What's Happening?
Truck drivers have achieved another legal victory in their data privacy lawsuit against Union Pacific Railroad. The lawsuit alleges that Union Pacific violated Illinois' Biometric Information Privacy Act
(BIPA) by collecting fingerprint scans from truck drivers entering its intermodal facilities without obtaining their informed written consent. Additionally, the truckers claim the railroad failed to publish a data retention policy and shared their biometric information with a third party without permission. Union Pacific sought to dismiss the case, arguing it was exempt from BIPA due to contracts with state agencies. However, a federal district court judge denied this motion in August, and the Seventh Circuit Court of Appeals affirmed this decision on September 30, allowing the truck drivers' case to proceed. This is not the first BIPA-related lawsuit against Union Pacific; a similar class-action suit from 2020, which challenged the railroad's claim of federal preemption, is still pending. Other railway companies, such as BNSF Railway Company, have also faced and settled BIPA lawsuits, with BNSF reaching a $75 million settlement in 2024.
Why It's Important?
This ongoing lawsuit highlights the increasing scrutiny and legal challenges surrounding biometric data collection in the U.S., particularly under state laws like BIPA. The court's decision to reject Union Pacific's exemption argument reinforces the broad applicability of BIPA and similar privacy statutes, signaling that companies cannot easily circumvent these regulations even when engaged in government-related contracts. For industries heavily reliant on biometric identification, such as transportation and logistics, this case sets a precedent that strict adherence to consent and data handling protocols is crucial. The potential for significant financial penalties, as seen in the BNSF settlement, underscores the substantial legal and financial risks companies face for non-compliance. This also empowers individuals, particularly employees and contractors, to challenge unauthorized collection and use of their biometric data, fostering greater awareness and protection of personal privacy in the workplace.
What's Next?
With the Seventh Circuit Court of Appeals affirming the lower court's decision, the truck drivers' data privacy lawsuit against Union Pacific will now continue in federal court. Union Pacific will likely need to prepare for further litigation, potentially including discovery and trial, unless a settlement is reached. The outcome of this case could further clarify the scope of BIPA's exemptions and its application to companies with diverse operational contracts. This development may also encourage more individuals to file similar lawsuits against companies that collect biometric data without explicit consent or proper data handling policies. Furthermore, the ongoing legal battles could prompt other states to consider enacting similar comprehensive biometric privacy laws, expanding the regulatory landscape for businesses operating nationwide.
Beyond the Headlines
The legal challenges against Union Pacific and other railway companies reflect a broader societal shift towards greater awareness and demand for control over personal data, especially biometric information. The Illinois Biometric Information Privacy Act (BIPA), enacted in 2008, was ahead of its time and continues to serve as a model for robust data privacy legislation. These cases underscore the ethical implications of using advanced technologies like fingerprint scanners without transparent consent mechanisms. The core issue extends beyond mere legal compliance to the fundamental right of individuals to control their unique biological identifiers. The repeated success of truck drivers in these lawsuits could catalyze a re-evaluation of data collection practices across various industries, pushing companies to adopt more privacy-centric approaches and potentially influencing federal data privacy legislation to create a more uniform standard across the U.S.
