Stemming the Rising Tide of Biometric Privacy Class Actions
For the better part of a year, companies across all industries have seen a torrent of putative class actions filed under the Illinois Biometric Information Privacy Act.
This should come as no surprise; major decisions issued by the Illinois Supreme Court and the U.S. Court of Appeals for the Ninth Circuit — which significantly reduced the burden for plaintiffs to state actionable BIPA claims — have opened the floodgates. Combined with Facebook Inc. paying $550 million to end a major BIPA class action, companies can expect to see the tidal wave of BIPA filings to continue — if not increase — moving forward.
To date, defendants have had few defenses available to respond to alleged BIPA violations. Recently, however, a new defense has emerged as a potential game changer: preemption. And so far, it has received favorable treatment by the courts.
Two significant BIPA opinions demonstrate how a preemption defense can be utilized by corporate defendants to halt such claims in their tracks or, at a minimum, significantly limit the amount of damages.
Overview of the Illinois Biometric Information Privacy Act
Under BIPA, companies cannot collect or store biometric data without first providing notice, obtaining written consent, and making certain disclosures, including the development of a written biometrics privacy policy, to individuals or their “legally authorized representative.” Importantly, BIPA provides a private right of action for any person “aggrieved” by a violation thereof and permits recovery of statutory damages of $1,000 per negligent violation, or $5,000 if the violation is deemed intentional or reckless.
In January 2019, the Illinois Supreme Court in Rosenbach v. Six Flags Entertainment Corp.[1] held plaintiffs can pursue BIPA claims for mere technical violations of the statute, even where no actual harm or damage is sustained. And later in 2019, the Ninth Circuit in Patel v. Facebook Inc.[2] further expanded plaintiffs’ ability to pursue BIPA claims for “no harm” violations by holding any violation amounts to a violation of substantive privacy rights and, as such, constitutes a cognizable concrete injury-in-fact for Article III standing.
And if that was not enough, in early 2020 Facebook settled the Patel litigation for a staggering $550 million.
Combined, companies utilizing biometric data in connection with their business operations will continue to see a flurry of BIPA class action filings — carrying with them significant potential liability exposure — for the foreseeable future.
Seventh Circuit Finds BIPA Claims Preempted Under the Railway Labor Act
In Miller v. Southwest Airlines Co.,[3] the U.S. Court of Appeals for the Seventh Circuit directly addressed the preemptive impact of federal labor law in general, and the Railway Labor Act in particular, on claims asserted by union employees subject to a collective bargaining agreement alleging state-law violations of BIPA.
In Miller, union employees of United Airlines and Southwest Airlines sued their airline employers stemming from their use of biometric timekeeping systems.
On appeal, the Seventh Circuit held the union workers’ BIPA claims were completely preempted by the Railway Labor Act. In doing so, the court first noted BIPA allowed worker or their authorized agent to receive necessary notices and consent to the collection and use of biometric data. Applied to the airline workers’ claims, whether the unions did consent to such collection and use of their biometric data, or perhaps granted authority through a management-rights clause, was a question that was required to be answered by an adjustment board under the Railway Labor Act.
Miller reasoned that because the plaintiffs had asserted a right in common with all other employees dealing with a mandatory subject of collective bargaining, it was not possible, even in principle, to litigate a dispute about how the airlines acquired and used fingerprint data for its whole workforce without asking whether the union had consented on its employees’ collective behalf. As such, the BIPA claims were preempted by federal labor law, and were required to be resolved by an adjustment board — not a judge — pursuant to the Railway Labor Act.
In addition to holding that the airline employees’ BIPA claims were preempted, Miller also found that, as a preliminary matter, the BIPA lawsuits themselves had been properly removed to federal court under U.S. Code Title 28 Section 1331.
Here, the court highlighted the fact that if a dispute necessarily entails the interpretation or administration of a collective bargaining agreement, there is no room for employees to sue under state law — in other words, state law is preempted to the extent a state has tried to overrule the union’s choices on behalf of the workers. And where it is impossible to litigate under a state statute without examining what the union knew and agreed to, a defendant is entitled to remove a suit to federal court under federal-question jurisdiction, Section 1331.
Finally, the court also highlighted the fact that as unionized employees resolution of the plaintiffs’ BIPA claims presented the prospect of a material change in workers’ terms and conditions of employment, which represented a sufficiently “concrete” injury to establish Article III standing, thus eliminating the plaintiffs’ ability to seek remand of the case back to state court.
Ultimately, based on preemption of the plaintiffs’ claims by the Railway Labor Act, Miller held it lacked subject matter jurisdiction over both lawsuits, thus mandating their dismissal.
