Surge in Class Actions Under the Illinois Genetic Information Privacy Act

This year has seen a substantial increase in the number of class action lawsuits filed against employers under the Illinois Genetic Information Privacy Act (GIPA). More than 20 suits have been filed this year, a stark contrast to zero filed in 2022 and only two in 2021.

Like its federal counterpart the Genetic Information Nondiscrimination Act (GINA), GIPA prohibits employers, and agents acting on their behalf, from “directly or indirectly” soliciting, requesting, requiring or purchasing genetic information from a person as a condition of employment or from using genetic information in a discriminatory manner against an employee or applicant. Genetic information is defined to include information from genetic tests or the manifestation of a disease or disorder of an individual or their family members.

Under the claims filed, plaintiffs allege that during the hiring process prospective employers collected family medical history and required pre-employment physicals or health interviews, which sought the protected information. These exams and interviews were often conducted by third-party occupational health services providers. The damages sought included “statutory damages” under the Act of $15,000 for each intentional and/or reckless violation and $2,500 for each negligent violation. In addition, GIPA has no statutory cap on punitive or compensatory damages and no statute of limitations, exposing employers to potentially massive damage awards.

Because these cases are in their infancy and currently only in Illinois, there is little guidance on the scope of GIPA and any exceptions that may exist. This means that we will need to wait and see how courts will interpret the Act and what impact the cases will have beyond Illinois.

In light of these developments, all employers should consider the following:

  • Disclaimer Use on Authorizations and Information Packets: Consider adding a written disclaimer to any authorization and pre-employment questionnaires that requests applicants not to provide any genetic information when responding to requests for medical information. The disclaimer should be provided to the applicant/employee for their information.
  • Review Third-party Provider Practices: Evaluate the practices of third-party medical providers, including documents provided to applicants/employees in their evaluation process, and request that family medical history not be obtained.
  • Assess Contracts/Indemnification Obligations: Review and assess the indemnification provisions of contracts with third-party medical providers. It is important that the hold harmless and indemnification obligations of the provider include reference to GIPA obligations in the scope of protection for the employer.

Tom Brady, Larry David, and Others Named Defendants in Class Action Suit Filed Against FTX

Four days after FTX, once the world’s third-largest crypto exchange, filed for voluntary Chapter 11 bankruptcy, former FTX investors filed a class action against 11 athletes and celebrities who promoted FTX in advertisements and on social media, including NFL quarterback Tom Brady and comedian Larry David.

The lawsuit, which also names FTX’s co-founder and former chief executive Sam Bankman-Fried as a defendant, seeks $11 billion in damage.

Background

The FTX bankruptcy filing covers about 130 FTX Group companies, including FTX.com, FTX’s US operations, and Bankman-Fried’s cryptocurrency trading firm, Alameda Research. According to published reports, Bankman-Fried had covertly used funds from FTX customers to make risky bets for Alameda Research – a hedge fund he also ran – and had commingled funds between the two entities.

Allegations Against FTX Celebrity Endorsers

The class action was brought on behalf of US investors who hold FTX yield-bearing accounts funded with crypto assets. The plaintiff and class-action members alleged that FTX lured them to its yield-bearing accounts and transferred investor funds to related entities to maintain the appearance of liquidity.

While an investor class action following bankruptcy is not necessarily surprising, the fact that the complaint named various celebrity endorsers and spokespeople as defendants is fairly unusual. Among them, Larry David starred in an advertisement for FTX that aired during the 2022 Super Bowl. The ad featured David being a skeptic on inventions such as the wheel, the fork, the toilet, democracy, the light bulb, the dishwasher, the Sony Walkman, and, finally, FTX, and cautioned viewers, “Don’t be like Larry.” Other conduct cited by the complaint includes:

  • Tom Brady and Gisele Bundchen: according to the complaint, Brady and Bundchen served as brand ambassadors for FTX, took equity stakes in FTX Trading Ltd., and appeared in an advertisement showing them telling acquaintances to join the FTX platform.

  • Kevin O’Leary: served as brand ambassador and FTX shareholder and made several public statements, including on Twitter, “designed to induce consumers to invest in” FTX’s yield-bearing accounts.

  • Naomi Osaka: the tennis star served as a brand ambassador for FTX in exchange for an equity stake and payments in an unspecified amount of cryptocurrency, appeared in advertisements, and promoted FTX to her Twitter followers.

