No Grand Bargain: Illinois Supreme Court Rejects Exclusive Remedy Preemption in Privacy Act Class Actions

On February 3, 2022, in McDonald v. Symphony Bronzeville Park, LLC, the Illinois Supreme Court held the exclusive remedy provisions of the Illinois Workers’ Compensation Act (“Compensation Act”) do not preempt employee statutory damages claims under the Illinois Biometric Privacy Act (“Privacy Act”). Justice David K. Overstreet authored the near-unanimous opinion. Justice Michael J. Burke filed a concurrence, although it reads more like a dissent.

Pleading History

The plaintiff in McDonald filed a putative class action against her former employer alleging that she and her coworkers were required to scan their fingerprints to track their time worked and prevent others from clocking-in for them (i.e., to prevent time card fraud). Specifically, the plaintiff alleged that the defendant violated section 15(b)’s informed consent requirements and section 15(a)’s publicly-available retention and destruction policy. Her original complaint stated these alleged violations caused her mental anguish.

Sections 5(a) and 11 of the Compensation Act (820 ILCS 305/5(a) and 11) preempt workplace injuries that cause emotional distress, provided the employer did not specifically “intend” to injure the employee. When the defendant in McDonald moved to dismiss the plaintiff’s complaint as preempted by the exclusive remedy provisions of the Compensation Act, the plaintiff filed an amended complaint that dropped the mental anguish allegation and cited only the Privacy Act’s statutory damages provisions of $1,000 per negligent violation or $5,000 per reckless or intentional violation.

The Compensation Act’s “Grand Bargain”

The Compensation Act provides the “exclusive remedy” or means by which an employee may recover against an employer for a work-related injury. Its purpose is to impose liability “without fault” upon the employer and, in return, limit the amount the employer must pay an employee for a work-related injury. As the Illinois high court noted in McDonald, this quid pro quo ensures employees are compensated for work-related injuries as authorized by the Compensation Act and relieves employers of the risk of unlimited “large damages verdicts.” By contrast, the Privacy Act was enacted to safeguard against the unauthorized disclosure and misuse of biometrics.

A Foregone Opportunity to Reconcile the Public Policy Behind Both Statutes

The defendant employer argued that the supreme court could—and should—reconcile the public policies behind both statutes, rather than give one statute precedence over the other. In fact, as the court noted in Barragan v. Casco Design Corp., the “court has a duty to interpret the statutes in a manner that avoids an inconsistency and gives effect to both statutes, where such an interpretation is reasonably possible.” The crux of the defendant’s position in McDonald was that the plain language of the Compensation Act’s exclusivity test, and more than fifty years of precedent applying that test, preempted the Privacy Act’s statutory damages claims. Under the employer’s approach, trial courts could satisfy the fundamental purpose of the Privacy Act by enjoining violations and ensuring compliance with the statute’s informed consent regime. If an employee’s biometric data was allegedly compromised, the defendant in McDonald argued that trial courts could order permanent injunctive relief without subjecting employers to the crippling liability posed by class-based damages claims under the Privacy Act.

The Illinois Supreme Court’s Application of the Exclusivity Test

The plain language of sections 5(a) and 11 of the Compensation Act provide that worker’s compensation benefits are an employee’s sole remedy for accidental injuries that “arise out of and in the course of the employment” and preempt any common law or statutory claims against the employer. According to the supreme court, an employee may avoid exclusive remedy preemption if the employee’s injury: (1) was not accidental; (2) did not arise out of the employment; (3) did not occur in the course of the employment; or (4) was not compensable under the Compensation Act.

The supreme court focused on the fourth exception—whether the injury was “not compensable” under the Compensation Act—implicitly finding that the plaintiff could not prevail on the first three exceptions. The defendant argued that sections 5(a) and 11 are “broadly worded” and encompass “any injury” “that occurred in the line of duty and arose out of and in the course of employment in the workplace.” The plaintiff countered that “only physical or psychological injuries are compensable” under the Compensation Act and that her privacy injury was not physical or psychological in nature.

The supreme court conceded that “this court has previously applied the plain language of the exclusivity provisions of the Compensation Act to preclude an employee’s statutory cause of action against his employer in the circuit court,” citing its opinion in Gannon v. Chicago, Milwaukee, St. Paul & Pacific Ry. Co. However, the court held that “McDonald’s loss of the ability to maintain her privacy rights was not a psychological or physical injury that is compensable under the Compensation Act.” It described the injury as “personal and societal” and thus “not the type of injury that categorically fits within the purview of the Compensation Act.”

