2022 IL App (2d) 210692 No. 2-21-0692 Opinion filed November 30, 2022 ______________________________________________________________________________
IN THE
APPELLATE COURT OF ILLINOIS
SECOND DISTRICT ______________________________________________________________________________
TRINIDAD MORA, Individually and On ) Appeal from the Circuit Court Behalf of All Individuals Similarly Situated, ) of Winnebago County. ) Plaintiff-Appellant, ) ) v. ) No. 21-CH-22 ) J&M PLATING, INC., ) Honorable ) Donna R. Honzel, Defendant-Appellee. ) Judge, Presiding. ______________________________________________________________________________
JUSTICE JORGENSEN delivered the judgment of the court, with opinion. Presiding Justice Brennan and Justice Schostok concurred in the judgment and opinion.
OPINION
¶1 Plaintiff, Trinidad Mora, sued defendant, J&M Plating, Inc., asserting that defendant
violated the Biometric Information Privacy Act (Biometric Act) (740 ILCS 14/1 et seq. (West
2020)) by failing to establish a retention-and-destruction schedule for the possession of biometric
identifiers and biometric information (collectively, biometric data) until four years after it first
possessed plaintiff’s biometric data. 740 ILCS 14/15(a) (West 2020). The trial court granted
defendant’s motion for summary judgment (735 ILCS 5/2-1005(c) (West 2020)), finding that
section 15(a) of the Biometric Act established no time limits by which a private entity must
establish a retention-and-destruction schedule for biometric data. Plaintiff appeals. We reverse and
remand. 2022 IL App (2d) 210692
¶2 I. BACKGROUND
¶3 A. The Biometric Act
¶4 The Biometric Act, enacted in 2008, 1 regulates “ ‘the collection, use, safeguarding,
handling, storage, retention, and destruction of biometric identifiers and information.’ ”
Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, ¶ 19 (quoting 740 ILCS 14/5(g)
(West 2016)). The Biometric Act defines a “biometric identifier” as a “retina or iris scan,
fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10 (West 2020).
“Biometric information” means “any information, regardless of how it is captured, converted,
stored, or shared, based on an individual’s biometric identifier used to identify an individual.” Id.
The legislature, through the Biometric Act, “codified that individuals possess a right to privacy in
and control over their biometric identifiers and biometric information.” Rosenbach, 2019 IL
123186, ¶ 33.
¶5 Under the Biometric Act:
“any person ‘aggrieved’ by a violation of its provisions ‘shall have a right of action ***
against an offending party’ and ‘may recover for each violation’ the greater of liquidated
damages or actual damages, reasonable attorney fees and costs, and any other relief,
including an injunction, that the court deems appropriate.” Id. ¶ 1 (quoting 740 ILCS 14/20
(West 2016)).
¶6 The Biometric Act “vests in individuals and customers the right to control their biometric
information by requiring notice before collection and giving them the power to say no by
withholding consent.” Id. ¶ 34. Section 15 of the Biometric Act “imposes on private entities ***
1 The Biometric Act took effect upon becoming law. 740 ILCS 14/99 (West 2020).
-2- 2022 IL App (2d) 210692
various obligations regarding the collection, retention, disclosure, and destruction of” biometric
data. Id. ¶ 20. These obligations include the following.
¶7 Section 15(a) of the Biometric Act, which is at issue in this case, contains a requirement to
develop, publish, and comply with a retention-and-destruction schedule. It provides:
“A private entity in possession of biometric identifiers or biometric information must
develop a written policy, made available to the public, establishing a retention schedule
and guidelines for permanently destroying biometric identifiers and biometric information
when the initial purpose for collecting or obtaining such identifiers or information has been
satisfied or within 3 years of the individual’s last interaction with the private entity,
whichever occurs first. Absent a valid warrant or subpoena issued by a court of competent
jurisdiction, a private entity in possession of biometric identifiers or biometric information
must comply with its established retention schedule and destruction guidelines.” Id.
§ 15(a).
