There is little dispute that the Illinois Biometric Information Protection Act (“BIPA”) is a unique privacy law to the extent that it creates a private cause of action for any failures to notify individuals before their biometric information is collected and stored. That is, BIPA potentially creates a liability regardless of whether there was a breach of private information. Further complicating matters is the fact that many data collectors that qualify as “financial institutions” or “local and state governments” are exempted from BIPA. A recent motion to dismiss filed by New Albertson’s, Inc. (“Albertson’s), a defendant named in a BIPA action, has put the constitutionality of this exemption for financial institutions and state governments at issue.
As with many employers in Illinois, Albertson’s was named as a defendant in a lawsuit based on alleged violations of BIPA. In a lawsuit entitled Bruhn v. New Albertson’s, Inc, Case No. 2018 CH 1737, filed in the Circuit Court of Cook County, Illinois, a class action plaintiff alleged he worked as a pharmacist at a Jewel-Osco store located in Elgin, Illinois. Plaintiff claims Jewel required him to provide a scan of his fingerprints on a biometric device in order to access the pharmacy’s computer system. Plaintiff further claims Jewel violated BIPA when it collected and stored his biometric information without providing the proper notification. On August 20, 2019, Albertson’s filed a motion to dismiss which will push Illinois courts to examine the constitutionality of BIPA.
As for a quick refresher on Illinois Constitutional law, the Illinois Constitution provides the following which is generally referred to as the “special legislation clause:”
The General Assembly shall pass no special or local law when a general law is or can be made applicable. Whether a general law is or can be made applicable shall be a matter for judicial determination.
In support of its motion to dismiss, Albertson’s analyzes the legislative intent behind BIPA and argues “[i]n short, the legislator felt BIPA was necessary to protect consumers’ biometric data, particularly connected with financial information.” And, while the legislature’s intent behind BIPA was to protect information by placing burdens on entities that collect and store biometric data, Albertson’s questions how that purpose is served when the statute does not include many entities that may qualify as a “financial institution or an affiliate of a financial institution” and contractors, subcontractors and agents of state or local governments. Based on these exclusions to BIPA, Albertson’s argues that BIPA violates the special legislation clause and, is therefore unconstitutional because “Broad Groups” of individuals are excluded from the statutory framework. In particular, Albertson’s claims BIPA’s exclusions for financial institutions and local governments give way to an unfair result that is unconstitutional.
In its brief, Albertson’s argues the question of whether a law violates the special legislation clause and is void includes the following two-step analysis: “…whether the statutory amendments discriminate in favor of a select group” and “if so, whether the classification created by the statutory amendments is arbitrary.” As for the exception of financial institutions, Albertson’s argues BIPA excludes essentially the entire financial industry. Albertson’s asserts the use of the term “financial institution” in BIPA could exclude a number of entities ranging from retailers that happen to issue credit cards to car dealerships and mortgage brokers and, therefore, BIPA is unconstitutional.
Albertson’s further asserts the BIPA exception for governments unconstitutionally “eliminates a wide swath of entities from the BIPA.” Albertson’s argues the exclusion for governmental entities is overly broad to the extent it exempts contractors, subcontractors and agents of state and local governments while they were working for the government. Consequently, the stated purpose of BIPA is not served with these exclusions.
Albertson’s claims BIPA’s impact, which excludes a potentially large number of entities from protecting the public’s biometric data, “constitutes special legislation in violation of the Illinois Constitution. Albertson’s argues it is entitled to have the action against it dismissed since “[a] general law could have been passed, and was in fact originally proposed to apply to both the government and financial institutions.”
Regardless of whether the court finds BIPA unconstitutional, Albertson’s still brings a valid point to light about the confusion BIPA causes for data collectors. For example, Albertson’s poses a hypothetical where a janitorial company providing services to a government building would not have to comply with BIPA while another janitorial service providing services to a private building would incur the costs to comply with BIPA. It will be interesting to see how the trial court, and most likely the Illinois appellate court, addresses this question.