On October 12, 2017, Meijer, Inc. became the latest Illinois employer faced with a class action lawsuit over its use of employee fingerprints for tracking hours worked.

The lawsuit was filed in state court in Chicago and claims Meijer violated the Illinois 2008 Biometric Information Privacy Act, which requires businesses, including employers which maintain fingerprint or other biometric information databases, to adopt policies regarding collection and use of biometric information.

The Illinois law applies to "biometric information" derived from a "biometric identifier," such as a "retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." The Illinois law requires written notice to individuals whose information will be collected. The notice must state the purpose of the collection, and how long the information will be used or stored. The individual must consent to the collection in writing. The individuals' information must be protected in the same manner as other sensitive and confidential information. The business must have a publicly available written policy regarding how long it stores the data, plus rules regarding disposition of the information. Any person harmed by a violation of the law can sue for statutory damages.

The plaintiff in the Meijer case claimed that he and an undetermined number of his Meijer coworkers at any of the 24 Illinois Meijer stores were required to allow their fingerprints to be scanned into a company database without written permission and without explanation of how their fingerprints would be stored or disposed of. Employees were required to scan their fingerprints each time they clocked in or out of work. The lawsuit complains the lack of notice leaves employees with no way of protecting themselves against possible identity theft or against unauthorized tracking or use of their information. It seeks $5,000 or more per violation per person.

Dozens of Illinois employers have been sued for similar violations. Two other states, Texas (whose law is enforceable only through the attorney general) and Washington (whose law took effect on July 23, 2017), have similar laws. Several other states, including Michigan, have considered but not yet enacted a similar law. A bill substantially similar to the Illinois law at issue in the Meijer case was introduced in Michigan on September 27, 2017. The bill has not been acted upon. For now, Michigan employers who do business in Illinois, like Meijer, should make sure they are in compliance with the Illinois Biometric Information Privacy Act.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.