A disability services provider argued its government contract made it exempt – the court disagreed
An Illinois appeals court ruled that holding a government contract does not shield employers from biometric privacy claims over employee fingerprint data.
The Appellate Court of Illinois, Third District, issued its decision on April 28, 2026, in a case that could force employers across the state to rethink how they handle worker biometric information, particularly when sharing it with payroll vendors.
The dispute involved Cornerstone Services, Inc., a corporation that provides support to individuals with intellectual and developmental disabilities in Illinois. Cornerstone receives funding from the Illinois Department of Human Services, with government payments accounting for 60% to 73% of its annual revenue – more than $23 million a year during the period in question.
Tiara Thomas, a former Cornerstone employee who worked at the company from 2020 to 2022, filed a class action alleging that Cornerstone tracked employee time on the job through the use of a fingerprint-scanning time clock. She alleged the company had collected and stored employee fingerprints for timekeeping purposes since around 2008 and had employees sign a consent form related to its biometric data collection policy. The problem, according to her complaint, was that the form never told employees their fingerprints would be disclosed to Automatic Data Processing, the third-party vendor Cornerstone used to process payroll. Thomas alleged that sharing fingerprint data with ADP without employee knowledge or consent violated the Illinois Biometric Information Privacy Act.
Cornerstone pushed back, arguing it was exempt from BIPA under a provision that carves out government contractors. The statute says BIPA does not apply to a contractor of a state agency or local government unit when that contractor is working for that government entity. Cornerstone's position was straightforward: because it held an active government contract throughout Thomas's employment, it was shielded from BIPA liability entirely, regardless of whether the alleged violation had anything to do with its government work.
The court disagreed.
In a unanimous decision, the three-judge panel held that the exemption is not a blanket pass. The qualifying phrase in the statute does not simply mean during the time a government contract exists. It means the exemption only kicks in when the employer's alleged violation actually occurred within the scope of its government contract work. Anything outside that scope remains subject to BIPA.
The court also addressed a related question: whether the exemption is limited to employers that work exclusively for the government. It answered no. An employer does not need to be a government-only operation to claim the exemption. But the protection only extends to conduct that falls within the boundaries of the government contract itself.
Cornerstone warned the court that this reading would create a messy situation, forcing government contractors to separate parts of their workforce to comply with BIPA for some operations but not others. The court was unmoved, noting that BIPA already provides alternatives for compliance – including obtaining employee consent.
The case has been sent back to the trial court in Will County, where the underlying class action will proceed. The factual allegations have not been proven, and Cornerstone will have the opportunity to defend against them.
For HR professionals, the takeaway is immediate and practical. Employers who collect fingerprints, hand scans, or other biometric identifiers from workers and share that data with third-party vendors such as payroll processors cannot assume a government contract will insulate them from liability. The safest course remains what BIPA has always required: tell employees what you are collecting, who you are sharing it with, and get their consent before doing so.
