H&M Hennes & Mauritz

Is a fingerprint the same as a finger scan? H&M is arguing in Illinois state court that the distinction matters.

The retailer is fighting a proposed class action by a former employee who claims the company collected her fingerprint for its punch-clock system that tracks daily work hours. The former employee, Kenyetta Slater, claims the practice violates the Illinois Biometric Information Privacy Act, a fairly unique feature of Illinois state law that restricts how companies can collect biometric information such as fingerprints and iris scans. The law requires that companies inform people they’re collecting such information and get their consent.

In its motion to dismiss last week, H&M argued Slater had given a signed acknowledgment that she would be giving her “biometric finger scan” to log her work hours. What’s more, H&M claims it merely collects finger scans, meaning that it uses information from the scan to create a unique way to identify employees, but doesn’t actually retain the fingerprints themselves.  

“This description of the timekeeping system used by H&M was accurate — the system scans the user’s finger but H&M does not keep a fingerprint of any H&M employee,” the retailer argues in its motion to dismiss the suit.

Slater’s attorney Douglas Werman of Werman Salas P.C. said in a statement that the company’s arguments follow the general strategy of companies fending off such suits in Illinois.

“There is nothing novel in H&M’s motion to dismiss, and it follows the same playbook as other motions to dismiss filed by other employers in other cases,” Werman said in a statement Monday. “We expect the court to deny H&M’s motion.”

A hearing in the case is scheduled for April 16. A representative for H&M did not comment.

The issue carries broader resonance for retailers, who are increasingly using this type of technology in their operations, attorneys said. Companies might use biometric technology to give specific employees access to cash registers and the ability to open thumbprint-activated doors.

Biometric suits playing out in Illinois tackle some of the growing privacy concerns within retail, a sector that employs some 29 million people, according to an estimate by SelectUSA, a program led by the U.S. Department of Commerce.

“There is a lot of exposure in the retail industry to this type of litigation,” said Torsten Kracht, a litigation partner at Hunton Andrews Kurth LLP who represents retailers.   

For an employee or a consumer considering the privacy of their thumbprints, federal law doesn’t offer much guidance. Federal laws don’t specifically speak to companies’ use of thumbprints, unless they might also identify genetic information. In that vacuum, a state laws provide some answers.

After Illinois passed its biometric law in 2008, Texas and Washington state also followed suit with similar laws, although those states only empowered the state’s prosecutors to target offenders for violations. Illinois’ biometric law is unique, attorneys said, because it provides a private right of action and allows statutory damages — that is, it allows regular people to sue for any violations and potentially win monetary compensation.

That’s made Illinois the venue of choice for several biometric lawsuits against companies across industries, including Google and theme park operator Six Flags, which had sold repeat entry passes that employed some fingerprint technology. The Six Flags case went before the Illinois Supreme Court, which ruled in January that people could sue under the law even without having to show that they suffered any specific injury because of it.

“Mild as the law is in Illinois, it’s one of the few states that’s legislated it,” said Matthew Finkin, a labor and employment law professor at the University of Illinois.

The Illinois law is a consumer statute, but it is drafted broadly enough to include employees. The issue with the law frequently boils down to the question of consent. Did the person the company is collecting a thumbprint or an eye scan from freely consent to it?

When considering this question, courts might view the choices of consumers and employers differently. Choosing to unlock your iPhone with your thumbprint is one thing, but starting a job that might involve the use of thumbprint punch clocks could be a more complicated choice.

“There are different considerations for collecting information from employees as a condition of employment, versus collecting it from consumers who can easily decide that they just don’t want to shop in your store,” said Kracht.