By Gerald L. Maatman, Jr., Jennifer A. Riley, and Alex W. Karasik
Duane Morris Takeaways: In Vaughan v. Biomat USA, Inc. et al, Case No. 20-CV-4241, 2022 U.S. Dist. LEXIS 168497 (N.D. Ill. Sept. 19, 2022), Judge Marvin Aspen of the U.S. District Court for the Northern District of Illinois issued the latest plaintiff-friendly decision under the Illinois Biometric Information Privacy Act (“BIPA”), holding that federal regulations relating to plasma collection do not preempt the BIPA. For employers looking to craft novel defenses in response to the recent onslaught of biometric privacy class action litigation, this ruling represents another impediment to a potential defense strategy.
Case Background
Plaintiffs, a group of individuals who donated blood plasma at Defendants’ donation centers for money, alleged that they were required to provide their fingerprints scans to Defendants at kiosk for identity and tracking purposes. They claimed that Defendants stored their biometric fingerprint scans in a database that was used to track the donations. Plaintiffs contended that Defendants’ practices violated Sections 15(a) and 15(b) of the BIPA by: (i) failing specific limited purpose or length of time for which Defendants collected, stored, or used their biometrics; (ii) failing to provide retention policies, guidelines, or schedules for deletion of their biometric data; (iii) failing to obtain their authorization to store their data; and (iv) failing to destroy the data in the requisite time period. Id. at 2. Plaintiffs sought to bring the class action on behalf of themselves and all others enrolled in the biometric system over the preceding five years.
Defendants moved to dismiss on the grounds that: (i) federal law regarding plasmapheresis preempts the BIPA; (ii) several Plaintiffs provided informed consent for the collection of their biometric data, and therefore, their Section 15(b) claims could not survive; (iii) the BIPA did not apply to the collection of Plaintiffs’ fingerprints under three statutory exemptions; (iv) Plaintiffs claims were untimely; and (v) Plaintiffs failed to state claims for reckless violations of the BIPA.
The Court’s Decision
The Court denied Defendants’ motion to dismiss on all grounds.
First, the Court addressed the federal preemption argument. Defendants asserted that there was conflict between the Food and Drug Administration (“FDA”) regulations and the BIPA because the former requires plasmapheresis to establish a “donor identification system” and to keep records on the “donor records” for “10 years after the records of processing are completed.” Id. at 9. Since the BIPA requires destruction of biometric identifies within three years, Defendants argued that the resulting conflict must be resolved in favor of federal law. The Court rejected Defendants’ argument. It held that the federal law did not require the use of biometric data to verify plasma donors’ identities. The Court opined that the only requirement was to “obtain proof of identity of the donor” and that the requisite proof could be established with photographic identification. Id. at 10. Further, the Court found no merit to Defendants’ argument that fingerprint scans best served the purpose of the FDA regulations requiring donor identification systems. Instead, it determined that there was “no authority that fingerprint scans are superior to the other forms of identification that regulations accept.” Id. at 11.
Second, the Court analyzed Defendants’ contention that several Plaintiffs signed consent forms and thus could not assert Section 15(b) claims. The Court reasoned that Section 15(b) requires not just a signed consent form, but also written notice that the biometric information is being collected and stored, and the purpose and length of time of the storage. Since the Court found that the consent agreements did not contain the full information required, the Court rejected Defendants’ argument.
Third, the Court ruled that Defendants’ argument that the BIPA did not apply because of statutory exemption was without merit, as none of the asserted exemptions applied to Plaintiffs.
Fourth, the Court determined the five-year statute of limitations period applied to Plaintiffs’ claims such that the claims were timely-filed. Although the Court noted that the statute of limitations issue was before the Illinois Supreme Court, it observed that the Defendants did not provide any persuasive indications that the Illinois Supreme Court will apply a one-year statute of limitations when it decides Tims v. Black Horse Carriers, Inc., 452 Ill. Dec. 48, 184 N.E.3d 1029 (Ill. Jan 26, 2022). The Court, therefore, declined to dismiss the claims on this basis.
Finally, the Court turned to Defendants’ argument that Plaintiffs’ request for liquidated damages should be dismissed because they failed to plausibly allege recklessness or willfulness. The BIPA authorizes a prevailing party to recover, inter alia, the greater of actual damages or $1,000 in liquidated damages for each negligent BIPA violation and the greater of actual damages or $5,000 in liquidated damages for each intentional or reckless BIPA violation. Id at 26. The Court determined that since requests for liquidated damages are not claims under the BIPA, but rather demands for relief, Plaintiffs were not required to plead facts showing Defendants’ recklessness or willfulness.
Accordingly, the Court denied Defendants’ motion to dismiss in its entirety.
Key Takeaways For Employers
As Illinois state and federal courts seemingly issue plaintiff-friendly rulings at every turn in biometric privacy class action space employers are faced with an evaporating array of potential defenses. Businesses that utilize biometric technology for employees and customers would thus be prudent to ensure their consent and storage procedures are compliant with the BIPA statute in order to best mitigate potential damages in this area.