By Ryan T. Garippo, Alex W. Karasik, and Gerald L. Maatman, Jr.
Duane Morris Takeaways: On September 29, 2024, in Howe, et al. v. Speedway, LLC, No. 19-CV-01374, 2024 U.S. Dist. LEXIS 176263 (N.D. Ill. Sept. 29, 2024), Judge Edmond Chang of the U.S. District Court for the Northern District of Illinois denied Speedway’s two motions for summary judgment and granted Plaintiff’s motion for class certification, meaning this Illinois Biometric Information Privacy Act (the “BIPA”) class action will proceed to trial.
This decision is significant for employers because it represents another example of a court limiting the sparse defenses available to corporate defendants in BIPA cases.
Case Background
Plaintiff worked as a manager trainee and then as a manager for Speedway, LLC (“Speedway”). Like many employers, Speedway used finger-scan timeclocks for its employees to clock in and out of work “to avoid the problem of ‘buddy punching’ (clocking in and out for someone else).” Id. at *1. These timeclocks scanned the ridges of an employee’s fingerprint and then created an alphanumeric code. The parties disagreed as to whether this alphanumeric code could be reverse engineered to reconstruct the scan that it was based on to finger-scans.
In 2017, Plaintiff filed a lawsuit in the Circuit Court of Cook County (Illinois) alleging violations of the BIPA, which prohibits the possession, collection, and/or disclosure of an individual’s biometric information without notice and consent. Over the course of the last seven years, Speedway put up a vigorous defense to these claims. It removed the case to federal court. Howe, et al. v. Speedway, No. 17-CV-07303, 2018 WL 2445541, at *1 (N.D. Ill. May 31, 2018). Plaintiff then filed and won a motion to remand, claiming that he himself had not suffered an injury-in-fact. Id. at *1-7. But then after the case proceeded for nearly two years in state court, Speedway removed the case again after the Illinois Supreme Court changed its approach to the Article III analysis. Howe, 2024 WL 4346631, at *3, n. 5. Speedway also filed two motions for summary judgment, a motion to exclude Plaintiff’s expert witness, and a response in opposition to class certification. Id. at *3.
The Court’s Opinion
The Court denied Speedway’s motions for summary judgment and motion to exclude Plaintiff’s expert witness, while granting Plaintiff’s motion for class certification.
First, the Court rejected Speedway’s argument, as “a matter of first impression,” that the term “fingerprint” does not include partial prints or partial finger scans. Id. at *7. The Court held that the term “fingerprint” means “the ridges of the finger (or a portion of the distinctive pattern of lines on a finger), as long as that portion of the finger’s ridges or pattern is sufficient to be unique to a particular individual and is capable of being used to identify a particular person.” Id. As a result, the Court concluded that “[t]here is no reason that particular fingerprint, or scan of a ‘portion of the ridges of a finger’ cannot qualify as a biometric identifier” and by extension that the alphanumeric code was “biometric information under [the] BIPA.” Id. at *8.
Second, the Court rejected Speedway’s argument that it failed to act negligently, let alone recklessly, sufficient to establish statutory damages under the BIPA. The Court found “[o]n liability, BIPA is indeed a strict liability statute and requires no proof of particular mental state to establish a violation of the statutes notice and consent or data-retention policy requirements.” Id. at *10. Although such states of mind are required to obtain statutory damages, the Court concluded that there was a question of fact as to Speedway’s state of mind because it was undisputed that Speedway did not have BIPA-specific notice forms up to nine years after the BIPA’s enactment. However, it will be up to a jury to decide whether this conduct was negligent or reckless.
Third, the Court rejected Speedway’s argument that the damages alleged were disproportionate to the harm suffered and would violate the due process clause of the U.S. Constitution. The Court reasoned that $1,000 per-negligent violation, and $5,000 per-reckless violation, were not inherently unconstitutional damages figures. Thus, they did not run afoul of the due process clause. The Court was also unpersuaded by Speedway’s concern that certification of a class action implicates such significant damages. The Court reasoned that “[s]omeone whose maximum penalty reaches the mesosphere only because the number of violations reaches the stratosphere can’t complain about the consequences of its own extensive misconduct.” Id. at *17 (quotations omitted).
Fourth, the Court also dispensed with Speedway’s myriad of other affirmative defenses and arguments. For a variety of reasons, the Court held that each of these defenses failed. Further, the Court took care to note that “Speedway may still litigate whether there are any factual questions to decide” at trial. Id. at *10. But the Court was “skeptical” that such disputed facts exist. Id. With all of Speedway’s motions and defenses rejected, the Court granted Plaintiff’s motion for class certification of the “7,246 employees enrolled using its timeclocks in Illinois.” Id. at *15.
Implications For Businesses
Unfortunately, the story in Speedway is one that employers who utilize biometric timekeeping systems in Illinois know all too well. A seemingly routine business decision regarding timekeeping practices evolved into exponential liability, despite a plaintiff’s own admission that he did not suffer an injury-in-fact.
Fortunately, for companies with an Illinois presence that utilize biometrics, reprieve is on the way. On August 2, 2024, Illinois Governor J.B. Pritzker signed Senate Bill 2979, which amends the draconian penalties under Sections 15(b) and 15(d) of the BIPA. For businesses caught in the BIPA’s crosshairs, this reform ushers in a welcome era of relief in terms of bet-the-company liability.