BIPA’s Back in the News: Illinois Supreme Court Gives Unionized Employers ‎Respite From Costly Privacy Law Claims

In light of the Illinois Supreme Court’s string of recent, individual-friendly decisions related to Illinois's Biometric Information Privacy Act (“BIPA”) (see our Firm’s commentary on those decisions here and here), it was wholly reasonable for employers subject to BIPA to be anxious about the Court’s next BIPA decision. Add labor unions to the mix, and employers were well within their rights to be wary. But the Illinois Supreme Court’s recent Walton v. Roosevelt University decision may actually benefit employers that are subject to BIPA and have a unionized workforce. 

Statutory Background

BIPA is a privacy statute that imposes a number of compliance obligations on entities collecting biometric data, including requirements that the entity issue notice of the data collection and obtain an advanced written release from the subject of that data collection. BIPA violations can be costly at $5,000 per violation. But, relevant here, BIPA allows an “authorized representative” to “receive necessary notices and consent to the collection of biometric information.” 740 ILCS 14/15(b).

Like all state laws, BIPA is not immune to possible federal preemption, which occurs when federal law takes precedence over a state law.

Section 301 of the Labor Management Relations Act (LMRA) gives federal district courts jurisdiction over any lawsuit stemming from a “violation of contracts between an employer and labor organization.” These contracts (i.e., Collective Bargaining Agreements (“CBA”)) generally require an arbitrator to settle disputes over their meanings. Given that the United States Supreme Court had never determined whether the LMRA preempts BIPA, the Illinois Supreme Court examined Seventh Circuit Court of Appeals’ precedent to determine whether the LMRA preempts BIPA. The issue before the Illinois Supreme Court was, “Does Section 301 of the Labor Management Relations Act [(the “LMRA”)] . . . preempt BIPA claims . . . asserted by bargaining unit employees covered by a [CBA]?”

Case Background

In 2019, a former employee of Roosevelt University filed a class-action suit alleging the university violated its unionized employees’ BIPA privacy rights. As a condition of employment, the employees were required to scan their hands when clocking in and out for work. The plaintiff alleged the university violated BIPA because neither he nor his fellow putative class members ever signed a release as required under BIPA. The plaintiff further alleged the university never informed the putative class of the university’s data collection practices, as also required under BIPA. In turn, the plaintiff claimed he and the purported class were entitled to damages under BIPA, attorney’s fees, and injunctive relief.

The university argued that federal labor law preempted the plaintiff’s BIPA claims since his union’s CBA contained a broad management rights clause. In short, the university argued that federal labor law required an arbitrator to interpret the parties’ CBA to determine whether use of the hand-scanning timekeeping mechanism was properly within management’s discretion.

Walton’s Rationale

The Walton Court analyzed two Seventh Circuit cases that previously addressed federal labor laws’ preemption of BIPA claims.

First, the Seventh Circuit in Miller v. Southwest Airlines Co., 926 F.3d 898, 903 (7th Cir. 2019) held the Railway Labor Act preempted unionized employees’ BIPA claims since their union had consented to the employer’s fingerprint-scanning timekeeping device by agreeing to a broad management rights clause in the parties’ CBA. The court reasoned that the employees’ union was an “authorized agent” for BIPA notice and consent purposes and that “how workers clock in and out is a proper subject of negotiation between unions and employees.” Id. As a result, the court reasoned an “adjustment board” was required to determine if the parties’ broad management rights clause included the right for management to have employees’ use the fingerprint-scanning timekeeping device.

Two years later, applying the rationale from Miller, the Seventh Circuit determined that Section 301 of the LMRA preempts BIPA claims. Specifically, in Fernandez v. Kerry, Inc., 14 F.4th 644 (7th Cir. 2021), unionized employees filed a class action lawsuit claiming their employer violated BIPA by not obtaining their consent before requiring the employees to use their fingerprints to clock in and out of work. The court held a broad management rights clause in a CBA preempts BIPA claims since an arbitrator must decide “whether the employer properly obtained the union’s consent” to use the biometric timekeeping device. Id.

The Illinois Supreme Court adopted a similar view in Walton. The Court deferred to the Seventh Circuit’s decisions in Miller and Fernandez since the cases were not decided without “logic” or “reason.” The Court held, “when an employer invokes a broad management rights clause from a CBA in response to a [BIPA] claim brought by bargaining unit employees, there is an arguable claim for preemption.” Thus, whether the CBA’s management rights clause allowed Roosevelt University to utilize hand-scanning timekeeping software was a decision to be decided by an arbitrator.

Practical Implications for Unionized Employers

While, as a general matter, broad management rights clauses in CBAs benefit employers, this is now especially so where employers collect biometric information of unionized employees in Illinois. The Walton decision may allow unionized employers to avoid costly class-action litigation in court in favor of the private forum of arbitration.