Why Workers' Compensation Exclusivity Does Not Bar a BIPA Claim
Key Takeaways
- Sections 5(a) and 11 of the Workers' Compensation Act are the exclusivity provisions, and by their terms they apply only where the injury is one the Act covers
- Under Folta, the question is not whether an employee can literally recover but whether the type of injury categorically fits within the purview of the compensation scheme
- McDonald v. Symphony Bronzeville Park, 2022 IL 126511, held that a Privacy Act violation is not that type of injury and may be pursued in the circuit court
- A second, independent ground was that the Privacy Act postdates the Compensation Act and its definition of “written release” expressly contemplates the employment setting
- A special concurrence identified the pleading on which the outcome depended: the amended complaint had dropped any allegation of mental anguish
The Exclusivity Defense
The Illinois Workers' Compensation Act replaced common-law employer liability with a no-fault scheme, and the exchange runs in both directions: the employer assumes liability without fault and is relieved of the prospect of large damage verdicts, while the employee gives up certain recoverable elements of damage. Two provisions of 820 ILCS 305 carry that bargain.
Section 5(a) provides that, except as provided in section 1.2, no common law or statutory right to recover damages from the employer for injury or death sustained by any employee while engaged in the line of his duty as such employee, other than the compensation provided in the Act, is available to any employee who is covered by the provisions of this Act. Section 11 provides that the compensation the Act provides, together with its provisions, shall be the measure of the responsibility of a covered employer.
Illinois courts read the two together as a general rule with four escape routes. An employee avoids exclusivity by establishing that the injury was not accidental; did not arise from the employment; was not received during the course of the employment; or was not compensable under the Act. Employers defending fingerprint timeclock claims conceded the first three and litigated the fourth.
McDonald v. Symphony Bronzeville
Marquita McDonald filed a putative class action in August 2017 against Symphony Bronzeville Park, LLC, a post-acute-care facility that required employees to scan a fingerprint to authenticate themselves and track their time. She alleged she was employed there from December 2016 to February 2017, was never given nor signed a release consenting to storage of her biometric information, and was never told the purpose or the length of time for which it would be stored. The claims were pleaded under section 15(b)(1), (b)(2) and (b)(3) as negligent violations.
In a first-amended complaint filed in April 2019, McDonald withdrew a common-law negligence claim and removed the allegation that she had suffered mental anguish, stating that those allegations were unnecessary to recovery on the statutory claim. That amendment turns out to matter.
The circuit court certified the question whether the exclusivity provisions bar a claim for statutory damages under the Privacy Act where an employer is alleged to have violated an employee's statutory privacy rights. The appellate court answered no. In McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511, decided February 3, 2022, the Illinois Supreme Court also answered in the negative and remanded. Justice Overstreet wrote for the court; Justice Michael J. Burke specially concurred.
Why the Court Rejected Preemption
The court accepted that it had previously applied exclusivity to bar a statutory cause of action, citing a 1958 decision barring a scaffold-statute claim by an employee who fell from a ladder. The distinction it drew was not between statutory and common-law claims but between kinds of injury.
That framing came from Folta, where an employee with mesothelioma argued his claim was “not compensable” because a period of repose had run. The court had rejected the literal reading: the question is not whether the employee can in fact receive compensation, but whether the type of injury categorically fits within the purview of the compensation acts. Because the occupational disease statute specifically addressed asbestos exposure, the injury fit, and exclusivity barred the suit even though nothing could be recovered.
Applied to a Privacy Act claim, the same test cuts the other way, and the opinion is explicit that the exclusivity provisions “by their express language, only apply if the injury is one that is covered by the Compensation Act.”
The court then gave a second, independent reason drawn from the Privacy Act's own text. Where two statutes cover the same subject, the more specific governs the general and the more recently enacted is generally given precedence. The Privacy Act postdates the Compensation Act, and its definition of “written release” reaches, in the employment context, a release executed by an employee as a condition of employment. The legislature therefore knew that claims would arise at work, and it treated employee claims identically to nonemployee claims except as to the permissible method of obtaining consent.
