Illinois appeals court holds that BIPA Section 15(a) requires retention-and-destruction policies upon possession of any biometric data

On Wednesday, November 30th, an Illinois state appeals court held that the Illinois Biometric Information Privacy Act (BIPA) requires private entities to develop retention-and-destruction schedules upon possession of biometric data. Notably, the court held that it is not enough to develop such policies after collection.

In the case, Mora v. J&M Plating, Inc., 2022 IL App (2d) 210692, the Court reversed and remanded a trial court’s summary judgment in favor of the employer. The trial court had held that Section 15(a) of BIPA established no time limit by which a private entity must develop a retention-and-destruction schedule for biometric data. The appellate court disagreed. 

The language of Section 15(a) is as follows:

“A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with the private entity, whichever occurs first.” 

In this case, J&M Plating collected the lead plaintiff, Mora’s, fingerprints in 2014 for time entry purposes. In 2018, the company developed a retention-and-destruction policy in accordance with BIPA requirements. Three years later, the company terminated Mora, who brought suit under BIPA the next month seeking declaratory and injunctive relief as well as damages for J&M’s alleged violation of section 15(a) (among other alleged violations). Mora also alleged that J&M had violated Section 15(b) of BIPA, which requires full notice and consent prior to the collection of biometric data, but the trial court dismissed that claim as time-barred because more than five years had passed from the start of the collection in 2015 to the filing of the suit in 2021.

Litigation of the Section 15(a) claim proceeded forward. J&M eventually moved for summary judgment, arguing that the language of Section 15(a) does not establish a time limitation in relation to the initial collection of biometric data, but rather only requires a retention-and-destruction schedule to be made publicly available on the day the biometric data is no longer needed or the parties’ relationship has ended. The trial court agreed, finding that because J&M had established an acceptable retention-and-destruction policy prior to Mora’s termination and later complied with that policy, there was no harm to remedy. The appellate court read Section 15(a) differently, holding that BIPA imposes upon private entities the obligation to establish procedures to protect employees’ and customers’ biometric data during the entire period in which they hold that data. Thus, the court ruled that Section 15(a), consistent with the rest of the statutory scheme, requires that a retention-and-destruction policy to exist prior to any biometric data collection.

What this means for employers:

While Section 15(b)’s language clearly requires informed written consent prior to biometric data collection (subject to a five-year statute of limitations), Section 15(a) is silent on when retention-and-destruction policies must be publicly available when collection begins. Nonetheless, the court in Mora held that a company’s failure to develop and implement such retention-and-destruction policies prior to collection could lead to civil penalties under BIPA (which can be astronomical depending on the number of violations), regardless of how quickly a company makes its retention-and-destruction schedule publicly available after collecting that biometric data. Employers should note that the appellate court took a stronger stance than Mora, whose attorneys had only sought a ruling that retention-and-destruction policies must be developed within a reasonable time after collection. 

This will be an issue to watch moving forward. It can certainly be argued that the appeals court wrote a time requirement into Section 15(a) where no such requirement exists in the statutory language. Do not be surprised if this issue is appealed to the Illinois Supreme Court.  But, until then, employers should ensure that they establish their publicly available retention-and-destruction policy, along with the proper notice and informed consent,  prior to collecting any biometric data.

As BIPA judicial interpretations continue to advance, it is vital for employers to become and remain compliant with its requirements. Thompson Coburn LLP’s Labor and Employment team is vigilant in staying up to date on all developments. For any BIPA or work related questions and concerns, please contact Susan Lorenc, Ryan Gehbauer, Zoe Spector, or your Thompson Coburn attorney.