Illinois court limits BIPA exemption for government contractors using fingerprint clocks

Tiara Thomas, a former Cornerstone employee who worked at the company from 2020 to 2022, filed a class action alleging that Cornerstone tracked employee time on the job through the use of a fingerprint-scanning time clock. She alleged the company had collected and stored employee fingerprints for timekeeping purposes since around 2008 and had employees sign a consent form related to its biometric data collection policy. The problem, according to her complaint, was that the form never told employees their fingerprints would be disclosed to Automatic Data Processing, the third-party vendor Cornerstone used to process payroll. Thomas alleged that sharing fingerprint data with ADP without employee knowledge or consent violated the Illinois Biometric Information Privacy Act. 

Cornerstone pushed back, arguing it was exempt from BIPA under a provision that carves out government contractors. The statute says BIPA does not apply to a contractor of a state agency or local government unit when that contractor is working for that government entity. Cornerstone’s position was straightforward: because it held an active government contract throughout Thomas’s employment, it was shielded from BIPA liability entirely, regardless of whether the alleged violation had anything to do with its government work. 

The court disagreed. 

In a unanimous decision, the three-judge panel held that the exemption is not a blanket pass. The qualifying phrase in the statute does not simply mean during the time a government contract exists. It means the exemption only kicks in when the employer’s alleged violation actually occurred within the scope of its government contract work. Anything outside that scope remains subject to BIPA. 

The court also addressed a related question: whether the exemption is limited to employers that work exclusively for the government. It answered no. An employer does not need to be a government-only operation to claim the exemption. But the protection only extends to conduct that falls within the boundaries of the government contract itself.