The plaintiff and class members claimed that those FTX promoters engaged in a conspiracy to defraud investors and violated Florida state laws prohibiting unfair business practices. Specifically, in their civil conspiracy claim, the plaintiff and class members alleged that “the FTX Entities and Defendants made numerous misrepresentations and omissions to Plaintiff and Class Members about the Deceptive FTX Platform in order to induce confidence and to drive consumers to invest in what was ultimately a Ponzi scheme, misleading customers and prospective customers with the false impression that any cryptocurrency assets held on the deceptive FTX Platform were safe and were not being invested in unregistered securities.” [1]

Celebrities Under Scrutiny in Crypto Industry

The US Securities and Exchange Commission (SEC) has gone after celebrities for deceptively touting cryptocurrencies since 2017. In November 2017, SEC Chair Gary Gensler warned celebrities that federal securities laws require people who tout a certain stock or crypto security to disclose the amount, the source, and the nature of those payments they received.[2]

In October 2022, the SEC found that Kim Kardashian violated the anti-touting provision of the federal securities laws by plugging on social media a crypto asset security offered and sold by EthereumMax (EMAX) without disclosing the payment she received for the promotion.[3] Kardashian later settled with the SEC, paid $1.26 million in penalties, disgorgement, and interest, and cooperated with the Commission’s ongoing investigation.[4] “Ms. Kardashian’s case also serves as a reminder to celebrities and others that the law requires them to disclose to the public when and how much they are paid to promote investing in securities,” Gensler added.[5]

Investors have also gone after celebrities for deceptively touting cryptocurrencies. In January 2022, a group of investors filed a lawsuit against Kim Kardashian, along with boxer Mayweather and former basketball star Paul Pierce, for losses they suffered after the celebrities promoted EMAX.

Implications

This case offers a stark warning to celebrities and non-crypto companies that might be considering serving as brand ambassadors or paid influencers for crypto companies, or engaging in sponsorships. Any individual or organization considering entering into a co-promotion or sponsorship agreement with a company in the crypto industry should ensure adequate due diligence has been conducted on the potential partner and carefully scrutinize crypto and NFT offerings for potential liability or exposure under US securities laws. Notably, the US Federal Trade Commission is also carefully scrutinizing the use of influencers and endorsements in commercial marketing and imposes its own disclosure obligations.

© 2022 ArentFox Schiff LLP

For more Finance Legal News, click here to visit the National Law Review.


FOOTNOTES

[1] See Complaint, Count Three.

[2] See SEC Statement Urging Caution Around Celebrity Backed ICOs, available at SEC.gov | SEC Statement Urging Caution Around Celebrity Backed ICOs.

[3] See SEC Charges Kim Kardashian for Unlawfully Touting Crypto Security, available at SEC.gov | SEC Charges Kim Kardashian for Unlawfully Touting Crypto Security.

[4] Id.

[5] Id.

The Law of Unintended Consequences: BIPA and the Effects of the Illinois Class Action Epidemic on Employers

Has your company recently beefed up its employee identification and access security and added biometric identifiers, such as fingerprints, facial recognition, or retina scans? Have you implemented new timekeeping technology utilizing biometric identifiers like fingerprints or palm prints in lieu of punch clocks? All of these developments provide an extra measure of security control beyond key cards which can be lost or stolen, and can help to control a time-keeping fraud practice known as “buddy punching.” If you have operations and employees in Illinois (or if you utilize biometrics such as voice scans to authenticate customers located in Illinois), your risk and liability could have increased with the adoption of such biometric technology, so read on ….

What’s the Issue in Illinois?

The collection of biometric identifiers is not generally regulated either by the federal government or the states. There are some exceptions, however. Back in 2008, Illinois passed the first biometric privacy law in the United States. The Biometric Information Privacy Act, known as “BIPA,” makes it unlawful for private entities to collect, store, or use biometric information, such as retina/iris scans, voice scans, face scans, or fingerprints, without first obtaining individual consent for such activities. BIPA also requires that covered entities take specific precautions to secure the information. BIPA also carries statutory penalties for every individual violation that can multiply quickly … and the lawsuits against employers have been coming by the dozens over the past few months.

The Requirements of BIPA

Among other requirements, under BIPA, any “private entity” — including employers — collecting, storing, or using the biometric information of any individual in Illinois – no matter how it is collected, stored or used, or for what reason – must:

  1. Provide each individual with written notice that his/her biometric information will be collected and stored, including an explanation of the purpose for collecting the information as well as the length of time it will be stored and/or used.
  2. Obtain the subject’s express written authorization to collect and store his/her biometric information, prior to that information being collected.
  3. Develop and make available to the public a written policy establishing a retention schedule and guidelines for destroying the biometric information, which shall include destruction of the information when the reason for collection has been satisfied or three years after the company’s last interaction with the individual, whichever occurs first.

