Digitally signed by Reporter of Decisions Reason: I attest to Illinois Official Reports the accuracy and integrity of this document Appellate Court Date: 2020.05.13 12:54:55 -05'00'
Rivera v. Commonwealth Edison Co., 2019 IL App (1st) 182676
Appellate Court MONICA RIVERA, Individually and on Behalf of All Others Caption Similarly Situated, Plaintiff-Appellant, v. COMMONWEALTH EDISON COMPANY and EXELON CORPORATION, Defendants- Appellees.
District & No. First District, Second Division No. 1-18-2676
Filed December 3, 2019
Decision Under Appeal from the Circuit Court of Cook County, No. 17-CH-07460; the Review Hon. Raymond W. Mitchell, Judge, presiding.
Judgment Affirmed.
Counsel on Ryan F. Stephan, James B. Zouras, Andrew C. Ficzko, and Anna M. Appeal Ceragioli, of Stephan Zouras, LLP, of Chicago, for appellant.
Neil H. Dishman, Julia P. Argentieri, and Nicholas A. Simpson, of Jackson Lewis P.C., of Chicago, for appellees. Panel PRESIDING JUSTICE FITZGERALD SMITH delivered the judgment of the court, with opinion. Justice Coghlan concurred in the judgment and opinion. Justice Pucinski specially concurred, with opinion.
OPINION
¶1 The plaintiff, Monica Rivera, filed a class action complaint against the defendants, Commonwealth Edison Company (ComEd) and Exelon Corporation (Exelon), alleging that they violated her rights under the Employee Credit Privacy Act (820 ILCS 70/1 et seq. (West 2016)) by investigating her credit history in connection with a conditional offer of employment as a customer service representative (CSR) and ultimately refusing to hire her because of the results of that investigation. The trial court granted summary judgment in favor of the defendants on the plaintiff’s claim. The plaintiff now appeals. For the reasons that follow, we affirm the trial court’s entry of summary judgment.
¶2 I. BACKGROUND ¶3 ComEd is a public utility company that provides electrical services to approximately 3.8 million customers in Illinois. It is a subsidiary of Exelon, which is an electric utility holding company. On May 9, 2017, the defendants extended to the plaintiff a conditional offer of employment for a temporary part-time position as a CSR with ComEd, with a starting wage of $31.42 per hour. This was an entry-level position that required a high school diploma or equivalent. The offer of employment was contingent upon the completion of a successful background check, credit check, and drug screen. As part of this, the defendants obtained a consumer report on the plaintiff that included certain information about her credit history. On May 23, 2017, a representative of the defendants sent an e-mail to the plaintiff, rescinding the conditional offer of employment. That e-mail stated that “due, in part, to information received from the consumer report previously provided to you, we are not able to offer you employment at this time.” ¶4 The plaintiff filed a class action complaint alleging that, by inquiring into her credit history and obtaining her credit report in connection with her application for the CSR position and by ultimately refusing to hire her for that position because of information contained in the report, the defendants violated her rights under the Employee Credit Privacy Act. See id. § 10(a). The plaintiff alleged that she was bringing the case on behalf of herself and other similarly situated individuals who had applied for the same position or other similarly titled positions with the defendants and had been subjected to a credit inquiry or check as a condition of employment. ¶5 The defendants answered the complaint and later filed a motion for summary judgment. In general, they argued in the motion for summary judgment that the prohibition on an employer’s investigation into an applicant’s credit history or use of that credit history in connection with hiring decisions did not apply to the customer service representative position for which the plaintiff had been a candidate. They argued that the possession of a satisfactory credit history was a bona fide occupational requirement of that position because it “ ‘involves access to personal or confidential information’ ” of the defendants’ customers. See id. § 10(b)(5). After
