On October 12, 2022, a federal jury in Illinois delivered a verdict in favor of class action plaintiffs after finding that BNSF Railway, one of the largest freight railroad operators in North America, violated the Illinois Biometric Information Privacy Act (“BIPA”), in Illinois’ first BIPA trial. The class plaintiffs were awarded $228 million after the jury found that BNSF committed 45,600 “reckless or intentional violations” of BIPA.
The class action complaint was filed in 2019 in the Cook County Circuit Court by Richard Rogers, a truck driver who was required to scan his fingerprint for security purposes when visiting BNSF’s facilities, but the case was eventually removed by defendants to the US District Court for the Northern District of Illinois. Rogers claimed that BNSF violated BIPA when the company failed to provide him, and similarly situated truck drivers, with written disclosures describing the purpose for collecting and the duration of its use of the biometric data; failed to publicly provide any retention or destruction policies regarding the biometric data; and failed to obtain his informed written consent prior to collecting and storing his biometric data. Rogers also alleged that BNSF failed to obtain the informed consent prior to disseminating the biometric information to its technology vendors in violation of BIPA. In March 2022, the court certified a class of more than 44,000 plaintiffs which consists of “all individuals whose fingerprint information was registered using an Auto-Gate System at one of BNSF’s four Illinois facilities at any time between April 4, 2014 and January 25, 2020.”
One of BNSF’s primary arguments was that it should not be held responsible for the collection of biometric information by third-party contractor, Remprex, because BIPA does not impose liability for the acts of a third party. However, the court rejected this argument shortly before trial, finding that Illinois statutes incorporate the common law, which extends to third parties unless the statute is in some way “irreconcilable” with the common law. The court held that BIPA was not irreconcilable with Illinois common law and, even if it was, the “otherwise obtain” language in section 15(b) of BIPA was broad enough to cover instances where a third party collected data for or at the behest of a defendant. Section 15(b) states that “[n]o private entity may collect, capture, purchase, receive through trade, or otherwise obtain a persons or a customer’s biometric identified or biometric information” without proving notice to and obtaining written consent from that person.”
Jury verdict | Notification of Docket Entry | Notice of Removal of Complaint | Notice of Removal Exhibit A – Class Action Complaint |Memorandum Opinion and Order – class certification |Memorandum Opinion and Order – third parties