In Christopher Howe v. Speedway LLC, the U.S. District Court for the Northern District of Illinois issued an in-depth decision on multiple summary judgment issues addressing Illinois’ Biometric Information Privacy Act (BIPA) in the context of partial fingerprint scans. The case presents significant insights into the applicability of BIPA to modern workplace technology and the potential for class action exposure under Illinois’ strict biometric privacy laws.

The Background

Christopher Howe, a former Speedway employee, brought a class action lawsuit against Speedway LLC, alleging that the company violated BIPA by using finger-scanning timeclocks without proper notice or consent. Howe claimed that Speedway’s system, which required employees to clock in and out using partial fingerprint scans, violated BIPA’s provisions for the collection, retention, and use of biometric identifiers and information.

BIPA, one of the strictest biometric privacy laws in the United States, prohibits private entities from collecting, storing, or disclosing biometric data without informed consent. It provides a private right of action for individuals and imposes statutory damages of $1,000 for negligent violations and $5,000 for reckless or intentional violations.

The Court’s Analysis

• Biometric Identifiers: Do Partial Finger Scans Count?

A key issue was whether partial fingerprint scans collected by Speedway’s timeclocks fell under BIPA’s definition of “biometric identifiers.” Speedway argued that BIPA applies only to full fingerprints, as typically collected by law enforcement, and not partial scans.

The court rejected this narrow interpretation, ruling that the plain language of BIPA does not require a full fingerprint for protection. According to the court, the term “fingerprint,” as used in BIPA, includes any scan of the finger’s ridges that can be used to identify an individual. The court emphasized that the statute was intended to protect “unique personal features” used for identification purposes and that partial scans clearly fall within that scope.

• Biometric Information: Are the Templates Generated from Finger Scans Protected?

Speedway also contended that the alphanumeric templates generated from the finger scans did not qualify as “biometric information” under BIPA. The company argued that the templates lacked sufficient detail to uniquely identify individuals.

Again, the court disagreed. It ruled that the templates, which are created based on the unique features of employees’ finger scans, are biometric information because they are derived from biometric identifiers. Since these templates were used to identify specific employees as they clocked in and out, they are clearly covered by BIPA’s definition of biometric information.

• Possession and Collection: Does Speedway “Collect” Biometric Data?

Speedway further argued that because the scanned fingerprint images were immediately discarded after being used to generate the templates, the company did not “collect” or “possess” biometric data as required by BIPA.

The court found this argument unconvincing, ruling that Speedway’s retention of the templates, even after discarding the images, meant the company was still in possession of biometric information. The court looked at the “or otherwise obtain” language in the BIPA statute to determine that even retaining partial finger scans for less than half a second before being discarded “are nonetheless gain[ing] or attain[ing]” biometric information which aligns with the Merriam-Webster definition of “obtain.” The retention and use of these templates for employee identification purposes triggered BIPA’s requirements for notice, consent, and data retention policies.

• Negligence and Recklessness: A Jury Issue

One of the most notable aspects of the decision is the court’s handling of the damages issue. BIPA provides for statutory damages based on the degree of fault: $1,000 per negligent violation and $5,000 per reckless or intentional violation. Speedway sought summary judgment, arguing that its conduct, at worst, was negligent and did not rise to the level of recklessness or intent required for higher damages.

The court denied Speedway’s motion on this issue, ruling that whether Speedway acted negligently, recklessly, or intentionally was a factual question for the jury. The court held that there were genuine disputes regarding the company’s awareness of BIPA’s requirements and its compliance efforts, making the issue of damages inappropriate for summary judgment.

Key Takeaways

The Howe decision highlights several important developments in Illinois BIPA litigation:

• Broad Interpretation of Biometric Identifiers: Even partial fingerprint scans are considered biometric identifiers under BIPA, expanding the scope of the law to cover various types of biometric data collection. Companies should be aware of this decision and how it may impact decisions on other technology used for safety such as cameras.
• Templates as Biometric Information: Alphanumeric codes or templates derived from biometric scans could be considered biometric information, meaning companies using such data must comply with BIPA’s notice and consent provisions.
• Negligence vs. Recklessness: The degree of fault in BIPA violations—whether negligent or reckless—is a factual issue that cannot be resolved at summary judgment, increasing the likelihood of cases going to trial.

As companies continue to adopt biometric technologies in the workplace, Howe v. Speedway serves as a reminder that Illinois courts are interpreting BIPA broadly. Businesses that use any form of biometric data collection, including partial scans, must ensure strict compliance with BIPA’s consent and data handling requirements or risk significant exposure to class action liability.

Scopelitis has a robust Workplace and Data Privacy Practice that is familiar with drafting privacy-related policies and defending individual and class action litigation involving privacy issues. If you have questions about BIPA or any other privacy-related matter, please contact Chip Andrewscavage, Andy Butcher, Jared Kramer, Matt Payne, or Dylan Goetsch.