-2- conducting discovery pertaining to the issues raised in the defendants’ motion and supporting affidavits, the plaintiff filed a response supported by depositions and other evidence. ¶6 The affidavits, depositions, and other evidence in the summary judgment record demonstrate the facts as follows. For any residence, business, or other entity within ComEd’s service territory to obtain electricity, an account must be established with ComEd. This is the case even for customers who purchase electricity from a different supplier, as ComEd still delivers it. Thus, as ComEd provides electrical services to 3.8 million customers, it receives and stores a significant amount of information about its customers. ¶7 The primary database that ComEd uses to store information about its customers is its Customer Information Management System (CIMS). Access to CIMS is restricted to those ComEd employees who hold positions requiring them to use it in the course of their job duties. Over 2000 ComEd employees have some access to CIMS. Among those who have access, employees have varying levels of access to the information in the database, depending on what information they require to perform their job duties. ComEd denotes part of the information within CIMS as “personal identifiable information,” which includes information such as a customer’s Social Security number, tax ID number, driver’s license number, credit card number, and bank account number. Access to such personal identifiable information is restricted to those positions and groups that are required to gather and use this information in the performance of their job duties. This includes the customer care, billing, security, new business, and claims departments. CSR is one of the positions with access to the part of CIMS where customers’ personal identifiable information can be entered into the database. ¶8 The job of ComEd’s CSRs involves communicating by telephone with new and existing customers seeking to establish or transfer electrical service or making other inquiries concerning their service or account with ComEd. In certain situations, CSRs obtain or are able to view customers’ full Social Security numbers. One situation in which CSRs obtain a customer’s full Social Security number is when a new customer calls ComEd to establish service. As part of that process, CSRs validate the new customer’s identity by requesting the customer’s name and full Social Security number and entering that information into the CIMS database, where it is validated by Equifax. After that occurs, CSRs request additional information, including the new customer’s date of birth and driver’s license number, and enter that information into CIMS. After the appropriate information is obtained about the new customer and entered into CIMS, CSRs are no longer able to view the customer’s full Social Security number in CIMS. Rather, only the last four digits of the number are visible to the customer service representative. The same occurs with customers’ full driver’s license numbers. Only the last several digits of these can be viewed in CIMS by a CSR after being entered. ¶9 Two additional situations in which CSRs obtain or can view a customer’s full Social Security number are when a new customer’s Social Security number is found to exist in another customer’s record, and when a customer calls to inform ComEd that he or she has filed for bankruptcy and is entitled to have his or her electricity restored. In cases involving the duplication of a Social Security number, CSRs send an electronic communication to the revenue management department to resolve the issue. That communication typically includes the full Social Security number given by the new customer. CSRs have the continued ability to view that communication, including the full Social Security number, until it is resolved by the revenue department, which can take up to 12 days. In cases where a customer reports
-3- declaring bankruptcy, CSRs ask the customer to provide either a full Social Security number or a bankruptcy case number. CSRs then send that information in an electronic communication to the bankruptcy or legal department. CSRs have the continued ability to view that communication, including the full Social Security number, until the customer’s electricity is restored, which can take up to 30 days. ¶ 10 CSRs also obtain customers’ bank account numbers and credit card information when customers call ComEd and provide this information to pay a bill or an overdue balance. After these numbers are initially inputted into CIMS, CSRs can no longer view the full bank account numbers or credit card numbers. ¶ 11 After ComEd initially obtains personal identifiable information from customers, its CSRs have the continued ability to view certain information in CIMS to perform their job duties and assist customers. This includes the ability to view partially redacted Social Security numbers, driver’s license numbers, matricula numbers, bank account information, dates of birth, and address history for all current and former ComEd customers. ¶ 12 Eric Leslie, one of ComEd’s senior trainers who provides training to CSRs in the performance of their duties, was questioned in his deposition about ComEd’s “new business” department. This is a different department than the customer care department, in which CSRs work. Leslie testified