What Counts as a Compensable Injury
The compensation scheme's structure supplied the answer. The Act sets out schedules corresponding to death, to injuries to specific body parts, and to inability to work, and it requires employers to report accidental deaths, injuries and illnesses to the Commission. Damages are awarded according to a predetermined fee schedule, which eliminates variability in the value of each judgment. These, the court observed, are injuries that affect an employee's capacity to perform employment-related duties.
The older formulation is Pathfinder's: whether there was “a harmful change in the human organism—not just its bones and muscles, but its brain and nerves as well.” The Commission is an administrative agency without general or common-law powers, limited to what the legislature granted it, and these are the injuries it was given to price.
A Privacy Act violation is described in different terms. The Act imposes prophylactic measures to prevent the compromise of biometrics, and the claim seeks redress for the lost opportunity, in Rosenbach's phrase, “to say no by withholding consent.” The personal and societal injuries caused by violating those requirements are, in the court's words, different in nature and scope from the physical and psychological work injuries the Compensation Act reaches.
Employer Fingerprint Timeclocks
Bronzeville and its amici pressed the consequences. If workplace injuries could be characterized to evade the exclusivity provisions, they argued, the litigation floodgates would open and the protections Illinois employers rely on would erode; employers would have greater protection against significant physical, emotional and mental workplace injuries than against technical violations of the Privacy Act, and exposure would run to potentially devastating class actions.
The court did not dispute the magnitude. It acknowledged the substantial consequences the legislature intended, noting that section 20 subjects private entities that fail to follow the statute to liquidated damages of $1,000 for a negligent violation and $5,000 for an intentional or reckless one, plus attorneys' fees, expert witness fees, other litigation expenses and injunctive relief, whether or not actual damages can be shown.
Its answer was allocative rather than substantive: whether a different balance should be struck given the category of injury “is a question more appropriately addressed to the legislature,” and it is not the court's role to inject a compromise but to interpret the acts as written.
Where the Defense Still Operates
Because the test is the type of injury pleaded, McDonald does not retire the exclusivity provisions from employment-related biometric litigation; it locates their edge. Injuries that do categorically fit within the compensation scheme continue to belong to it, and the court reaffirmed prior decisions applying exclusivity to emotional distress arising from workplace false imprisonment or malicious prosecution, and to emotional distress claims by an employee who had collected a workers' compensation settlement.
Justice Michael J. Burke's special concurrence traced the line to the pleading. He agreed the alleged injury was not compensable because, on the operative complaint, there was no injury at all: McDonald had amended to remove any allegation of mental anguish and sought liquidated rather than actual damages. Had she persisted in the mental anguish allegation, he wrote, the exclusivity provisions would have barred her claim. He described the resulting incongruity as an opportunity for gamesmanship in pleading, since exclusivity would then apply to Privacy Act claims alleging actual injuries but not to those alleging technical violations. That reasoning is a concurrence rather than the court's holding.
One further limit is statutory rather than judicial. Sections 5(a) and 11 both now open with an exception for section 1.2, added in 2019, which withdraws exclusivity where recovery of compensation benefits would be precluded by the operation of a period of repose. The court noted the amendment in a footnote as specific to the facts in Folta and not at issue in McDonald.
Background
For the underlying law rather than this development: Illinois privacy law, HR & Employment privacy law, Technology & SaaS privacy law.
Frequently Asked Questions
Which provisions of the Illinois Workers' Compensation Act create exclusivity?
What test did McDonald apply to decide the claim was not barred?
Why did the Privacy Act's definition of “written release” matter to the outcome?
Does McDonald mean exclusivity never applies to a workplace biometric claim?
Sources
Everything above is reported from these documents. Follow them to verify.
- McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511 (Illinois Supreme Court) (February 3, 2022) court opinion
- 820 ILCS 305, Workers' Compensation Act (Illinois Compiled Statutes) (August 31, 2026) statute
- 740 ILCS 14, Biometric Information Privacy Act (Illinois Compiled Statutes) (August 2, 2024) statute
Reporting, not legal advice. This article reports on developments in privacy law using publicly available primary sources, which are linked throughout and listed at the end. It is not legal advice, it is not written or reviewed by an attorney, and it does not assess how any law applies to your situation. Privacy law changes frequently and differs by jurisdiction. Reading this does not create an attorney-client relationship. To find out where you or your business stands, consult a licensed attorney. How we report.