¶8 Section 15(b) contains the following notice requirement:
“(b) No private entity may collect, capture, purchase, receive through trade, or
otherwise obtain a person’s or a customer’s biometric identifier or biometric information,
unless it first:
(1) informs the subject or the subject’s legally authorized representative in
writing that a biometric identifier or biometric information is being collected or
stored;
(2) informs the subject or the subject’s legally authorized representative in
writing of the specific purpose and length of term for which a biometric identifier
or biometric information is being collected, stored, and used; and
-3- 2022 IL App (2d) 210692
(3) receives a written release executed by the subject of the biometric
identifier or biometric information or the subject’s legally authorized
representative.” 740 ILCS 14/15(b) (West 2020).
¶9 Section 15(c) prohibits profiting from a transaction involving a person’s or a customer’s
biometric data. Id. § 15(c) (“No private entity in possession of a biometric identifier or biometric
information may sell, lease, trade, or otherwise profit from a person’s or a customer’s biometric
identifier or biometric information.”). Section 15(d) prohibits the disclosure or redisclosure of a
person’s or customer’s biometric data, unless the subject consents or the disclosure is required in
certain circumstances. See id. § 15(d). Finally, section 15(e) requires a private entity in possession
of biometric data to store, transmit, and protect it (1) using the reasonable standard of care in its
industry and (2) in a manner as or more protective than the manner in which it stores, transmits,
and protects other confidential and sensitive information. See id. § 15(e).
¶ 10 These provisions are enforceable through private rights of action. Rosenbach, 2019 IL
123186, ¶ 21. Section 20 of the Biometric Act provides that “[a]ny person aggrieved by a violation
of this Act shall have a right of action in a State circuit court or as a supplemental claim in federal
district court against an offending party.” 740 ILCS 14/20 (West 2020). Section 20 further provides
that
“[a] prevailing party may recover for each violation:
(1) against a private entity that negligently violates a provision of this Act,
liquidated damages of $1,000 or actual damages, whichever is greater;
(2) against a private entity that intentionally or recklessly violates a
provision of this Act, liquidated damages of $5,000 or actual damages, whichever
is greater;
-4- 2022 IL App (2d) 210692
(3) reasonable attorneys’ fees and costs, including expert witness fees and
other litigation expenses; and
(4) other relief, including an injunction, as the State or federal court may
deem appropriate.” Id.
¶ 11 When a private entity fails to comply with one of section 15’s requirements, that violation
constitutes an invasion, impairment, or denial of the statutory rights of any person or customer
whose biometric data is subject to breach. Rosenbach, 2019 IL 123186, ¶ 33. “The violation, in
itself, is sufficient to support the individual’s or customer’s statutory cause of action.” Id. “Other
than the private right of action authorized in section 20 of [the Biometric Act], no other
enforcement mechanism is available.” Id. ¶ 37. The legislature has imposed safeguards to ensure
that privacy rights in biometric data “are properly protected before they can be compromised and
by subjecting private entities who fail to follow the statute’s requirements to substantial potential
liability (740 ILCS 14/20 (West 2016)) whether or not actual damages, beyond violation of the
law’s provisions, can be shown.” McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511,
¶ 48. Finally, the workers’ compensation statute’s exclusivity provision does not bar Biometric
Act claims. Id. ¶ 50 (“[b]ecause the injury alleged is not the type of injury compensable in a
workers’ compensation proceeding, [the plaintiff’s] lawsuit is not preempted by the exclusive-
remedy provisions of the [statute]”).
¶ 12 B. Plaintiff’s Complaint
¶ 13 Plaintiff began working for defendant on July 2, 2014, and began clocking into his job via
fingerprint scan in September 2014. In May 2018, defendant established a written retention-and-
-5- 2022 IL App (2d) 210692
destruction schedule for biometric data, and, on May 22, 2018, plaintiff signed defendant’s policy 2
and consented to the collection and use of his biometric data. Plaintiff’s employment was
terminated on January 7, 2021, and, pursuant to defendant’s retention-and-destruction schedule,
plaintiff’s biometric information was destroyed approximately two weeks after his termination.
¶ 14 On February 16, 2021, plaintiff filed a class-action complaint (735 ILCS 5/2-801 (West
2020)) 3 against defendant, alleging violations of sections 15(a) and 15(b) of the Biometric Act.
