On November 30, 2022, the Illinois Appellate Court for the Second District, in Mora v. J&M Plating, Inc., 2022 IL App (2d) 210692, overruled the trial court’s grant of summary judgment for a defendant employer relating to Section 15(a) of the Biometric Privacy Act which requires the existence of a “written schedule” relating to the retention-and-destruction of biometric information and that the schedule is published and complied with by the employer.
Section 15(a) is different than Section 15(b) in that it deals with the development of a retention-and-destruction schedule for biometric data, while 15(b) concerns the notice of, among other things, the “length of term for which [biometric data] is being collected, stored, and used.”
In this case the defendant employer developed its retention-and-development schedule after initially collecting the employee’s fingerprints. The initial collection of the fingerprints was in September 2014. The employer developed the retention-and-destruction schedule on May 22, 2018, nearly 4 year later. The employment of the plaintiff was terminated on January 7, 2021, and the fingerprint information was destroyed within 14 days thereafter in compliance with the retention-and-destruction schedule.
The defendant argued Section 15(a) related to the timely destruction of biometric data, not the collection of data. The temporal component of section 15(a) according to defendant was self-evident and the statutory duty to develop a retention-and-destruction schedule was satisfied so long as the schedule existed on the day the biometric data possessed by the defendant was no longer needed or the parties’ relationship had ended.
The Appellate Court found otherwise. Section 15(a), according to the Appellate Court, could not be interpreted in isolation; but rather, needed to be viewed in relation to the entire statute including in relation to Section 15(b) which, unlike Section 15(a), specified that the collection could not occur “unless [the employer/private entity] first” provided notice of, among other things, the length of time for which the data would be stored. For this reason, the Appellate Court concluded that the duty to develop a schedule for the retention and destruction of biometric information necessarily required a retention-and-destruction schedule “at the moment” the biometric data was collected.
Here, the defendant employer began collecting plaintiff’s biometric data in September of 2014, and this triggered, according to the Court, its obligation under section 15(a) to develop a retention-and-destruction schedule. Defendant did not have a schedule in place until May 2018, or nearly four years later. Thus, it violated section 15(a), according to this Appellate Court.
The need for businesses to comply with BIPA’s strict requirements is vital to the avoidance of statutory damages. The best practice is having written policies regarding consent, collection, retention, and destruction of biometric identifiers and biometric information which comply with the statutory requirements.
For more information, please contact James Kenny at jkenny@airdowerwas.com or (312) 506-4470 or James Jansen at jjansen@airdowerwas.com or (312) 506-4484.