Labor & Employment Law Daily BIPA class claims advance against company that provides biometric timekeeping devices to employers
Friday, April 17, 2020

BIPA class claims advance against company that provides biometric timekeeping devices to employers

By Kathleen Kapusta, J.D.

The timekeeping systems provided by the company include biometric-based time clocks that require employees to use their biometric information to punch in and out of work.

Two employees who were required as a condition of their employment—one with a retail grocer and the other with a manufacturer—to scan their fingerprints using a timekeeping device provided by Kronos, a provider of HR management software and services, survived Kronos’ motion to dismiss their putative class action alleging violations of the Illinois Biometric Information Privacy Act (BIPA). After first finding the employees had standing to pursue their claims under Sections 15(b) and (d), the federal court in Illinois was unable to ascertain “with the requisite level of confidence” whether they had standing to pursue their 15(a) claim; thus, it directed the parties to submit supplemental briefing on that issue before ruling on Kronos’ motion to dismiss the Section 15(a) claim. The court also denied the company’s motion to strike the employees’ class allegations (Figueroa v. Kronos Inc., April 13, 2020, Feinerman, G.).

Both employees scanned their fingerprints on a Kronos biometric timekeeping device when clocking in and out of work and one did so when clocking in and out for lunch. Kronos stored their fingerprint data in its database but, they alleged, it never informed them of the purposes or length of time for which it was collecting, storing, using, or disseminating their data or about any biometric data retention policy it had developed or whether it would ever permanently delete their data. Nor, they claimed, did they ever receive or sign a release allowing it to collect, store, sue, or disseminate their biometric data, which it purportedly disseminated to other firms, including to firms hosting the data in data centers.

Bringing a putative class action against Kronos, the employees alleged violations of Sections 15(a), 15(b), and 15(d) of BIPA.

Standing. Although neither party raised a jurisdictional issue, the court found it “close enough to warrant discussion.” Citing Robertson v. Allied Solutions, LLC—in which the Seventh Circuit explained that a defendant’s “withholding information when a statute requires its publication” inflicts an “informational injury”—the court here noted that the failure to disclose information concerning a plaintiff’s statutory rights inflicts a concrete injury where the defendant fails entirely to make the disclosure, but not where the defendant only makes an incomplete or otherwise technically deficient disclosure. Further, in Crabtree v. Experian Information Solutions, Inc., the Seventh Circuit held that where the defendant’s violation of a statutory duty to disclose leads “to the deprivation of an opportunity [for the plaintiff], even if futile as a practical matter, [that] can be enough to establish a concrete injury.”

Under these principles, said the court, the employees had standing to pursue their claims under Sections 15(b) and (d) as they alleged that Kronos obtained their biometric data without informing them it was doing so or obtaining their consent in violation of Section 15(b) and that Kronos disclosed or otherwise disseminated their data to outside data hosts without informing them or obtaining their consent in violation of Section 15(d). With both claims, the court noted, they were denied an opportunity to withhold their consent to the collection or dissemination of their data and the denial of that opportunity was sufficiently concrete to confer standing.

Supplemental briefing required. As to their claim under Section 15(a), which requires private entities that possess biometric data to develop and publish a written policy that includes a retention schedule and destruction guidelines, the employees acknowledged that due to Kronos’ alleged violations of Sections 15(b) and (d), “most employees don’t know they are interacting with Kronos when they have their biometrics scanned by their employer’s Kronos devices, let alone providing it their biometric data,” and therefore would “have no reason to affirmatively seek out Kronos’ website and search for its biometric data policies.” Thus, the court observed, if they would never have sought out a Kronos policy it was unclear whether they suffered a concrete injury due to Kronos’ failure to develop and publish a policy. Accordingly, before addressing the motion to dismiss the Section 15(a) claim, the court directed the parties to submit supplemental briefing on this issue.

Section 15(b) claim. Turning to Kronos’ motion to dismiss, the court noted the employees alleged that when they enrolled in and used their employers’ timekeeping systems, Kronos obtained their biometric data without first informing them or obtaining from them a written release. “That,” said the court, “is a textbook violation of Section 15(b).” Rejecting Kronos’ contention that it could not be held liable because BIPA’s definition of written release expressly delegates notice and consent obligations to the employer when biometric data is collected in the employment context, the court found that “even putting aside whether Kronos was required to receive from Plaintiffs the written release mandated by Section 15(b)(3), Kronos still (allegedly) violated Sections 15(b)(1) and (b)(2) by not informing them that it was collecting or obtaining their biometric data, for what purposes, and for how long.”