that the new business department handles calls concerning newly constructed buildings or houses that require electrical infrastructure to be installed for ComEd to deliver electricity. He testified that those calls are not handled by CSRs. He testified that where the infrastructure already exists at a premises and a customer calls to put their name on the service there, such calls are handled by CSRs in the manner described above. ¶ 13 ComEd employs approximately 500 CSRs, who work on two floors of an office building in Oak Brook, Illinois. They work in individual cubicles with two computer monitors and a pad of paper on which they can take notes during calls. Each CSR handles about 100 calls from customers each workday. The calls that CSRs handle are recorded and stored electronically in a database. CSRs’ supervisors can listen during or after these calls, and they can also monitor the computer screens of the CSRs. ComEd also uses a third-party vendor, Clear Metrics, to monitor calls handled by CSRs for quality assurance purposes. Fewer than 1% of the calls handled by CSRs are actually monitored. ¶ 14 After a new customer establishes an account, ComEd sends a letter to the customer. The letter, a sample of which is included in the record, invites customers to visit the defendants’ website. The letter does not specifically direct customers to the website for the purpose of accessing the defendants’ privacy policy, nor does the record on appeal contain any other evidence of the defendants specifically directing customers to their website for the specific purpose of accessing the privacy policy. However, the privacy policy is generally available on the defendants’ website and is included in the record on appeal. It states in part, “Through your use of our *** Services we may collect Personal Information (‘PI’), which is information that identifies you as an individual or relates to you as an identifiable individual,” including “your first and last name, home or business address, email address, and telephone number.” It further states that the defendants “must collect certain PI and [personally identifiable information (PII)] if you choose to use our Services. PII includes information where your name is combined with your Social Security number, driver’s license number, state identification card number, bank account number, credit card or debit card number, or unique biometric data.”
-4- ¶ 15 The trial court granted the defendants’ motion for summary judgment. The trial court concluded that the undisputed facts established that a satisfactory credit history was a bona fide occupational requirement of the CSR position that the plaintiff sought because the position “ ‘involves access to personal or confidential information.’ ” See id. As such, the trial court determined that the prohibition on an employer’s investigating and considering a job applicant’s credit history in making hiring decisions did not apply in this case. The plaintiff then filed a timely notice of appeal.
¶ 16 II. ANALYSIS ¶ 17 This case is before us on the trial court’s granting of summary judgment in favor of the defendants, and thus, our standard of review is de novo. Williams v. Manchester, 228 Ill. 2d 404, 417 (2008). Summary judgment is proper where, when viewed in the light most favorable to the nonmoving party, the pleadings, depositions, admissions, and affidavits on file reveal that there is no genuine issue as to any material fact and that the moving party is entitled to judgment as a matter of law. Hall v. Henn, 208 Ill. 2d 325, 328 (2003); 735 ILCS 5/2-1005(c) (West 2018). The purpose of summary judgment is not to try a question of fact but to determine whether one exists. Thompson v. Gordon, 241 Ill. 2d 428, 438 (2011). If a dispute exists about a material fact, or if reasonable observers could draw divergent inferences from the undisputed material facts, then summary judgment should be denied. Forsythe v. Clark USA, Inc., 224 Ill. 2d 274, 280 (2007). ¶ 18 The plaintiff’s claim in this case was that the defendants’ actions of investigating of her credit history in connection with the conditional offer of employment and ultimately refusing to hire her because of the results of that investigation violated section 10(a) of the Employee Credit Privacy Act, which provides as follows: “(a) Except as provided in this Section, an employer shall not do any of the following: (1) Fail or refuse to hire or recruit, discharge, or otherwise discriminate against an individual with respect to employment, compensation, or a term, condition, or privilege of employment because of the individual’s credit history or credit report. (2) Inquire about an applicant’s or employee’s credit history. (3) Order or obtain an applicant’s or employee’s credit report from a consumer reporting agency.” 