Plaintiff asserted that defendant required employees to “clock in” with their fingerprints and that
defendant collected, stored, and used employee fingerprints and associated personally identifying
information without first providing notice, obtaining informed consent, or, as relevant to this
appeal, publishing a data retention-and-destruction schedule.
¶ 15 In count I, plaintiff sought declaratory and injunctive relief and damages for defendant’s
alleged violation of section 15(a) (failure to institute, maintain, and adhere to publicly available
retention schedule). In count II, plaintiff sought damages for alleged violations of section 15(b)
(failure to obtain informed written consent and release before obtaining biometric data). Plaintiff
argued that defendant invaded his statutorily protected right to privacy in his biometric data, never
2 Defendant’s two-page policy, titled the “J&M PLATING BIOMETRIC INFORMATION
PRIVACY POLICY,” contains both its section 15(b) notice and its section 15(a) retention-and-
destruction schedule, the latter of which provides that “[a]n employee’s biometric information
will be destroyed upon termination of the employment relationship or if biometric information is
no longer needed.” 3 Plaintiff defined the class as “[a]ll individuals who had their fingerprints collected,
captured, received[,] or otherwise obtained and/or stored by [d]efendant in the state of Illinois.”
-6- 2022 IL App (2d) 210692
adequately informed him or the class of its biometric collection practices, never obtained the
requisite written consent from plaintiff or the class regarding plaintiff’s practices, and never
provided to them any retention-and-destruction schedule.
¶ 16 On April 28, 2021, defendant moved to dismiss plaintiff’s complaint (735 ILCS 5/2-
619(a)(5), (9) (West 2020)), asserting that it instituted a biometric information privacy policy,
plaintiff signed defendant’s policy, he consented to the collection and use of his biometric data,
his employment was terminated, and, pursuant to defendant’s written retention-and-destruction
schedule, his biometric data was destroyed upon his termination. Thus, count I was defeated
because plaintiff’s information was destroyed upon his termination, the statute of limitations
barred plaintiff’s section 15(b) claim (count II), and his claim was barred by the Workers’
Compensation Act (820 ILCS 305/1 et seq. (West 2020)). Defendant attached to its motion an
affidavit from Martina Schumaker, its chief financial officer. Schumaker averred that plaintiff was
defendant’s employee from July 2, 2014, through January 7, 2021. In September 2014, defendant
began utilizing a fingerprint scan system for timekeeping purposes and collected images of
employees’ fingerprints for such purposes that month. It developed and publicized its Biometric
Act policy in May 2018, which was published at in-person meetings on May 20 and 22, 2018. On
May 22, 2018, by signing a copy of the policy, plaintiff acknowledged receipt of the policy and
consented to defendant’s collection and use of his biometric data for timekeeping purposes.
Plaintiff’s last day of employment with defendant was January 7, 2021, and his biometric data that
was collected for timekeeping purposes was destroyed upon his termination.
¶ 17 On July 14, 2021, the trial court dismissed count II of plaintiff’s complaint, finding that the
cause of action under section 15(b) of the Biometric Act accrued in September 2014 and that a
five-year limitations period applied. Thus, the claim was time-barred. As to count I, the section
-7- 2022 IL App (2d) 210692
15(a) claim at issue in this appeal, the court denied defendant’s motion to dismiss. It determined
that defendant’s motion raised fact-based arguments properly resolved in a summary-judgment
motion.
¶ 18 C. Defendant’s Summary-Judgment Motion
¶ 19 On September 30, 2021, defendant moved for summary judgment on count I of plaintiff’s
complaint, arguing that plaintiff’s biometric data was destroyed two weeks after his last day of
work and, thus, he could not establish a violation of section 15(a) of the Biometric Act. It asserted
that section 15(a) did not have any timing language for the establishment of a retention-and-
destruction schedule and, therefore, it was of no import that defendant’s policy was not in place
before plaintiff’s biometric data was first obtained. Defendant attached an affidavit from Albert
Cloherty, “manager II-tech support” with ADP, Inc., defendant’s vendor. Cloherty averred that he
reviewed ADP’s records and that they reflected that any biometric information ADP possessed
relating to plaintiff that was generated by time clocks or time clock attachments during plaintiff’s
employment with defendant was destroyed on or about January 21, 2021.
