Trouble on the Tracks - BNSF Railway Ordered to Pay $228 Million Under Illinois Biometric Information Privacy Act

The first case to go to trial under the Illinois Biometric Information Privacy Act (BIPA, or “the Act”), has ended in a $228 million judgment entered against the defendant company BNSF Railway. BIPA passed in 2008, and litigation over its provisions followed, as it is the strictest law of its kind in the United States.(1) The Act, in simple terms, allows an employer to collect, store, and use biometric information, like fingerprints, facial geometry, retina scans and the like.(2) However, a private entity attempting to do so must obtain informed, written consent from the person providing the information.(3)

Since the statute came into effect, various large companies have been subject to payouts for class actions. You may have heard about some of these suits. Facebook paid a $650 million settlement for “face templates”, TikTok paid a $93 million settlement for its facial recognition software, a court ordered Snapchat to pay $35 million to Illinois residents for lenses and filters, and this past September, a court ordered Google to pay $100 million for their “face grouping tool.”(4)

One of Lavelle Law’s articles “Illinois Supreme Court Ruling on Biometric Information Privacy Act Has Far Reaching Consequences” explained that in the 2019 case of Rosenbach v. Six Flags Entm’t Corp., the Illinois Supreme Court ruled that in order to state a claim under BIPA, a plaintiff does not need to allege actual harm. Instead, the “aggrieved party” under the Act is simply someone who can demonstrate a BIPA violation has occurred. In this example, the plaintiff filed suit on behalf of her minor child. Rosenbach widened the scope of who can bring BIPA claims, opening the door for even more litigation and settlements pursuant to the Act.

The newest BIPA case, Rogers v. BNSF Ry. Co. is novel in that it proceeded through a jury trial instead of the parties reaching an out of court settlement. In this federal lawsuit, a truck driver for a third-party company alleged that the BNSF required drivers to use fingerprints and related biometric information to be able to access railyards for pickups and drop-offs. The problem with this, the plaintiff alleged under BIPA, is that the railroad did not receive written consent before collecting and storing this biometric information. Additionally, the railroad did not disclose in writing its purpose in collecting and storing this data.(5)

Defendants BNSF Railway argued that because they had contracted through a third party to operate the equipment that collected Rogers’ fingerprints, they could not be held in violation of BIPA. They asserted this defense through a motion in limine the night before trial, moving to exclude any evidence suggesting liability under BIPA for the acts of any third parties, which the court rejected. The court found that vicarious liability could be asserted in BIPA claims, and allowed the case to proceed to trial.(6)

The jury deliberated for less than an hour before finding that the defendant BNSF violated BIPA, recklessly or intentionally, 45,600 times. The $228 million dollar verdict awarded the maximum penalty of $5000 per occurrence.(7)

What this litigation and judgment tells employers is that Illinois juries are upholding BIPA claims strictly and stringently, and courts are extending BIPA’s breadth even further to include vicarious liability with third-party data collection. Employers must therefore be mindful of obligations under BIPA, and if a business collects, stores or uses biometric information, how to make sure that they are doing so in a way that will not violate BIPA’s provisions. Please contact the author, MaryAllison Mahacek, at mmahacek@lavellelaw.com or one of our business law attorneys if your business uses biometric information or needs assistance in defending against a BIPA claim.

(1) Megan Hickey, ‘They have to tell you they’re going to collect it’: The Illinois biometric law companies violate, resulting in big settlements, CBS News (Sept. 30, 2022), https://www.cbsnews.com/chicago/news/they-have-to-tell-you-theyre-going-to-collect-it-the-illinois-biometric-law-companies-violate-resulting-in-big-settlements/.           

(2) Id. § 15.

(3) 740 ILCS 14/1 et seq.

(4) Hickey, supra note 1.

(5) Sarah Freishtat, BNSF loses first case to go to trial under Illinois’ biometrics privacy law, The Southern Illinoisan (Oct. 15, 2022), https://thesouthern.com/news/state-and-regional/bnsf-loses-first-case-to-go-to-trial-under-illinois-biometrics-privacy-law/article_18b0e56a-28dd-571c-90bd-ea11aebf0d95.html.

(6) BREAKING: Plaintiff Prevails In First BIPA Class Action Jury Trial, Nat’l L. Rev. (Oct. 12, 2022), https://www.natlawreview.com/article/breaking-plaintiff-prevails-first-bipa-class-action-jury-trial.

(7) CBS Chicago Team, Jury finds BNSF Railway guilty of violating Illinois Biometric Privacy Act, CBS Chicago (Oct. 12, 2022), https://www.cbsnews.com/chicago/news/jury-bnsf-railway-guilty-illinois-biometric-privacy-act/.