820 ILCS 70/10(a) (West 2016). The defendants contended that the above prohibition on an employer’s investigation into a job applicant’s credit history or use of that credit history in connection with hiring decisions did not apply to the position for which the plaintiff had been a candidate. They argued that the CSR position at issue involved access to personal or confidential information of ComEd’s customers, and therefore, it qualified for an exception under section 10(b)(5) of the Employee Credit Privacy Act. Id. § 10(b)(5). Section 10(b)(5) provides in pertinent part: “(b) The prohibition in subsection (a) of this Section does not prevent an inquiry or employment action if a satisfactory credit history is an established bona fide occupational requirement of a particular position or a particular group of an employer’s employees. A satisfactory credit history is not a bona fide occupational requirement unless at least one of the following circumstances is present: ***
-5- (5) The position involves access to personal or confidential information, financial information, trade secrets, or State or national security information.” Id. “Personal or confidential information” is a defined term in the Employee Credit Privacy Act, and it means “sensitive information that a customer or client of the employing organization gives explicit authorization for the organization to obtain, process, and keep; that the employer entrusts only to managers and a select few employees; or that is stored in secure repositories not accessible by the public or low-level employees.” Id. § 5. ¶ 19 The plaintiff raises several principal arguments on appeal that the CSR position at issue does not qualify for the exemption under section 10(b)(5). She argues that genuine issues of material fact exist about whether the information handled by ComEd’s CSRs satisfied the statutory definition of “personal or confidential information.” She also argues that a genuine issue of material fact exists about whether CSRs have “access” to such information, as opposed to merely serving as “conduits” who receive the information initially and then distribute it to other employees within ComEd. The plaintiff correctly notes that the defendants bear the burden of proving that an exemption applies to the position at issue. Ohle v. The Neiman Marcus Group, 2016 IL App (1st) 141994, ¶ 47.
¶ 20 A. Personal or Confidential Information ¶ 21 We first address the plaintiff’s arguments concerning whether the information at issue satisfies the statutory definition of “personal or confidential information.” In doing so, we note that the plaintiff does not challenge the fact that the information received by ComEd’s CSRs constitutes “sensitive information.” 820 ILCS 70/5 (West 2016). We agree that information such as Social Security numbers, driver’s license numbers, bank account information, credit card numbers, and other similar information obtained by ComEd’s CSRs meets this aspect of the statutory definition. ¶ 22 The plaintiff contends that the information at issue does not satisfy any of the three aspects of the statutory definition of “personal or confidential information.” First, she argues that a genuine issue of material fact exists about whether CSRs themselves are “low-level employees,” such as to show an issue of fact about whether the sensitive information at issue “is stored in secure repositories not accessible by the public or low-level employees.” See id. Second, she argues that a question exists about whether the number of CSRs employed by ComEd (approximately 500), as well as the total number of ComEd employees who have some level of access to the information in the CIMS database (approximately 2000), constitutes a “select few” employees, such as to raise an issue of fact about whether the defendants entrust the sensitive information at issue “only to managers and a select few employees.” See id. Third, she argues that the defendants did not make a sufficient showing that customers gave “explicit authorization” for ComEd to “obtain, process, and keep” the sensitive information at issue. See id. ¶ 23 In support of her argument that CSRs are themselves low-level employees, the plaintiff relies on the fact that the position she was offered was a temporary, part-time position. She points out that it was an entry-level position, for which the educational requirements were a high school diploma or equivalent. She would have been paid hourly and not on a salary basis. Although the record does not appear to contain any evidence about the number of hours that the plaintiff would have worked in this position, she argues that, at a wage of $31.42 per hour, she would have earned “at most half” of the $65,000 earned by CSRs working full time.
