Illinois Third District Appellate Justice John Anderson
OTTAWA, ILLINOIS - A state appeals panel has ruled staffing agencies can’t be held liable in potentially costly biometric privacy lawsuits targeting the businesses who provide employment opportunities, saying the temp agencies don't control how the actual employers track their workers' hours on the job.
Araceli Salinas and Lorena Servin sought to certify a class action in their DuPage County lawsuit against Arthur Schuman Midwest, a cheese manufacturer in Elgin, along with Surestaff and Metrostaff, for alleged violations of the Illinois Biometric Information Privacy Act through fingerprint time clocks at the food plant.
The lawsuit is similar to thousands of others filed against employers under the BIPA law in the past decade, with potentially many millions of dollars at stake.
Enacted in 2008, the Illinois BIPA law was ostensibly designed to safeguard the so-called unique identifying biometric information of employees and customers, including their fingerprints, facial geometry and other unique physical characteristics. Lawmakers at the time said the measure was inspired by the collapse of the company known as Pay By Touch, which had been among those pioneering the ability of consumers to pay for goods and services using fingerprint scanners.
Since 2015, however, the BIPA law has been used by a growing cadre of trial lawyers to target businesses of all types and sizes with an onslaught of thousands of class action lawsuits filed in Cook County and other courts in Illinois, and now even in other states.
The overwhelming bulk of BIPA litigation, though, has taken aim employers in Illinois. Such lawsuits have accused them of violating the law by scanning workers' fingerprints, faces, voices and other biometric characteristics, without first obtaining written consent or providing notices about how that information might be stored, used, shared and destroyed, among other technical provisions in the law.
And as in all other BIPA suits, the plaintiffs in the Arthur Schuman litigation are asking the court to order the defendants to pay damages allowed under the law of $1,000-$5,000 per violation. When multiplied across hundreds of potential plaintiff workers, damages could quickly climb into the many millions of dollars.
When DuPage County Circuit Judge David Schwartz granted summary judgment to the staffing agencies, the workers challenged his ruling before the Illinois Third District Appellate Court. Justice John Anderson wrote the panel’s opinion, filed Jan. 30; Justices Joseph Hettel and William Holdridge concurred.
According to Anderson, Schuman hired Paycom Payroll to install the clocks. The workers said they never provided consent for their fingerprints to be logged and also alleged they didn’t receive the required notice about data use and retention. He said the workers’ third amended complaint alleged “Schuman was the exclusive possessor of the biometric time clocks under its lease with Paycom;” that Shuman decided to install and had exclusive authority to require employees to use the clocks; and that neither Paycom, Surestaff nor Metrostaff could mandate use of the technology.
The complaint further alleged Schuman transferred the contested data to cloud-based Paycom servers and also said the staffing agencies bore liability for enrolling workers in the system, then teaching them how to use the clocks and monitoring their hours. In arguing for summary judgment, the staffing agencies said they couldn’t access or control the time clock data beyond “limited administrative access to enroll and correct employees’ time records,” Anderson wrote.
Judge Schwartz initially denied the workers’ request for additional discovery, saying it wasn’t necessary to determine whether the agencies obtained clock data. Then in January 2025, he granted the summary judgment motion. That April, he granted their request for an Illinois Supreme Court rule finding. He also has denied Schuman’s motion to dismiss the complaint, and it remains pending in DuPage County where limited discovery proceeds.
The workers asked the appellate panel to reverse the denial of their discovery request as well as the summary judgment.
“The Illinois Supreme Court has analyzed what it means to collect, capture, or obtain biometric information,” Anderson wrote, pointing to the state high court's 2023 opinion in Cothron v. White Castle. Under that analysis, he said, neither the complaint nor unrebutted affidavits demonstrate the agencies controlled or possessed any protected biometric data.
The workers advanced a liability theory under their chosen BIPA section insisting “the staffing agencies need not obtain possession of the biometric data by being able to access or control the use of the data,” Anderson wrote. “Rather, they contend it is enough that their acts facilitated or acted as a conduit relative to data collection. We reject this rationale.”
The panel said the theory stretches the BIPA section “beyond its text” and noted other courts have already “rejected similar arguments where a party played a passive or ministerial role in connection with the use of biometric identifying devices.” Among those instances were finding Apple and Samsung couldn’t access face or fingerprint data stored on users’ mobile devices.
“There might be circumstances where a conduit theory might be persuasive, such as if one of the entities in this case controlled another,” Anderson said. “We do not reach that question, as plaintiffs make no allegations that the staffing agencies and Schuman are corporately related, vicariously liable or joint employers.”
After finding Judge Schwartz correctly granted summary judgment, the panel examined whether he rightly denied the discovery request. It found he did, with Anderson writing the agencies’ motion offered proof to affirmatively disprove the workers’ allegations of collecting, capturing or obtaining protected data.
“Plaintiffs based their claims not on allegations of actual collection or possession of data, but, rather, on the ministerial implementation of the time clock system,” Anderson wrote. “Plaintiffs admitted in their arguments that Schuman (and not the staffing agencies) possessed the data and could access or control its use. Further, to the extent more discovery was requested by plaintiffs, it was not requested on the issue of direct access and control of the data. Rather, the discovery sought mainly involved whether the staffing agencies implemented or required the use of the time clock — actions that we conclude are not tantamount to collecting or obtaining biometric data.”
Plaintiffs have been represented in the action by attorneys Roberto Luis Costales and William H. Beaumont, of Beaumont Costales LLC, of Chicago.
The staffing agencies have been represented by attorneys Joseph T. Charron Jr., of Baker & McKenzie LLP, and Peter J. Gillespie and Samantha Damewood, of Laner Muchin, both of Chicago.
Jonathan Bilyk contributed to this report.
