist you just thought of for that novel you’ve been working on? Record a voice memo.

Sometimes, though, the need arises to record more serious matters. Many people involved in lawsuits choose to record conversations with their phones, all in the name of preserving evidence that might be relevant in court. People involved in contentious divorce or child custody cases, for example, might try to record a hostile confrontation that occurred during a pickup for visitation. Conversely, others might be worried that an ex-spouse has secretly recorded a conversation and plans to use it against them out of context.

But while everyone has the power to record just about anything with few swipes on their phone, do they have the legal right to do so? If not, what are the possible consequences? Can you even use recorded conversations in court? Consider these important questions before your press record.

Criminal Liability: Can you go to jail just for recording someone’s conversation?

The short answer: Yes. Under Michigan’s Eavesdropping law,[1] it is a felony punishable by up to two years and $2,000 to willfully use any device to eavesdrop on (meaning to overhear, record, amplify, or transmit) a conversation without the consent of all participants in that conversation.[2]It is also a felony for a person to “use or divulge” any information that they know was obtained through illegal eavesdropping.[3]

But there is one important distinction that Michigan courts have recognized: if you are a participant in the conversation, then you do not need permission of other participants to record the conversation (at least not when it comes to the eavesdropping law; there may be other laws that apply, as discussed below).[4] This makes sense given the purposes of the law. The theory is that if you are a participant in the conversation, then other participants at least have a chance to judge your character and determine if you are the kind of person who might relay the conversation to others (either verbally or by making a recording).

The bottom line is that if you use a device, like your cellphone, to record, overhear, amplify, or transmit a conversation that you are not a part of without the permission of all participants, you could face criminal consequences.

Civil Liability: If someone records your private conversation, can you file a lawsuit against them?

The short answer: Yes. The eavesdropping statute allows eavesdropping victims to bring a civil lawsuit against the perpetrator.[5] But the same distinction applies; you cannot sue someone for recording a conversation that they participated in.

Before filing a civil eavesdropping claim, though, consider what if anything there is to gain. The eavesdropping statute permits a judge to issue an injunction prohibiting the perpetrator from further eavesdropping. This may be a valuable remedy if there is a risk that the eavesdropper would otherwise continue eavesdropping on your conversations. The statue also allows a plaintiff to recover actual damages and punitive damages from the wrongdoer. In many cases, actual damages will likely be minimal, and punitive damages are subject to the whims of the judge or jury deciding the case. A result, the cost of litigation may exceed any monetary recovery unless actual damages are significant or the eavesdropper’s conduct was egregious enough to elicit a large punitive award from a jury.

Evidence and Admissibility: Can I use a recorded conversation in court?

Many people are familiar with the exclusionary rule that arises from the Fourth Amendment of the United States Constitution, which provides that if police officers obtain evidence as a result of an illegal search or seizure, then the prosecution is prohibited from using that evidence to support their case. This raises the question:

If a regular civilian obtains evidence by recording a conversation in violation of the eavesdropping statute, is that evidence automatically excluded from court proceedings?

The short answer: No. The exclusionary rule is specifically designed to curb the potentially oppressive power of the government in order to guarantee the protections of the Fourth Amendment, at the expense of excluding potentially valuable evidence from court proceedings. Since the Fourth Amendment only restricts government conduct, the exclusionary rule only applies to evidence obtained as a result of unconstitutional government action. As a result, even if a private citizen breaks the law and records your conversation, that recording is not automatically excluded from court.[6]

So does this mean you can use any recorded conversation in court whenever you want?

The short answer: No. Anything presented in court still needs to comply with the Rules of Evidence, and in many cases recorded conversations will not make the cut. A big reason is the hearsay rule, which says that out of court statements cannot be used to prove the truth of the matter asserted.[7] In other words, you can’t use a recording of your neighbor saying “I use my neighbor’s Wi-Fi” as evidence to prove that he was, in fact, using your Wi-Fi.

But there are many exceptions to the hearsay rule which might allow a recorded conversation into court. Salient among these exceptions is the rule that admissions of a party-opponent are not hearsay.[8] Consequently, if a man records his ex-wife’s conversation with her current husband, the hearsay rule will not prevent the man from using the recording of his ex-wife against her in a child custody case; the ex-wife is a “party-opponent” and her out-of-court statements are not considered hearsay.

Continuing this same example, note that the man’s actions would violate the eavesdropping statute (assuming he didn’t have permission to make the recording) because he was not a participant in the hypothetical conversation. But this violation would not keep the recording out of court. Nevertheless, if a prosecutor wanted to press charges, the man could be subject to criminal liability. And if the ex-wife was so inclined, she could file a civil lawsuit against the man and ask for an injunction and monetary damages.

Other Law: Is the eavesdropping statute the only law you need to worry about before recording all of your conversations?

The short answer: No, don’t hit record just yet. Even if you comply with the eavesdropping statute, there are still other potential pitfalls to be aware of. For instance, wiretapping laws govern the recording and interception of telephone calls and electronic communications, and carry criminal penalties. For inter-state phone calls, the laws of other states will come into play as well. And depending on the means you use to obtain a recording and what you do with the recording once you have it, you risk incurring civil liability for a variety of privacy torts, such as intrusion upon seclusion or public disclosure of private facts.

The safest route is to always get permission from everyone involved before recording a conversation or sharing a recorded conversation with anyone. If that’s not an option, consult with a lawyer who has had an opportunity to consider all of the facts involved in your case.

________________________________

[1] MCL 750.539 et seq.
[2] MCL 750.539a; MCL 570.539c.
[3] MCL 750.539e.
[4] See Sullivan v. Gray, 117 Mich. App. 476, 324 N.W.2d 58, 59 – 61 (1982).
[5] MCL 750.539h.
[6] See, e.g., Swan v. Bob Maxey Lincoln Mercury, No. 216564, 2001 WL 682371, at *2 n3 (Mich. Ct. App. Apr. 24, 2001)
[7] MRE 802.
[8] MRE 801(d)(2).

This post was written by Jeffrey D. Koelzer of  Varnum LLP © 2017
For more legal analysis go to The National Law Review