-6- Additionally, she cites the fact that all of the phone calls that CSRs handle are recorded and stored in a database, where they can be monitored by supervisors or by Clear Metrics. She argues that “low-level employees” refers to employees without managerial control or authority over business operations, and the fact that CSRs are highly monitored, closely managed employees raises an issue of fact about whether they qualify as low-level employees. ¶ 24 By contrast, the defendants argue that ComEd’s CSRs are not low-level employees. They argue that CSRs have a much higher level of responsibility for handling the sensitive information of customers than nearly all other employees of ComEd. They argue that the position is “highly paid.” They argue that, given that it is undisputed that part-time CSRs perform the same job, receive the same customer information, and are paid the same hourly wage as full-time CSRs, the fact that the plaintiff sought a part-time position did not make her a “low-level employee.” They argue that the fact that the position was entry level is immaterial, given the level of responsibility that a CSR has for handling information about customers. They argue that the question of whether an employee is “low-level” does not hinge on whether the employee has managerial or supervisory responsibilities. ¶ 25 No definition of “low-level” employee is contained in the Employee Credit Privacy Act. Thus, we are presented with an issue of statutory interpretation, in which our role is to ascertain and give effect to the intent of the legislature. General Motors Corp. v. State of Illinois Motor Vehicle Review Board, 224 Ill. 2d 1, 13 (2007). The best evidence of legislative intent is the language used in the statute itself, which must be given its plain and ordinary meaning. Paris v. Feder, 179 Ill. 2d 173, 177 (1997). Words and phrases should not be considered in isolation but, rather, they must be interpreted in light of other relevant provisions and the statute as a whole. County of Du Page v. Illinois Labor Relations Board, 231 Ill. 2d 593, 604 (2008). In addition to the statutory language, the court may consider the purpose behind the law, the evils sought to be remedied, and the consequences that would result from interpreting the law one way or the other. Id. ¶ 26 Here, the plain and ordinary meaning of “low-level,” as defined in the dictionary, is “being of low importance or rank.” Merriam-Webster’s Collegiate Dictionary 691 (10th ed. 1998). If we considered this phrase in isolation, we might conclude that, because there is no indication of how “low” in importance or rank the employees must be, the plaintiff proposes a reasonable interpretation that low-level employees “refers to employees without managerial control or authority over business operations.” However, we must interpret the term in the context of the statute as a whole. It appears in the aspect of the statute describing “sensitive information *** that is stored in secure repositories not accessible by the public or low-level employees.” 820 ILCS 70/5 (West 2016). The term “low-level employees” is used in conjunction with “the public.” This indicates a level of employee whose need or ability to access sensitive information stored in secure repositories is of a level similar to that of the public in general. ComEd’s CSRs would not fall within this category of employees, because it is undisputed that their need and ability to obtain and use the information of ComEd’s customers to perform their job duties is much greater than that of the general public. Therefore, they are not “low-level employees” within the meaning of the statute. ¶ 27 Further, there is no genuine issue of material fact that ComEd stores the sensitive information it possesses about its customers in a secure repository, the CIMS database. This database is not accessible to the public, and ComEd restricts access to the database to those of its employees who hold positions requiring them to use it. Thus, although approximately 2000
-7- ComEd employees have some access to CIMS, there are many employees of ComEd who cannot access it because their job duties do not require it. These would include the “low-level employees” referred to in the statute, whose need or ability to access the information in CIMS is no greater than that of the public in general. ¶ 28 We therefore hold that no genuine issue of material fact exists about whether the information at issue satisfies the statutory definition of “personal or confidential information” because it is “sensitive information *** that is stored in secure repositories not accessible by the public or low-level employees.” Id. As the satisfaction of any one aspect of the definition is sufficient, we do not need to consider the plaintiff’s alternative arguments that the number of ComEd employees who can access the information indicates that it is not entrusted “only to managers and a select few employees,” or that there is no evidence that customers gave “explicit authorization” for ComEd to “obtain, process, and keep” the information at issue. To the extent that the plaintiff’s argument suggests that all three aspects of the statutory definition must be satisfied, we reject this argument. The use of the word “or” in the statute indicates that these are three different alternatives and establishing any one of the three alternatives is sufficient to satisfy the statutory definition of “personal or confidential information.” See Elementary School District 159 v. Schiller, 221 Ill. 2d 130, 145 (2006).
