Even as technology advances and consumers become more accustomed to providing their fingerprints in routine, everyday transactions (such as unlocking their cellular phones), private entities, and employers in particular, are under attack in the courts for their use of finger-scan and biometric technology.

The Illinois Biometric Information Privacy Act (“BIPA”), effective since October 2008, regulates the collection, use, safeguarding, handling, storage, retention, destruction, and disclosure of biometric identifiers and information. The BIPA, however, was largely ignored until mid-2015 when the first wave of BIPA litigation was filed against social media and photo-storage/sharing services.

BIPA litigation has now turned its attention to employers. Since August 2017, in Cook County, Illinois alone, more than 30 class action lawsuits have been filed in state court alleging violations of the BIPA, mostly based on employers’ use of finger-scan technology for timekeeping tracking. The recent lawsuits generally allege that employers have collected, stored, and/or used workers’ fingerprints without providing notice to workers or obtaining consent. They also allege that employers lack written policies establishing a retention and destruction schedule for workers’ biometric information or identifiers. It has not yet been determined whether such timekeeping practices violate the BIPA.

What is a biometric identifier? A “biometric identifier” under the BIPA is defined as:

  • A retina scan
  • An iris scan
  • A fingerprint
  • A voiceprint
  • A scan of hand geometry
  • A scan of face geometry

The BIPA expressly excludes the following from the definition of “biometric identifiers”: writing samples; written signatures; photographs; human biological samples used