¶ 20 Plaintiff responded that defendant waited nearly four years after it began possessing
biometric data to establish a retention-and-destruction schedule and that this did not comply with
the statute. Further, defendant’s retroactive compliance did not cure its earlier violations, because
plaintiff’s biometric data was already exposed to the harm the legislature sought to prevent.
Plaintiff argued that section 15(a) must be read to require an entity to establish a retention-and-
destruction schedule prior to possessing an individual’s biometric data. Alternatively, plaintiff
argued that defendant was required to establish a schedule the moment it first possessed plaintiff’s
biometric data, not years later.
-8- 2022 IL App (2d) 210692
¶ 21 The trial court granted defendant’s motion, finding that the statute contains no timing
language and “is written as if the private entity is already in possession of biometric identifiers and
information.” The court determined that defendant had a retention-and-destruction schedule,
obtained plaintiff’s consent, and plaintiff’s data was destroyed shortly after his employment was
terminated. Thus, “there’s no harm here. They ultimately did comply. There is no timing language
in the statute.” Plaintiff appeals.
¶ 22 II. ANALYSIS
¶ 23 Plaintiff argues that the trial court erred in granting defendant summary judgment on his
section 15(a) claim, because the Biometric Act required defendant to establish a retention-and-
destruction schedule for biometric data prior to its possession of such data, or, alternatively, at the
moment of possession or within a reasonable time thereafter. Defendant’s establishment of a
schedule four years after the fact (i.e., after defendant began collecting plaintiff’s biometric data),
plaintiff asserts, did not comply with the Biometric Act, and any contrary conclusion strips the
statute of any enforceability. For the following reasons, we agree that the trial court erred in
granting defendant summary judgment and conclude that the Biometric Act requires a private
entity such as defendant to develop a retention-and-destruction schedule upon possession of
biometric data. Defendant’s establishment of a retention-and-destruction schedule four years after
it first possessed such data for plaintiff violated section 15(a).
¶ 24 Preliminarily, we note that defendant argues that plaintiff’s statement of facts contains no
citations of the record on appeal and is argumentative, in violation of Illinois Supreme Court Rule
341(h)(6) (eff. Oct. 1, 2020). Rule 341(h)(6) requires an appellant’s brief to contain a “[s]tatement
of facts, which shall contain the facts necessary to an understanding of the case, stated accurately
and fairly without argument or comment, and with appropriate references to the pages of the record
-9- 2022 IL App (2d) 210692
on appeal.” Id. The rules of procedure regarding appellate briefs are not mere suggestions, and
when procedural violations interfere with our review of the issues on appeal, it is within our
discretion to, inter alia, strike the brief for failure to comply with the rules. See Parkway Bank &
Trust Co. v. Korzen, 2013 IL App (1st) 130380, ¶ 10. Nevertheless, where, as here, violations of
supreme court rules are not so flagrant as to hinder or preclude our review and where defendant
has provided a statement of facts, we will disregard any noncompliant statements in plaintiff’s
brief. See In re Marriage of Wendy S., 2020 IL App (1st) 191661, ¶ 15; see also Twardowski v.
Holiday Hospitality Franchising, Inc., 321 Ill. App. 3d 509, 511 (2001) (we may review an
otherwise insufficient appeal where “we understand the issue plaintiff intends to raise and
especially where the court has the benefit of a cogent brief of the other party”).
¶ 25 Turning to the merits, a trial court may grant summary judgment only “if the pleadings,
depositions, and admissions on file, together with the affidavits, if any, show that there is no
genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter
of law.” 735 ILCS 5/2-1005(c) (West 2020). The trial court considers the documents and exhibits
in the light most favorable to the nonmoving party. Home Insurance Co. v. Cincinnati Insurance
Co., 213 Ill. 2d 307, 315 (2004).