¶ 29 B. “Access” to Personal or Confidential Information ¶ 30 The plaintiff next argues that a genuine issue of material fact exists about whether CSRs have “access” to personal or confidential information within the meaning of section 10(b)(5) of the Employee Credit Privacy Act. 820 ILCS 70/10(b)(5) (West 2016). She argues that ComEd’s CSRs are merely “conduits” whose role is merely to receive customers’ information initially and pass it on to the other responsible departments within ComEd, and not thereafter to process, keep, or access customers’ information. She also argues that the ability to view the redacted information of customers in CIMS is insufficient to amount to “access” under section 10(b)(5). Both parties argue that their respective positions are supported by this court’s decision in Ohle, 2016 IL App (1st) 141994, which analyzed the meaning of the word “access” as used in section 10(b)(5). ¶ 31 In Ohle, the plaintiff was a candidate for an entry-level position as a dress-collection sales associate at one of the defendant’s retail stores. Id. ¶ 2. The defendant obtained a credit check of the plaintiff in conjunction with a potential job offer and elected not to hire her after she failed it. Id. ¶¶ 2, 5. The issue on appeal in the plaintiff’s ensuing lawsuit was whether the sales associate position involved “access” to personal or confidential information of customers within the meaning of section 10(b)(5). Id. ¶ 22. The evidence in the case demonstrated that sales associates’ jobs were to sell the defendant’s merchandise to the public. Id. ¶ 6. Sales associates were heavily supervised, both by store managers and by the loss prevention teams using surveillance cameras. Id. Part of their jobs included encouraging customers to open store credit cards. Id. ¶ 8. They could accept customers’ applications for such cards, and these applications would contain the customer’s date of birth, Social Security number, driver’s license number, and income information. Id. It was disputed whether the sales associates would input some or all of this information into an encrypted database in the point-of-sale (POS) register, or whether they merely received the applications, placed them in a locked drawer in the POS register, and delivered them to the cash department at the end of the day. Id. ¶¶ 8, 23,
-8- 32, 34-35. They were prohibited from keeping or accessing any personal customer information from the POS terminals or through any other means. Id. ¶¶ 8, 32, 36. ¶ 32 In its analysis, the court considered that the legislature’s intent in enacting the Employee Credit Privacy Act was to protect employees and prospective employees from having their credit histories used in employment decisions for jobs in which credit history was not relevant. Id. ¶¶ 17, 29. The court rejected the defendant’s argument that the facts above demonstrated that its sales associates had “access” to personal or confidential information within the meaning of section 10(b)(5). Id. ¶¶ 37-40. In doing so, the court explained part of its reasoning as follows: “Neiman Marcus requires the sales associates keep the applications locked in their cash drawer until the end of the work day or immediately give them to a manager. Only managers and credit office and loss prevention employees can see the customer information in the computer database and can obtain, keep, or process that information. In sum, Neiman Marcus does not permit sales associates to do any of the above. A sales associate essentially acts as a conduit by (1) receiving the application from the customer, ensuring it gets to Neiman Marcus manager or trusted employee, or (2) entering the information into the POS system for immediate credit approval, which is a task no more sensitive in nature than entering credit card numbers into a credit card machine or taking down driver’s license information to accept a personal check in order to complete a sales transaction. *** Therefore, we find it is Neiman Marcus managers and select few employees (credit office personnel and loss prevention), who have ‘access’ to personal and confidential customer information as contemplated by section 10(b)(5) and not Neiman Marcus dress collection sales associates.” Id. ¶ 37. The court recognized that if “access” were interpreted so broadly as to exempt employees who simply received a credit card application and placed it in a drawer for processing at a later time by a different department, the Employee Credit Privacy Act “would in effect accomplish nothing.” Id. ¶ 39. The court went on to state: “In the context of this case, ‘access’ to credit application information would pertain to the employees that process the credit application, receive the customer’s credit report, analyze the customer’s detailed financial history and make the decision on whether to extend credit. *** Only a select group of Neiman Marcus employees in the loss prevention, customer service, and the credit department have access to credit card applications after they were submitted, and only employees in those departments can access the encrypted customer information obtained from further processing of the customer’s credit history. Those are the types of positions that the legislature contemplated as having ‘access’ to personal or confidential information subject to section 10(b)(5) of the Act, not the type of position plaintiff sought.” Id. ¶ 40. ¶ 33 Here, the plaintiff argues that ComEd’s CSR position is similar to the sales associate position in Ohle. The plaintiff points out that the CSR position is an entry-level position requiring only a high-school diploma or equivalent. 1 She also points out that CSRs are subject to having their telephone calls or computer activity monitored by supervisors, the quality assurance department, and Clear Metrics. She argues that CSRs “are admittedly mere conduits
Ohle did not involve the issue, addressed above, of whether the defendants’ sales associates were 1
“low-level employees.”
