Reimbursement of Expenses and Collection of Biometrics – Updates to Illinois Employment Law

Two recent important legal developments will impact how employers operate in Illinois.  In the face of new risks and compliance challenges, employers must consider whether their current policies and procedures adequately address these developments.  The first development is an amendment to the Illinois Wage Payment and Collection Act (the “Act“), effective as of January 1, 2019.  The Act now requires employers to reimburse employees for expenses incurred over the scope of their employment.  The other development involves the regulation of biometric privacy through the state’s Biometric Information Privacy Act (“BIPA“).

Reimbursement of Employee Expenses

Employers must generally reimburse their employees when the employer “authorized or required” a “necessary expenditure”.  The Act gives employees a minimum of 30 calendar days to request reimbursement with supporting documentation.  If supporting documentation is missing, employees may submit a signed statement instead.  See 820 ILCS 115/9.5.

The Act allows employers to set expenditure limits and requirements for reimbursement by way of a written expense reimbursement policy.  Employers will not be liable for amounts that exceed those expenditure limits.  A written policy also offers employers the flexibility of setting other requirements, such as whether employees may use personal equipment in the scope of their employment, or establishing additional time parameters for submission of expense reports.

If employees are not timely reimbursed pursuant to the Act, they may be entitled to damages in the amount of unreimbursed expenses, damages of 2% for every month amounts remain unpaid, and costs and reasonable attorneys’ fees incurred by the employee.  See 820 ILCS 115/14.

While the Act is new to Illinois, California courts have interpreted a similar reimbursement law to find that cellular phone bills, costs of commuting and internet expenses are all reimbursable.  For example, one California court held that an employer was responsible for reimbursing the cost of a cellular phone used to make work-related calls even though the employee had an unlimited plan and no additional cost resulted from these calls.  See Cochran v. Schwan’s Home Service, 228 Cal. App. 4th 1137 (2014).

Collection of Biometric Information

BIPA regulates the retention, collection, disclosure and destruction of biometric identifiers by Illinois entities.  Biometric identifiers (“biometrics“), as defined by BIPA, are a retina or iris scan, fingerprint, voiceprint, or scan of face or hand geometry.  See 740 ILCS 14/10.  Illinois employers that fail to comply with BIPA may be subject to liquidated damages of $1,000 for a negligent violation, or $5,000 for an intentional violation, as well as reasonable attorneys’ fees and costs.  See 740 ILCS 14/20.  The Illinois Supreme Court recently clarified what constitutes a violation of BIPA.  See Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186 (January 25, 2019).  The Court concluded that BIPA plaintiffs do not need to show how a violation of BIPA’s requirements harmed them.  Instead, a violation, in itself, is all that is necessary for a party to maintain a claim.

As a threshold question for determining compliance, employers should first consider whether they collect any of the biometrics defined above.  BIPA only applies to these specific items and does not include other items like photographs, written signatures or information obtained for health care treatment.  The use of a fingerprint time clock is a common example of when employers collect biometrics.  This type of collection is allowed under BIPA; however, employers must meet the following requirements before doing so:

First, employers must have a written policy that outlines the procedures for retention and destruction of biometrics.  See 740 ILCS 14/15(a).  Employers also need the consent of their employees before any biometrics are collected.  Specifically, employees must be informed in writing of the biometrics being collected, the specific purpose for that collection and the amount of time that the information will be held. Employees must also execute a written release authorizing the collection.  See 740 ILCS 14/15(b).

Employers need to reasonably store and protect all biometrics that are in their possession.  See 740 ILCS 14/15(e).  Biometrics should be treated with the same degree of care as social security numbers or any other confidential information of employees.

While this post focuses on the employment context, BIPA protections apply to anyone who has biometrics collected, regardless of whether they are employees, clients or customers.

Illinois employers should confirm that their written policies and procedures comply with both the Act and BIPA, if applicable.  A failure to do so presents significant and unnecessary risk to employers.  Please do not hesitate to contact our office for additional information on these developments in Illinois law.