¶ 26 “Summary judgment is a drastic measure and should only be granted if the movant’s right
to judgment is clear and free from doubt.” Outboard Marine Corp. v. Liberty Mutual Insurance
Co., 154 Ill. 2d 90, 102 (1992). However, “[m]ere speculation, conjecture, or guess is insufficient
to withstand summary judgment.” Sorce v. Naperville Jeep Eagle, Inc., 309 Ill. App. 3d 313, 328
(1999). “ ‘The purpose of summary judgment is not to try an issue of fact but *** to determine
whether a triable issue of fact exists.’ ” Schrager v. North Community Bank, 328 Ill. App. 3d 696,
708 (2002) (quoting Luu v. Kim, 323 Ill. App. 3d 946, 952 (2001)).
- 10 - 2022 IL App (2d) 210692
¶ 27 The issue in this case involves a statutory construction question, which constitutes a
question of law and is thus appropriate for summary judgment. Hooker v. Retirement Board of the
Firemen’s Annuity & Benefit Fund, 2013 IL 114811, ¶ 15. We review de novo issues involving
statutory construction and summary-judgment rulings. Id.
¶ 28 “Our primary objective when construing a statute is to ascertain and give effect to the intent
of the legislature.” Eighner v. Tiernan, 2021 IL 126101, ¶ 19. “The most reliable indicator of
legislative intent is the plain and ordinary meaning of the statutory language.” Id. “When
construing statutory language, we view [a] statute in its entirety, construing words and phrases in
light of other relevant statutory provisions and not in isolation.” Id.
¶ 29 “When the statutory language is plain and unambiguous, we may not depart from the law’s
terms by reading into it exceptions, limitations, or conditions the legislature did not express, nor
may we add provisions not found in the law.” Rosenbach, 2019 IL 123186, ¶ 24. Nevertheless, in
construing a statute, a court may consider the reason for the law, the problems sought to be
remedied, the purposes to be achieved, and the consequences of construing the statute one way or
another. Hubble v. Bi-State Development Agency of the Illinois-Missouri Metropolitan District,
238 Ill. 2d 262, 268 (2010).
¶ 30 Plaintiff argues that section 15(a) of the Biometric Act reflects the legislature’s intent that
a retention-and-destruction schedule be established prior to the possession of biometric data (or,
alternatively, at the moment of possession or within a reasonable time thereafter). 4 Plaintiff notes
4 In Bernal v. ADP, LLC, No. 2017-CH-12364, 2019 WL 5028609 (Cir. Ct. Cook County,
Aug. 23, 2019), which plaintiff cites, the trial court granted the defendant biometric technology
provider’s motion to dismiss (735 ILCS 5/2-615 (West 2018)), without prejudice, the plaintiff
- 11 - 2022 IL App (2d) 210692
that the General Assembly stated that “[b]iometrics are unlike other unique identifiers that are used
to access finances and other sensitive information. *** Biometrics *** are biologically unique to
the individual; therefore, once compromised, the individual has no recourse, is at heightened risk
for identity theft, and is likely to withdraw from biometric-facilitated transactions.” 740 ILCS
14/5(c) (West 2020). Further, it stated that “[t]he full ramifications of biometric technology are
not fully known.” Id. § 15(f). Plaintiff contends that no other provision of the Biometric Act allows
for retroactive compliance and that allowing retroactive compliance with section 15(a) would
undermine the statute’s legislative purpose of empowering individuals with biometric privacy
rights before such rights are violated.
¶ 31 Plaintiff also asserts that it is not relevant whether an entity that did not have a retention-
and-destruction schedule in place upon the statute’s effective date would be in automatic violation
of the statute and be subject to statutory penalties for conduct that was not prohibited at the time it
took place. In plaintiff’s view, by 2014, when defendant first possessed plaintiff’s biometric data,
entities such as defendant had already had six years from the statute’s enactment to implement
employee’s section 15(a) Biometric Act claim. The plaintiff had alleged the defendant had not
established a policy prior to taking the plaintiff’s biometric data. The trial court found that section
15(a) does not explicitly require that the schedule exist prior to possession of the biometric data.
Bernal, 2019 WL 5028609, at *2. However, the court also determined that the plaintiff’s allegation
“does not exclude the possibility that [the] [d]efendant made available to the public an established
schedule and guidelines when, and not before, it was in possession of [the] Plaintiff’s biometric
information.” (Emphasis added.) Id. Thus, the complaint, the court determined, failed to state a
claim. Id.
