Kronos Gets Privacy Claims Pared Back in Biometric Class Suit (1)

Kronos Inc. won dismissal of claims in a senior living facility employee’s proposed class suit alleging it violated the Illinois Biometric Information Privacy Act, the Northern District of Illinois ruled.

Plaintiff Aisha Namuwonge failed to state viable claims that Kronos ran afoul of the law’s restrictions on disclosure and collection of biometric information, the U.S. District Court for the Northern District of Illinois said. But she may pursue claims that Kronos violated BIPA’s data-retention policy requirements, Judge Sharon Coleman ruled Nov 22.

The decision shows that pursuing cases against time-keeping companies is a challenge if the firms possessed, rather than collected, the biometric information, privacy attorneys said.

Companies in Illinois are facing suits under BIPA on a variety of fronts. Many of these cases are employees suing their employers for collecting biometric identifiers without informed consent. Some are against tech companies that process the biometric data, and others against third parties that provide biometric timekeeping services.

“Plaintiffs will have a tougher time going after time management companies because compliance by those companies is relatively straight forward,” Phillip Schreiber, a abor and privacy partner at Holland & Knight LLP in Chicago, said. That’s because a third party that possesses, rather than collects, biometric data “will comply with BIPA merely by having the required policy,” he said.

Namuwonge works for Brookdale Senior Living Inc., which uses a Kronos fingerprint scanning system to keep track of employee time.

She alleged Brookdale failed to inform employees that it disclosed employee fingerprint data to Kronos. She also alleged Kronos didn’t inform Brookdale workers that it disclosed their fingerprints to other third parties and failed to provide them with a written retention policy and guidelines for destroying biometric data.

Namuwonge adequately alleged Kronos “possessed” the fingerprint data collected by Brookdale, as required by the statute, Coleman wrote. The plaintiff pleaded a viable claim that Kronos failed to develop a BIPA-compliant retention schedule, she wrote.

But Namuwonge didn’t plead a viable claim that Kronos disclosed her data to a third party, Coleman wrote.

She alleged Brookdale failed to inform her it disclosed fingerprint data to Kronos, but didn’t allege any other specifics related to disclosure or distribution by Kronos, the judge wrote.

The court also dismissed Namuwonge’s claim under a BIPA section that requires private entities that “collect” a person’s biometric data to inform the subject in writing. There is a difference between “possessing” and “collecting” biometric information, Coleman wrote.

Namuwonge’s allegations make clear that Brookdale collected the fingerprints using a system that Kronos supplied, not that Kronos collected them, Coleman wrote.

Big Fine Risk Limited

Kronos also convinced the court to dismiss the plaintiffs’ request for damages based on reckless or intentional violations.

Namuwonge failed to allege “substantive details” that time keeping management company Kronos’s actions were reckless or intentional violations of BIPA, Coleman wrote.

The ruling gives a boost to the defense bar because it limits the amount of money third-party vendors like Kronos would have to pay if a court found it had violated BIPA. Under the Illinois biometric privacy law, companies can be fined up to $5,000 for each intentional or reckless violation. Fines of $1,000 per violation are reserved for lesser violations.

The court gave leverage to defendants in settlements or mediation because it will “force the plaintiff to do more than just plead what the statute” says about reckless or intentional violations, Sean Wieber, litigation partner at Winston & Strawn LLP in Chicago, said. The decision shifts the pendulum back to plaintiffs to show why they should be able to get “five times the damages,” he said.

The plaintiffs’ bar is also watching how courts rule on damages claims.

“Whether a defendant acted recklessly or willfully is a large issue as the statutory damages move from $1,000 to $5,000,” Jay Edelson, founder of Edelson PC, said. There are likely to be “some huge fights in the coming months over what the proper standard is and how it is applied in different cases.”

Brookdale was voluntarily dismissed from the suit in May, according to the docket.

Representatives for Kronos didn’t immediately comment, nor did representatives for Namuwonge.

Stephan Zouras LLP represented the plaintiffs. Shook, Hardy & Bacon LLP represented Kronos.

The case is Namuwonge v. Kronos, Inc., 2019 BL 452484, N.D. Ill., No. 1:19-cv-03239, 11/22/19.