Also, any such information collected may not be disclosed to or shared with third parties without the prior consent of the individual.The Money Issue

Under the law, plaintiffs may recover statutory damages of $1,000 for eachnegligent violation and $5,000 per intentional or reckless violation, plus attorneys’ fees and other relief deemed appropriate by the court. Moreover, if actual damages exceed liquidated damages, then a plaintiff is entitled under the Act to pursue actual damages in lieu of liquidated damages.

These damage calculations are made and awarded under BIPA on an individual basis. Do the math: If an employer has 100 employees in Illinois and has allegedly been negligent in obtaining required BIPA consent from employees, this can be a potential exposure of an employer to $500,000 in penalties, before you add in the ability to recover attorneys’ fees.

Who is Getting Sued?

The list of companies sued under BIPA spans industries. The initial groups of defendants included companies such as Facebook, Shutterfly, Google, Six Flags, and Snapchat. Also, a chain of tanning salons and a chain of fitness centers were each sued for using biometric technology to identify members. Between July and October, nearly 26 class-action lawsuits were filed in Illinois state court by current and former employees alleging their employers had violated the BIPA. Companies range from supermarket chains, a gas station and convenience store chain, a chain of senior living facilities, several restaurant groups, and a chain of daycare facilities.

Facts vary from case to case, but nearly all of the recent employee BIPA cases implicate fingerprint or palm-print time-keeping technologies that collect biometric data to to clock employees’ work hours. The plaintiffs allege their employers failed to inform employees about the companies’ policies for use, storage and ultimate destruction of the fingerprint data or obtain the employees’ written consent before collecting, using or storing the individual biometric information.

In at least one case, the employee has also alleged fingerprint data was improperly shared with the supplier of the time-tracking machines, and has named that supplier as a defendant as well (Howe v. Speedway LLC, No. 2017-CH-11992 (Ill. Cir. Ct. filed Sept. 1, 2017)).

What Do I Do Now?

In order to avoid becoming the next target, employers with operations and employees in Illinois should ask some basic questions and review processes and procedures:

  1. First question to ask: are we collecting, storing or using individual biometric data for any purpose?
  2. If the answer is yes, has your company issued the required notice and received signed releases/consents from all affected individuals? This release/consent should be obtained at the commencement of employment before any collection of individual biometric data begins. Do you have a publicaly available written policy to cover the collection, storage, use and destruction of the data? The employee handbook is the most logical place for this policy.
  3. Review your processes: (a) make sure that any collected data is not being sold or disclosed to third parties, outside of the limited exceptions permitted by the Act, and this includes vendors and third party suppliers of biometric technology who process and store the information in a cloud-based service, and (b) make sure that you evaluate your internal data privacy protocols and processes for protecting this new data set, and be prepared to prove that you have “reasonably sufficient” security measures in place for the individual biometric data.
  4. Review your vendor processes: If a vendor has access to the individual biometric data (such as a software-as-a-service provider), make sure the vendor has sufficient data privacy protocols and processes in place and that you have representations regarding this protection from the vendor.
  5. Review insurance coverage for this type of exposure with your broker.
  6. Remember the data breach issues: Make sure your data breach policies recognize that individual biometric data is considered personal information under Illinois laws addressing data breach notification requirements.

This post was authored by Cynthia J. Larose of © Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. For more Labor & Employment legal analysis, go to The National Law Review

Court of Appeal Reminds Litigants That Settling With Named Plaintiff Does Not Necessarily End Putative Class Action

An article recently published in the National Law Review by Neil A.F. Popović and Lai L. Yip of Sheppard Mullin Richter & Hampton LLP  regarding Putative Damages and Class-Action Lawsuits:

 

If a defendant in a putative class action settles with the class representative prior to class certification, does the defendant nonetheless have to respond to pre-settlement discovery requests to identify absent class members? According to the California Court of Appeal in Pirjada v. Superior Court, 2011 WL 6144930, Case No. B234813 (Cal. App. Dec. 12, 2011), the answer is no, although the appellate court left open the possibility that the trial court could require some form of notice to protect the interests of absent class members.

Plaintiff Seeks Discovery Identifying Putative Class Members

Putative class representative Obaidul Pirjada (“Pirjada”) brought a purported class action on behalf of all security guards who had been employed in California by defendant Pacific National Security, Inc. (“Pacific National”) during the preceding four years, alleging violations of the California Labor Code and the California Business and Professions Code. Pirjada propounded discovery requesting, among other things, the names and addresses of all putative class members. Pacific National did not object or respond to the discovery requests.