-9- entering information into the ComEd database and nothing more.” She contends that, when customers call to set up a new account, CSRs input the customers’ Social Security numbers, driver’s license numbers, and bank account numbers into CIMS “for processing by the new business department.” She contends that CSRs “indisputably do not process the information,” and after inputting it into CIMS, they are prohibited from accessing the full Social Security numbers or other information. ¶ 34 We reject the plaintiff’s argument that the access of ComEd’s CSRs to customers’ personal or confidential information is similar to that of the dress-collection sales associate in Ohle. In that case, the evidence demonstrated that after a sales associate received credit card applications and either entered information into the POS system for immediate credit approval or placed them in a locked drawer in the POS register until they could be delivered to the responsible department for processing, the sales associate had no further ability to “see the customer information in the computer database” or to “obtain, keep or process that information.” Id. ¶ 37. Here, by contrast, the evidence shows that CSRs, after initially inputting the information into CIMS, continue throughout their employment to have the ability to view at least partial Social Security numbers, driver’s license numbers, bank account numbers, and credit card numbers, in addition to customers’ names, address histories, dates of birth, and other identifying information. Moreover, the evidence shows that CSRs use this customer information routinely to assist customers as part of their job duties. ¶ 35 We do not find any relevance in the fact that the CSR position sought by the plaintiff was entry-level or temporary. As explained above, the evidence demonstrates that regardless of its entry-level or temporary nature, it involves access to personal or confidential information. Also, the plaintiff contends that ComEd’s CSRs are subjected to a level of surveillance or monitoring in their jobs that is comparable to that of the sales associate in Ohle. We disagree. Although the evidence demonstrates that CSRs are subjected to having their telephone calls or computer activity recorded or monitored, the evidence further shows that less than one percent of the calls handled by CSRs are actually monitored. Therefore, we conclude that nothing about the level of monitoring or surveillance experienced by ComEd’s CSRs affects whether that position involves access to the personal or confidential information of customers. ¶ 36 We find that the plaintiff incorrectly characterizes the evidence when she states that CSRs merely input customer information into CIMS “for processing by the new business department.” As Eric Leslie testified in his deposition, ComEd’s new business department handles calls concerning newly constructed premises that require the installation of electrical infrastructure to receive electricity. He testified that CSRs do not handle those calls but, rather, they handle calls in situations when the infrastructure already exists and customers need their names added to the accounts. The evidence cited by the plaintiff does not establish that the new business department “processes” the information collected by the CSRs, or that any other department processes that information to the exclusion of the CSRs themselves. ¶ 37 Furthermore, we reject the plaintiff’s contention that the defendants’ own witnesses agree that the CSRs are “merely conduits” who “ ‘just put all the information into the system’ ” but do not process it. The testimony that the plaintiff cites for this proposition, which is from the deposition of ComEd employee Juan Rivera, is as follows: “MR. STEPHAN [(PLAINTIFF’S ATTORNEY)]: Would you agree that [CSRs are] sort of a conduit between the customers and the field? MS. ARGENTIERI [(DEFENDANTS’ ATTORNEY)]: Object to form. Vague.