- 12 - 2022 IL App (2d) 210692
procedures that would allow them to comply with the Biometric Act. By 2018, plaintiff notes,
when defendant did finally implement its schedule, an additional four years had elapsed for
defendant to comply. Thus, plaintiff reasons, even if entities had not been capable of immediate
compliance when the statute was enacted, waiting 6 or 10 years is an unreasonable time to attain
compliance.
¶ 32 Plaintiff also contends that allowing private entities unlimited time to comply with section
15(a), as the trial court did, would lead to absurd results and undermine both the enforceability of
the statute and the legislature’s objective of protecting biometric data from problems before they
occur. For example, plaintiff posits that a private entity could wait until a data breach has exposed
all biometric data before establishing a retention-and-destruction schedule and still comply with
section 15(a). Or, plaintiff suggests, a private entity could choose to never comply for decades, so
long as, when someone eventually brought up the deficiency, the private entity eventually
established a schedule. Plaintiff argues that common sense dictates that there is not an unlimited
time to comply with the statute and that such an understanding of section 15(a) would eliminate
the incentive for compliance with the statutory damages provision. See Rosenbach, 2019 IL
123186, ¶ 37 (“[t]o require individuals to wait until they have sustained some compensable injury
beyond violation of their statutory rights before they may seek recourse *** would be completely
antithetical to [the Biometric Act’s] preventative and deterrent purposes”).
¶ 33 Defendant responds that section 15(a) is concerned with the timely destruction of biometric
data when it is no longer needed and requires a private entity that possesses such data to have a
policy in place that ensures the data will be destroyed when the purpose for which it was collected
has ended or within three years after the parties’ last interaction, whichever occurs first. There is
no need, it asserts, for this court to rewrite the statute and provide a schedule or timetable within
- 13 - 2022 IL App (2d) 210692
which an entity must publish or adopt its schedule. The temporal component of section 15(a) is,
according to defendant, self-evident, and the statutory duty is satisfied so long as a schedule exists
on the day the biometric data possessed by a defendant is no longer needed or the parties’
relationship has ended. It argues that section 15(a)’s purpose is to ensure the data destruction
policy exists when either the data is no longer needed or the parties’ relationship has ended,
whichever occurs first, and not before the earlier of these occurrences. No other duty is imposed
by section 15(a), defendant contends. Defendant also argues that, had the legislature intended to
impose a duty to have a schedule in place before or at the moment an entity collects biometric data,
it could have easily written section 15(a) to say that such a schedule must be adopted prior to and
upon collecting the data (or within a reasonable time thereafter). It notes that, in contrast, section
15(b) contains a temporal requirement for compliance.
¶ 34 It is undisputed, defendant notes, that it had a policy in place when plaintiff’s relationship
with defendant ended, and plaintiff’s biometric data was destroyed within two weeks after his
employment with defendant ended. Defendant argues that section 15(b) of the Biometric Act,
which establishes a notice-and-consent requirement, grants a person like plaintiff the ability to
make an informed decision about whether to disclose his or her biometric data. Thus, the interest
served is a person’s right to control his or her private data. Plaintiff’s argument that he was entitled
to know how long defendant would store his data was the subject of his section 15(b) claim, which
was dismissed with prejudice and from which plaintiff did not appeal. Defendant contends that
plaintiff cannot resurrect his dismissed claim by bootstrapping section 15(b) protections to a
section 15(a) claim.
¶ 35 Defendant also argues that the Biometric Act’s organizational structure regulates different
steps in the process as they occur, with section 15(b) addressing the initial collection of data.
- 14 - 2022 IL App (2d) 210692
Storage and use are governed by sections 15(c), 15(d), and 15(e), and retention and destruction are
governed by section 15(a). Viewed as a whole, defendant asserts, the duty imposed by section
15(a) is plainly tied to when either the data is no longer needed or the parties’ relationship has
ended.
¶ 36 Defendant disagrees with plaintiff’s argument that, under the trial court’s reasoning, a suit
could not be brought until an injury has resulted from a defendant’s failure to have a schedule in
place and that this defeats the statute’s preventative and deterrent purposes. Defendant contends
that this is a strawman argument that we need not reach here, because defendant had a schedule in
place when the circumstances contemplated by section 15(a) arose. Further, defendant notes that
there is no evidence that plaintiff’s data was ever compromised due to the absence of a policy.