Plaintiff, Without Counsel Involvement, Settles Directly With Defendant

Without the involvement of his attorneys, Pirjada settled directly with Pacific National after negotiating with its CEO. Then, by letter to his counsel, Pirjada requested that his claims be dismissed with prejudice, and enclosed the settlement agreement along with payment for legal services.

Plaintiff’s Counsel Files Motion for Order Providing Notice to Putative Class Members; Defendant Files Motion to Dismiss

Instead of dismissing the lawsuit, however, Pirjada’s counsel filed a motion seeking to provide notice to absent members of the proposed class that substitution of a suitable class representative was necessary. Pacific National filed a motion to dismiss based on the parties’ settlement, which Pirjada joined.

Superior Court Denies Both Motions

The superior court denied Pacific National’s motion to dismiss, noting that a plaintiff’s individual settlement does not vitiate plaintiff’s or his counsel’s fiduciary obligations to the putative class members. The court granted sixty days leave to amend to add a new plaintiff as class representative. The court denied counsel’s motion for notice, finding it unnecessary because unlike in CashCall, Inc. v. Superior Court, 159 Cal. App. 4th 273 (2008), and Best Buy Stores, L.P. v. Superior Court, 137 Cal. App. 4th 772 (2006), members of the putative class of security guards know whether they were injured and thus can determine without notice whether to assert claims against Pacific National. The court specifically noted, however, that regardless of notice, plaintiff’s counsel was authorized to communicate with potential class members.

Plaintiff’s Counsel Moves to Compel Discovery to Identify New Class Representative, Which Superior Court Denies

Plaintiff’s counsel then moved to compel responses to the previously propounded requests for information identifying putative class members, arguing that Pacific National had waived its objections by failing to respond; that Pirjada could not provide contact information for other putative class members because he worked at only one Pacific National location and was the only guard assigned there; and that Pirjada contacted counsel only after his employment at Pacific National had ended. The superior court denied the motion to compel, stating that Pirjada had settled his claims and that his discovery requests were therefore moot. The court reiterated, however, that counsel were free to communicate with class members, even if it they were not entitled to discovery.

Court of Appeal Denies Petition, Deciding Superior Court Did Not Abuse Discretion

Plaintiff’s counsel filed a petition for writ of mandate challenging the superior court’s denial of the motion to compel, as well as the denial of the motion to provide notice.

The Court of Appeal concluded that the superior court acted within its broad discretion in denying the motion to compel, and choosing instead to protect absent class members by allowing counsel leave to amend the complaint after using informal means to identify potential replacement class representatives.

With respect to notice, the Court stated:

[P]recertification discovery may be allowed in appropriate circumstances to identify a substitute class representative in place of one who is not able to serve in that capacity, as well as to assist the lead plaintiff in learning the names of other individuals who might assist in prosecuting the action. But the obligation to notify absent class members before dismissing the case rests with the superior court, not the lead plaintiff or class counsel. The nature and extent of that notice must be decided by the court itself.

Pirjada, 2011 WL 6144930. at *14. The Court noted that under California Rule of Court 3.770, no notice to absent class members is required at all “if the court finds that the dismissal will not prejudice them.” Id. Moreover, because the superior court issued an order to show cause regarding dismissal, counsel will have the opportunity at that hearing to demonstrate that some form of notice is required to avoid prejudice to absent class members.

Lessons for Class Action Defendants

The somewhat unique circumstances in Pirjada highlight the importance of making sure to tie up procedural loose ends, such as outstanding discovery, when a defendant settles with the named plaintiff(s) prior to class certification. More broadly, the case serves as a reminder that named plaintiffs and their counsel have an ongoing fiduciary duty to potential class members, and courts must take reasonable steps to protect those interests, including through potential discovery and notice procedures.

Under Parris v. Superior Court, 109 Cal. App. 4th 285 (2003), and its progeny, “‘trial courts must apply a balancing test and weigh the actual or potential abuse of the class action procedure against the potential benefits that might be gained'” by allowing precertification discovery to identify a substitute class representative.Pirjada, 2011 WL 6144930, at *5 (quoting Starbucks Corp. v. Superior Court, 194 Cal. App. 4th 820, 825 (2011)). Addressing that standard remains a key consideration for defendants who seek to avoid ongoing class action litigation when they settle with a named plaintiff.

Copyright © 2011, Sheppard Mullin Richter & Hampton LLP.