Further, Kronos was still a private party that collected and obtained their data and thus it remained obligated to obtain a release from them as a condition of their employment. And even if it did not “actively collect” their data, as it argued, Section 15(b) “governs not only entities that ‘collect’ biometric data, but also those that ‘capture, purchase, receive through trade, or otherwise obtain’ such data.” And if Kronos “stored,” “used,” and “disclosed” their biometric data, as the employee’s alleged, it had to first “obtain” the data.

Nor does interpreting the term “obtain” in Section 15(b) render Section 15(a) superfluous. Section 15(a), observed the court, requires entities to develop and publish written policies regardless of whether they obtained biometric data before or after BIPA’s effective date, while Section 15(b) imposes notice and consent obligations only on those entities that come into possession of such data after BIPA’s effective date.

Section 15(d) claim. Turning to the employees’ Section 15(d) claim, in which they alleged that Kronos disseminated their biometric data to other firms that hosted the information in their data centers, and did not suggest that any of the specified exceptions permitted that dissemination, the court again found this “a textbook violation of Section 15(d).” While Kronos argued that Section 15(e) permits whatever dissemination of their data it may have done, the court pointed out that Section 15(e) only sets forth the means by which an entity must transmit biometric data when such transmission is otherwise allowed by the exceptions enumerated Section 15(d).

State of mind. Nor could Kronos prevail on its assertion that the employees did not plead any of the mental states required for statutory damages under BIPA. “While BIPA subjects defendants to a damage remedy only if there is negligence, recklessness, or willfulness, the cases have split as to whether a defendant’s mental state is a pleading requirement,” the court observed. Moreover, they alleged that as late as 2018 or 2019, Kronos continued to systematically collect and disseminate biometric data without complying with BIPA, which had been enacted a decade earlier, and this was sufficient to infer that Kronos acted negligently.

Class claims. Addressing Kronos’ challenges to the complaint’s class allegations, the court noted that the putative class includes some individuals pursuing separate lawsuits against their employers in which Kronos is either a defendant or a respondent in discovery. Rejecting Kronos’ contention that those other actions are superior venues for litigating the putative class claims asserted here, the court explained that those individuals could be excluded from any certified class if they continue to maintain those suits. Further, “the fact that Kronos is a respondent in discovery in suits brought by other putative class members does not bear on superiority, as Kronos cannot avoid class litigation for its own alleged BIPA violations merely because it has information relevant to suits against other defendants.” Nor was Kronos’ need to monitor other suits an issue here, said the court, noting that “Kronos and its able counsel undoubtedly have the bandwidth to defend this suit as a putative class action while, at the same time, monitoring other BIPA suits in which it is a defendant or a respondent in discovery.”

Predominance. Next Kronos argued that individualized question of fact concerning the various timekeeping practices of the putative class members’ various employers defeated predominance. But Kronos failed to explain how those questions affected its potential liability under BIPA and thus it forfeited any argument that they justified striking the class allegations. Further, it could be plausibly inferred from the complaint’s allegations that Kronos knows what biometric data it collected on which employees and for which employers. Even if pertinent, “the questions raised by Kronos are precisely the sort of fact-intensive issues that generally do not justify striking class allegations at the pleading stage.” And while, as Kronos pointed out, some putative class members may have consented in writing to obtaining their biometric data, it offered no evidence as to how many may have done so and thus there was no basis to conclude that a significant portion of the putative class had no viable claim.

Adequacy. As to Kronos’ assertion that the employees were inadequate class representatives because they will be distracted by litigating separate BIPA suits against their employers, they may “sell this putative class short in favor of their employer-specific suits,” and they will fail to vigorously litigate issues (like labor law preemption) not applicable to them, the court found that if “it turns out that Plaintiffs are not tending properly to this suit or that they are paying insufficient attention to issues that do not directly impact them,” it would have the opportunity to consider those matters at the class certification stage.

Interested in submitting an article?

Submit your information to us today!

Learn More

Labor & Employment Law Daily: Breaking legal news at your fingertips

Sign up today for your free trial to this daily reporting service created by attorneys, for attorneys. Stay up to date on labor and employment legal matters with same-day coverage of breaking news, court decisions, legislation, and regulatory activity with easy access through email or mobile app.