IE 11 Not Supported

For optimal browsing, we recommend Chrome, Firefox or Safari browsers.

Biometric Employee Tracking at Heart of Illinois Lawsuit

An ex-employee of Danville-based Thyssenkrupp Crankshaft has filed a potential class-action lawsuit against the company for its use of fingerprint technology to track when personnel clocked in and out of work.

(TNS) — A Danville manufacturer is one of the latest of many Illinois companies facing class-action lawsuits alleging privacy-law violations regarding use of fingerprint scanners to clock workers in and out of their shifts.

Like other employees at Thyssenkrupp Crankshaft, former employee Brenda Wickens scanned her fingerprint each time she clocked in and out of her job at the local plant at 1000 Lynch Road, Danville. The plant is a subsidiary of Thyssenkrupp AG, a German multinational conglomerate that focuses on engineering and steel production.

The potential class-action lawsuit was filed Sept. 11 in U.S. Northern District Court on behalf of Wickens and alleges the company violated Illinois privacy laws by failing to properly inform her of the purpose for using her fingerprint, the length of time it would be stored, how it would be permanently destroyed and failing to get her written consent to use her fingerprint.

In a separate issue, the lawsuit also alleges that the company failed to pay proper overtime wages to other employees and Wickens, whose employment ended this year.

Attorney David Fish of Naperville, who’s representing Wickens, said employers use the fingerprint scanners to save labor costs, for example, by eliminating “buddy punching” in a traditional time-card system when a co-worker punches in a fellow co-worker who might be absent or late for a shift.

State law doesn’t prohibit companies from using this fingerprint-scanning technology, Fish said, it just requires them to keep their employees informed. And a lot of employers are using the system but not complying with the law, he added.

“We hear from employees every week,” he said. “It’s an easy law to comply with. And it empowers workers to make a decision on whether they want to share information or not.”

In 2008, Illinois was the first to pass privacy laws regarding biometric information — fingerprints, iris and retina scans, voiceprints or scans of hand and face geometry — in response to a 2007 bankruptcy filing of Pay By Touch, a company that provided retailers in the state with fingerprint scanners for consumer transactions.

Suddenly, millions of fingerprint records could be sold, distributed or shared through the bankruptcy proceedings.

Illinois’ Biometric Information Privacy Act requires employees or customers to be notified in writing why a company is gathering biometric information; written notification of the length of time the information will be stored and used; a schedule of and guidelines for permanently destroying the information; and the person’s written consent to gather and use biometric information.

Since late 2017, there’s been a wave of similar class-action lawsuits against Illinois companies — including United Airlines owner United Continental Holdings Inc. and Hilton Worldwide Holdings Inc. — for use of fingerprint scanners.

One case involving Six Flags Entertainment Corp. and a 14-year-old whose fingerprint was obtained for a season pass went before the Illinois Supreme Court, which decided early this year that an individual can file such lawsuits based solely on a technical violation of the law without alleging any harm, such as monetary damages from misuse of the biometric information.

Wickens’ attorneys with the Fish law firm in Naperville do not allege any misuse or breach of the fingerprints gathered from employees.

The complaint only alleges technical violations by Thysennkrupp, stating the company “has violated (and continues to violate)” the law's requirements of written notification and consent.

“This exposes employees to serious and irreversible privacy risks,” the complaint states. “For example, if a fingerprint database is hacked, breached, or otherwise exposed, employees have no means by which to prevent identity theft and unauthorized tracking.”

The lawsuit asks for an order declaring the company’s conduct violates the law, an order that the company stop unlawful practices and an award of liquidated damages.

Illinois law allows for “liquidated damages” of $1,000 for a negligent violation or $5,000 for an intentional or reckless violation, and attorneys’ fees and injunctive relief are also available.

©2019 The News-Gazette (Champaign, Ill.). Distributed by Tribune Content Agency, LLC.