- 10 - MR. RIVERA: In a sense, I mean, I guess they can be. MR. STEPHAN: In other words, they collect information from the customers about outages, service calls, whatever, and they communicate that, and it goes up the chain to the technicians in the field who perform the service? MR. RIVERA: Correct. Yeah, they just put all the information into the system. Right.” The only information that Juan Rivera was questioned about in this exchange involved outages and service calls. This exchange had nothing to with CSRs’ responsibilities with regard to the kind of personal or confidential information of customers that is at issue in this case. It does not support the proposition for which it is cited by the plaintiff. ¶ 38 Finally, the plaintiff argues that the fact that CSRs can only view partial Social Security numbers, driver’s license numbers, and the like, as opposed to the full numbers, should not trigger the exception at issue. She contends that in Ohle, the sales associates “had the ability to view encrypted or redacted information as part of their job duties.” We believe that the plaintiff is misreading the facts of Ohle and downplaying the amount of customer information that the record discloses that ComEd’s CSRs can actually view. As stated above, in that case, the sales associates, after initially processing the credit card applications, had no further ability to see any sensitive information of customers in the computer database or to obtain, keep, or process that information. Id. Only employees in the defendant’s loss prevention, customer service, and credit departments had access to credit card applications after they were submitted or “can access the encrypted customer information obtained from further processing of the customer’s credit history.” Id. ¶ 40. Here, by contrast, the uncontested evidence shows that ComEd’s CSRs have the ongoing ability to view in CIMS customers’ partial Social Security numbers, driver’s license numbers, bank account numbers, and credit card numbers, in conjunction with customers’ names, address histories, dates of birth, and other identifying information. With the ongoing ability to view this information and use it as part of their jobs, their position is closer to that of the employees in the loss prevention, customer service, and credit departments of the defendant in Ohle than that of the sales associate. The fact that these numbers are only partially visible to CSR does not mean that the position does not involve “access to personal or confidential information” of the customers of ComEd.
¶ 39 III. CONCLUSION ¶ 40 For the foregoing reasons, we affirm the trial court’s entry of summary judgment in favor of the defendants and against the plaintiff.
¶ 41 Affirmed.
¶ 42 JUSTICE PUCINSKI, specially concurring: ¶ 43 I agree with the analysis and result in this matter; however, I write specially to point out that since the legislature did not define the word “access,” we are left to decide if some job applicants will or will not have “access” to confidential information. ¶ 44 Here the CSRs at Commonwealth Edison clearly had access to customers’ confidential information because the CSR first had to get that information verbally from the customer over
- 11 - the phone, certainly for all new customers, and sometimes for existing customers to resolve a problem. ¶ 45 Getting that information gives any CSR immediate access to confidential information that they keyboard onto a screen. That information is not secured until the next step, actually pushing it into the encrypted data system. Old fashioned pencil and paper and certainly the glitzier cell phones with cameras and recorders give any CSR gathering that information the opportunity to hijack it. While we hope that the vast majority of CSRs will not hijack information, and thus, customer identities, it is becoming more and more apparent that limiting access to such information is a fundamental security issue. ¶ 46 That being said, and with the greatest respect to the author and my colleagues who decided Ohle, it appears to me that the case was wrongly decided. The salespersons at Neiman Marcus had firsthand access to the confidential information their customers were providing to apply for a store credit card. It would only take a few seconds to voice record the information, take a photograph of it on a cell phone camera, or just plain write it down before hitting the “enter” key to push it into the secure part of the system. If the information was written by the customer on an actual paper application, the same opportunity for mischief exists. ¶ 47 While I am sympathetic to the idea that the exemption should not swallow the rule, where we must protect the right of people to apply for a job, we must also protect the right of people to the security of their confidential information. ¶ 48 I would find that “access” exists from the moment confidential information is given to any employee for the purpose of furthering that employer’s ability to provide service to a customer. Without more significant security protocols in place, applicants for those positions are expected to conform to the employer’s hiring security policies.
- 12 -