Class Action Claims Company Illegally Collected Biometric Data

NORTHBROOK, IL — A local baking company faces a class action lawsuit from a former employee who claims the firm violated state minimum wage and biometric privacy laws.

Teodoro Ontiveros, of Skokie, spent more than four years working as a line worker at Highland Baking Company in Northbrook before his termination for unspecified reasons in August 2018, according to a complaint filed Feb. 15 in Cook County.

Ontiveros asked for class action status on behalf of current and former workers at the company's 2301 Shermer Road facility related to its practices for beginning and ending shifts. His complaint said employees had their fingerprints or palmprints illegally collected by the company and were not paid for time spent putting on and taking off safety equipment.

Highland Baking was founded in 1984 in Highland Park by the late Jim Rosen, grandson of S. Rosen's Bakery founder Sam Rosen. It soon moved to a larger space in Lincolnwood, and since 2007 has been headquartered in a 250,000-square-foot manufacturing facility. It subsequently opened a second plant in Spartanburg, South Carolina.

The company employs about 800 people, with a majority working in Northbrook, according to CEO Stu Rosen, who took over after his father Jim died in 2015. Rosen told Patch the company abides by prevailing business practices.

"Clocking in after you put on your uniform and clocking out before you take off your uniform is a widely held and accepted common practice in our industry because the uniform is not a requirement of doing the job," Rosen said.

Ontiveros' suit claims workers were required by Highland Baking to "obtain safety equipment and work clothes from the company at the start of each shift," including "goggles, a uniform, hearing protection, gloves, a hairnet and non-slip shoes."

The "mandatory preparatory activity" of putting on the gear "typically lasts at least 10 minutes and is uncompensated" by the company, according to the complaint. As a result, employees were deprived of earned overtime wages and all affected employees should be covered in the proposed class, the suit claims.

The complaint also asks for a class to be formed under Illinois' biometric privacy law, or BIPA. The 2008 state law was one of the first to address the collection, use and storage of personally identifiable biometric information by private entities. It restricts the trade of such information and includes requirements that those being scanned have notice and provide consent when their biometric data is being collected by non-governmental entities.

At Highland Baking, workers had to place their entire hand on the company's biometric scanner in order to clock in or clock out, but the company "provided no information about the device," the complaint said. As a result, Ontiveros was uncertain what information it was collecting, how long it was storing the data or what it was used for, it said.

The lawsuit said the former line worker never consented to the data collection, was never provided with any written release, was never informed of any policies with regard to biometric data and, along with the rest of employees, had "continuously and repeatedly been exposed to risks, harmful conditions, and violations of privacy" due to the baking company's violations of the Illinois Biometric Information Protection Act, one of the most stringent biometric privacy laws in the nation.

The state law allows for penalties of $1,000 for each instance of a negligent violation of the act and $5,000 for each intentional or reckless violation, which could potentially be defined as any time any employee punches the clock.

Rosen declined to provide specifics about the scanning equipment his company uses, but he said the bakery's practices were well within industry norms.

"I believe [Highland Baking], like dozens if not hundreds of employers who are in a similar situation currently, collected the biometrics in consultation with the employee in good faith, used them only for the purposes of punching in and punching out on time clocks," Rosen said. "They were discarded immediately after the employee's relationship with the company ended."

Lorrie Peeters, an attorney for Ontiveros, declined to offer any comment on the case.

Ontiveros' BIPA suit is one of several to be filed in the weeks following the Jan. 25 Illinois Supreme Court decision in Rosenbach v. Six Flags Entertainment Corp., where the mother of then-14-year-old Alexander Rosenbach sued the Gurnee amusement park in 2016 after it collected his fingerprints for a season pass.

Overruling a 2017 appellate court ruling, the state's highest court decided plaintiffs do not have to prove damages to claim their biometric information — such as iris scans, fingerprints or voiceprints — were illegally collected. The decision was hailed by privacy advocates and criticized by business groups.

Rosenbach's case will continue in Lake County Circuit Court, where a hearing has been set for April 5.

The next court date in Ontiveros' suit is set for June 17.