Plaintiff’s fear, it suggests, is entirely hypothetical. Defendant also maintains that plaintiff’s
argument transforms the Biometric Act, which is a fault-based statute, into a strict liability regime
under which liability would attach as soon as a defendant came into possession of biometric data.
The statutory language, it argues, does not support such a construction.
¶ 37 We conclude that the trial court erred in granting defendant summary judgment. Section
15(a) of the Biometric Act provides:
“A private entity in possession of biometric identifiers or biometric information must
develop a written policy, made available to the public, establishing a retention schedule
and guidelines for permanently destroying biometric identifiers and biometric information
when the initial purpose for collecting or obtaining such identifiers or information has been
satisfied or within 3 years of the individual’s last interaction with the private entity,
whichever occurs first. Absent a valid warrant or subpoena issued by a court of competent
jurisdiction, a private entity in possession of biometric identifiers or biometric information
- 15 - 2022 IL App (2d) 210692
must comply with its established retention schedule and destruction guidelines.”
(Emphases added.) 740 ILCS 14/15(a) (West 2020).
¶ 38 Thus, section 15(a) specifies that a private entity “in possession of” biometric data “must”
(1) “develop a written policy,” (2) publish it, and (3) comply with it. The policy must contain (1) “a
retention schedule” and (2) “guidelines for permanently destroying” biometric data “when the
initial purpose for collecting or obtaining such” data “has been satisfied or within 3 years of the
individual’s last interaction with the private entity, whichever occurs first.” Id. The explicit trigger
for the development of the written policy (i.e., the retention-and-destruction schedule) is the private
entity’s possession 5 of biometric data. Id.
¶ 39 Our conclusion is consistent with the statutory scheme, which imposes upon private entities
the obligation to establish Biometric-Act-compliant procedures to protect employees’ and
customers’ biometric data. Section 15(b) of the Biometric Act provides that a private entity may
not collect, capture, purchase, or trade biometric data, unless it first (1) provides written notice to
the subject that it is collecting or storing the subject’s data and the specific purpose and length of
5 “ ‘Possession’ means ‘the act or condition of having in or taking into one’s control or
holding at one’s disposal.’ Webster’s Third New International Dictionary 1770 (1986); see also
Black’s Law Dictionary 1201 (8th ed. 2004) (listing the primary definition of ‘possession’ as ‘[t]he
fact of having or holding property in one’s power; the exercise of dominion over property’). Thus,
‘possession,’ as ordinarily understood, occurs when a person has or takes control of the subject
property or holds the property at his or her disposal.” People v. Ward, 215 Ill. 2d 317, 325 (2005).
The scanning and collection or storing of fingerprint data clearly involves the taking of property
and meets this definition.
- 16 - 2022 IL App (2d) 210692
time for which it is being collected, etc., and (2) receives a written release by the subject of the
data. Id. § 15(b). Our reading of section 15(a) is consistent with section 15(b)’s requirement that,
prior to the time a private entity collects, captures, purchases, or otherwise obtains a subject’s
biometric data, it must first inform the subject of the “length of term for which [biometric data] is
being collected, stored, and used.” Id. § 15(b)(2). We can discern no rational reason for the
legislature to have intended that a private entity “develop” a “retention schedule and guidelines for
permanently destroying” (id. § 15(a)) biometric data at a different time from that specified in the
notice requirement in section 15(b), which itself must inform the subject of the length of time for
which the data will be stored (i.e., retained), etc. For this reason, we also conclude that the duty to
develop a schedule upon possession of the data necessarily means that the schedule must exist on
that date, not afterwards. This is consistent, we believe, with the Biometric Act’s preventative and
deterrent purposes (Rosenbach, 2019 IL 123186, ¶ 37) and is the only reasonable interpretation of
the language of section 15(a). See Hartney Fuel Oil Co. v. Hamer, 2013 IL 115130, ¶ 25
(“[s]tatutory provisions should be read in concert and harmonized”); see also Eighner, 2021 IL
126101, ¶ 19 (“[w]hen construing statutory language, we view [a] statute in its entirety, construing
words and phrases in light of other relevant statutory provisions and not in isolation”).