Illinois Federal Court Extends Preemption Defense to Labor Relations Management Act
More recently, in Peatry v. Bimbo Bakeries USA, Inc.[4] the U.S. District Court for the Northern District of Illinois extended the scope of the preemption defense to claims implicating Section 301 of the Labor Management Relations Act.
In Peatry, an employee of Bimbo Bakeries filed a putative class action against the bakery alleging violations of BIPA arising from its biometric timekeeping practices. Peatry worked for the company from September 2016 to February 2019 — and was covered by a collective bargaining agreement from May 2018 through her employment end date. The bakery moved to dismiss Peatry’s lawsuit, arguing the Labor Management Relations Act and the National Labor Relations Act preempted her claims.
The district court agreed with the bakery on its Labor Management Relations Act preemption claim, holding that Section 301 preempted the plaintiff’s claims during the period over which a collective bargaining agreement governing the plaintiff’s employment was in effect.
Section 301(a) of the Labor Management Relations Act preempts claims founded directly on rights created by collective bargaining agreements — a well as claims substantially dependent upon the analysis of a CBA. So, if the resolution of a state law claim depends on the meaning of, or requires interpretation of, a CBA, then the application of state law is preempted, and federal labor law principles must be employed to resolve the dispute. If a claim is preempted, the Labor Management Relations Act requires employees to exhaust grievance and arbitration remedies provided in the CBA before filing suit.
According to Peatry, Miller governed the court’s resolution of the preemption question because the Railway Labor Act preemption standard is “virtually identical to the preemption standard the Court employs in cases involving § 301 of the LMRA.” Consequently, under Miller, Peatry’s claims required interpretation of the CBA governing the bakery workers’ employment — such that Section 301 preempted Peatry’s claims during the period the CBA was in effect.
The Peatry court rejected the bakery’s National Labor Relations Act preemption claim, however, finding that Peatry’s claims did not interfere with an attempt to regulate an aspect of labor relations, and that there was no incompatibility between BIPA and the National Labor Relations Act’s concerns with respect to establishing an equitable process for determining the terms and conditions of employment.
Ultimately, because Section 301 of the Labor Management Relations Act preempted the BIPA claims at issue, and because Peatry did not properly exhaust her administrative remedies before filing suit, the court dismissed the BIPA claims that were covered by the CBA for lack of subject matter jurisdiction.
Takeaways
The Miller and Peatry decisions offer key insight into the scope of the preemption defense — especially as it relates to Section 301 of the Labor Management Relations Act — and provides BIPA litigants with a vital defense strategy for defeating BIPA actions in state and federal court.
Significantly, Miller and Peatry illustrate that companies defending suits alleging mere procedural or technical BIPA violations can defeat these actions at an early stage in the litigation — likely by a Rule 12(b)(3) motion to dismiss for lack of subject matter jurisdiction or Rule 12(c) motion for judgment on the pleadings — by demonstrating that resolution of the plaintiff’s BIPA claims require interpretation of a CBA, namely with respect to whether the plaintiff’s union consented to the collection and use of biometric data on its employees’ behalf, such that the claims are preempted by the Labor Management Relations Act.
Further, as indicated in Miller, where an employer’s workforce is unionized the issue of preemption can also be used as a vehicle to remove BIPA suits to federal court, as matters requiring the interpretation of a CBA are sufficient to trigger federal-question jurisdiction under U.S. Code Title 28 Section 1331.
As also noted in Miller, where unionized workers bring suit for alleged violations of BIPA, the claims of this particular class of litigants necessarily involve the prospect of a material change in their working conditions, which gives these suits a concrete dimension sufficient to establish Article III standing, thus preventing employees from having their actions remanded back to state court.
Lastly, from a compliance perspective, unionized companies that incorporate biometric data into their operations can utilize the analysis seen in Miller and Peatry as a template for minimizing the risk of being on the receiving end of a BIPA class action. To do so, companies should first ensure that they inform union representatives of any intent to implement biometrics systems into their operations.
More importantly, employers should also make sure to directly address BIPA — and, in particular, the ability to collect and use workers’ biometric data for business purposes — during the collective bargaining negotiation process to maximize the likelihood any future disputes arising under BIPA are required to be resolved through mandatory arbitration, rather than class action litigation.
“Stemming the Rising Tide of Biometric Privacy Class Actions,” by Jeffrey N. Rosenthal and David J. Oberly was published in Law360 on April 22, 2020.
[1] Rosenbach v. Six Flags Entertainment Corp., 129 N.E.3d 1197 (Ill. 2019).
[2] Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019), cert. denied, No. 19-706, 2020 WL 283288 (U.S. Jan. 21, 2020).
[3] Miller v. Southwest Airlines Co., 926 F.3d 898, 901 (7th Cir. 2019).
[4] Peatry v. Bimbo Bakeries USA, Inc., No. 1:19-cv-02942 (N.D. Ill. Feb. 26, 2020).