Old Dominion’s Biometric Waiver Offers Creative Legal Tactic

Old Dominion Freight Line Inc.‘s $500 offer to employees if they agree not to sue over biometric privacy rights marks the latest creative strategy to ward off litigation following a landmark Illinois Supreme Court ruling.

The transport company faces a federal lawsuit over alleged violations of the Illinois Biometric Information Privacy Act (BIPA). Managers distributed a one-page waiver for employees to voluntarily sign, which would release the company from the statute’s obligations—days before the lawsuit was filed.

Companies are increasingly exposed to BIPA liability risks in Illinois following the state Supreme Court’s Cothron v. White Castle decision, which expanded the potential for huge damages awards under BIPA. The waiver is seen as a legal attempt to mitigate that exposure.

“Illinois law is pretty favorable in terms of allowing releases and upholding their validity, but there’s an exception to the rule for willful or wanton conduct,” David Oberly, a senior associate at Squire Patton Boggs LLP who specializes in biometric privacy issues, said in an interview.

Because no case law currently exists on retroactive BIPA exemption waivers, whether the strategy succeeds is an open question, he said.

The release offers employees $500 if they voluntarily agree not to sue the company and its affiliates from all claims that "(1) arise under the BIPA or (ii) are otherwise associated with any alleged biometric identifiers or biometric information collected, captured, used, stored, disclosed, disseminated, transmitted, or otherwise obtain by OD.”

Company managers began distributing the release, which would apply retroactively to alleged violations, around April 3, James Vlahakis of Vlahakis Law Group LLC who is involved in the federal litigation, said in an interview.

Old Dominion didn’t immediately respond to a request for comment.

Soliciting Waivers

Under BIPA, companies must maintain a biometric information retention and destruction policy, notify employees their biometric information is being collected or stored, the reasons for the collection, and the length of time the company will collect, store, and use the information.

In White Castle, the state Supreme Court ruled that claims under BIPA accrue every time a violation occurs, not just the first time the company collects biometric data. Defense lawyers said the decision could lead to exceedingly high awards in instances where BIPA violations occurred.

Privacy lawyers said releases such as the one used by Old Dominion aren’t uncommon and could help reduce BIPA litigation exposure.

“This is a successful strategy many companies have employed over the years to mitigate potential exposure under BIPA, and one that does not mean they violated BIPA,” Mary Smigielski, Lewis Brisbois Bisgaard & Smith LLP partner and co-chair of her firm’s Illinois BIPA practice group, said in an email.

She said another strategy is to implement a biometric policy regardless of whether biometric technology is used or covered by BIPA to avoid being a target for a class action.

But some lawyers said the releases may not prevent employees from joining class actions. They could instead encourage employees to reach out to lawyers, which in turn could trigger more lawsuits, Oberly said.

An April 7 amended complaint against Old Dominion alleges the company requires employees to use a time clock that records and stores their biometric data in violation of BIPA. More than 100 people may eventually become class members, according to the complaint.

Vlahakis, on behalf of his client John Kararo, filed the amended complaint in the US District Court for the Northern District of Illinois after Old Dominion began soliciting the retroactive waivers, he said.

The release states: “You have seven (7) calendar days to consider this RELEASE, and you may consult an attorney if you wish. In signing, you further agree that OD is not admitting to any wrongdoing with respect to its time clocks or timekeeping system, or any violation of the BIPA or any other law.”

Illinois was the first state to enact a biometric data privacy law, which also provides a private right of action for recovering damages for statutory violations.