¶ 40 We reject defendant’s argument that the statutory duty is satisfied so long as a schedule
exists on the day that the biometric data possessed by a defendant is no longer needed or the parties’
relationship has ended. The statutory language belies this interpretation, because it explicitly
requires an entity “in possession of” the data to “develop” and publish its retention-and-destruction
schedule. 740 ILCS 14/15(a) (West 2020). It does not state that the schedule must be in place upon
the earlier of the two specified conditions—when the collection purpose is satisfied or within three
years of the last interaction, whichever occurs first. Rather, again, the statute provides that an
- 17 - 2022 IL App (2d) 210692
“entity in possession of biometric [data] must develop a written policy.” Id. The duty to develop a
schedule is triggered by possession of the biometric data. The two specified conditions are
referenced for purposes of the retention schedule and are deadlines for the permanent destruction
of the biometric data in the private entity’s possession.
We also reject defendant’s assertion that plaintiff’s argument that he was entitled to know how
long defendant would store his data was the subject of his section 15(b) claim and that plaintiff
cannot resurrect his dismissed claim by bootstrapping section 15(b) protections to a section 15(a)
claim. This argument ignores the clear language of section 15(a), which requires a private entity,
upon possession of biometric data, to develop and make public a written retention-and-destruction
schedule. Although the statute must be read as a whole (Eighner, 2021 IL 126101, ¶ 19), a private
entity’s obligations under section 15(b) (specifically, to first provide written notice that biometric
data is being collected or stored, the purpose for which it is being collected or stored, and the length
of time for which it is being collected or stored and to obtain consent to the collection of the data
before it is collected or stored) are separate and distinct from those under section 15(a), and the
sections serve different purposes. Section 15(a)’s purpose is (1) to notify the public (including any
individual whose biometric data is in a private entity’s possession) that the entity has a retention
schedule that provides that the data will be kept/stored for only a finite time and reflects the
deadline for the data’s destruction and (2) to require the entity to comply with the schedule. This
is distinct from section 15(b)’s purpose, which is to provide individuals certain information when
a private entity seeks to obtain their biometric data (including the length of term for which the data
will be stored) and to give them control over whether to allow their data to be collected.
¶ 41 The trial court erred in finding that, because plaintiff sustained “no harm,” there could not
be a violation of the Biometric Act. This is contrary to the supreme court’s interpretation of the
- 18 - 2022 IL App (2d) 210692
statute. In Rosenbach, the supreme court held that “a person need not have sustained actual damage
beyond violation of his or her rights under [the Biometric Act] in order to bring an action under
it”; that is, “[t]he violation, in itself, is sufficient to support the individual’s or customer’s statutory
cause of action.” Rosenbach, 2019 IL 123186, ¶¶ 28, 33.
¶ 42 Here, defendant began collecting plaintiff’s biometric data in September 2014, and this
triggered its obligation under section 15(a) to develop a retention-and-destruction schedule.
Defendant did not have a schedule in place until May 2018, or nearly four years later. Thus, it
violated section 15(a).
¶ 43 In summary, the trial court erred in granting defendant summary judgment.
¶ 44 III. CONCLUSION
¶ 45 For the reasons stated, we reverse the judgment of the circuit court of Winnebago County
and remand the cause for further proceedings consistent with this decision.
¶ 46 Reversed and remanded.
- 19 - 2022 IL App (2d) 210692
Mora v. J&M Plating, Inc., 2022 IL App (2d) 210692
Decision Under Review: Appeal from the Circuit Court of Winnebago County, No. 21- CH-22; the Hon. Donna R. Honzel, Judge, presiding.
Attorneys Carl V. Malmstrom, of Wolf Haldenstein Adler Freeman & Herz for LLC, of Chicago, and Max S. Roberts (pro hac vice), of Bursor Appellant: & Fisher, P.A., of New York, New York, for appellant.
Attorneys Joshua G. Vincent, Michael F. Iasparro, and Stephen D. Mehr, for of Hinshaw & Culbertson LLP, of Chicago, for appellee. Appellee:
- 20 -