Notably, the court did not explain what these “personal and societal injuries” are or why a work-related “personal” injury would not be covered. Nor did the court point to any language in sections 5(a) and 11 of the Compensation Act that define a “compensable” injury as anything other than an “accidental” injury that “arises out of” and “in the course of” the employment. Indeed, the “fourth exception” to the Compensation Act’s exclusive remedy test that forms the centerpiece of the court’s decision in McDonald finds no support in the statutory language, and the court cites none. Moreover, there is nothing in the Compensation Act that makes its application in any way dependent on the “type” or “nature” of the employee’s purported injury – a point the court had previously recognized in earlier cases that raised similar challenges.

The court further determined that the Privacy Act’s definition of written release (“a release executed by an employee as a condition of employment”) was “further evidence that the legislature did not intend for Privacy Act claims to be presented to the Workers’ Compensation Commission.” By contrast, the defendant argued that the Privacy Act’s one reference to “employee” in the definition of written release did not provide the kind of mandate and clarity to suggest the legislature intended to disregard the Compensation Act’s longstanding exclusive remedy test. If “field preemption” was the true, unspoken basis of the court’s decision, then the court should have engaged in that analysis rather than read limitations into the Compensation Act’s provisions that its plain language simply does not support.

The Court’s Reasoning

The court cited the Workers’ Occupational Diseases Act (WODA) to support its conclusion that the alleged Privacy Act injury was not the “type” of injury the Compensation Act was intended to redress. This presumes the exclusive remedy provisions of the two statutes are the same when they are not. The plain language of WODA, unlike the Compensation Act, expressly limits its exclusive remedy provisions to “any injury to health, disease, or death therefrom.” The plain language of sections 5(a) and 11 of the Compensation Act places no such limiting language on the injury covered by its exclusivity provisions. Sections 5(a) and 11 merely require that the injury be “accidental” and “arise out of” and “in the course of” the employment.

The Court’s Response to Defendant’s Concerns: Damn the Torpedoes, Full Speed Ahead

Amici for the defendant warned this “decision stands to expose employers to potentially devastating class actions that can result in financial ruin.” The defendant added: “when workplace injuries can be cleverly characterized to evade the broad sweep of the exclusivity provisions, the proverbial litigation floodgates will open wide and the robust protections provided to Illinois employers will quickly erode.”

The supreme court responded: “We are cognizant of the substantial consequences the legislature intended as a result of Privacy Act violations … and the difficulty in providing meaningful recourse once a person’s biometric identifiers or biometric information has been compromised.” According to the court, “whether a different balance should be struck” is for “the legislature” and it “is not our role to inject a compromise, but, rather, to interpret the acts as written.”

The Concurrence: “Quite Simply, There Is No Injury”

Justice Burke concurred “with the majority that the injury as alleged is not compensable under the Compensation Act” but for a different reason: “because, quite simply, there is no injury.”

McDonald and the putative class have not suffered a physical, emotional, or financial injury. We know this because McDonald amended her complaint to remove any allegation that she suffered mental anguish from the purported violation of the Privacy Act. The operative, amended complaint sought recovery of liquidated damages, not any actual damages.

He pointed out the inconsistency between plaintiff arguing she suffered no physical, emotional or financial injury to evade preemption under the Compensation Act and the court’s prior holding in Rosenbach v. Six Flags Entertainment Corp. “that a technical violation of the Privacy Act is a ‘real and significant’ injury.”

Justice Burke further highlighted the “incongruity” in having the Compensation Act preempt Privacy Act claims that allege “actual injuries” but not technical violations that seek only statutory damages:

Had McDonald persisted in her allegation of mental anguish, the exclusivity provisions of the Compensation Act would have barred her claim. But by denying the existence of an injury, McDonald preserved her cause of action under the Privacy Act. This opportunity for gamesmanship in pleading highlights the incongruity of applying the Compensation Act’s exclusivity provisions to Privacy Act claims that allege actual injuries but not to those that allege technical violations.

Thus, the concurrence offers a basis for dismissal under the Compensation Act if mental anguish (or some other physical or mental injury) is alleged. However, artful pleading could easily avoid this outcome.

A Legislative Call to Action

The concurrence in McDonald highlights the incongruity in allowing multimillion-dollar Privacy Act class actions to proceed when there is no physical, psychological or financial injury. The court says this inherent inconsistency is for the Illinois General Assembly to fix.

Accordingly, should the General Assembly revisit the 2008 Privacy Act, it should address the many holes and problems with the statute, such as:

• Does the statute adversely affect Illinois’s ability to attract new business to the state and penalize companies that currently do business in Illinois?
• Have the robust safeguards already built into biometric technology been reviewed and how can the Privacy Act be revised to factor such safeguards into liability and statutory damages?
• Can the Privacy Act be amended to add a reasonable one-year or two-year statute of limitations to cut off the long tail of liability that currently exists?
• Can these amendments be applied retroactively to prevent crippling liability for companies that do business in Illinois?