Cybersecurity Policy Report, GENERAL HEALTH CARE NEWS—N.D. Ill.: Amazon has immunity from state law privacy claims under PREP Act, (Jun 5, 2024)

By Sherri M. Schroeder, J.D.

An Amazon worker had alleged Amazon violated Illinois’ Biometric Information Privacy Act by using thermal cameras to conduct temperature checks during the COVID-19 pandemic.

The U.S. District Court for the Northern District of Illinois has dismissed the claims made by a worker against Amazon.com, Inc. and Amazon.com Services LLC for violation of Illinois’ Biometric Information Privacy Act (BIPA). The worker alleged that Amazon collected her biometric data with thermal cameras without first complying with the requirements of BIPA and without her knowledge or consent and that it shared her biometric information with other Amazon entities, third-party biometric device and software vendors, and others. However, the court agreed with Amazon that it was statutorily immune from such claims under the Public Readiness and Emergency Preparedness Act (PREP Act) as the claims were “claims for loss” that were causally related to Amazon’s use of thermal camera based on the plain text of the PREP Act. Therefore, the court granted summary judgment against the worker (Redd v. Amazon.com, Inc., No. C 6485 (N.D. Ill. June 4, 2024)).

PREP Act. On March 17, 2020, the Secretary of HHS declared COVID-19 to be a public health emergency under the PREP Act. The PREP Act was enacted in 2005 to encourage expeditious development and deployment of medical countermeasures during a public health emergency by allowing HHS’s Secretary to limit legal liability for losses relating to the administration of medical countermeasures. Following the Secretary’s declaration, Amazon began using thermal cameras to screen the temperatures of employees working in some of its warehouses, including in Illinois.

BIPA claims. A worker in one of those warehouses in Illinois alleged that Amazon violated BIPA by (1) collecting her biometric data without first providing notice and obtaining the required consent; (2) possessing her biometric data without adopting a public written policy establishing a retention schedule and guidelines for permanent destruction of the data; and (3) disclosing her biometric data without her consent.

Immunity. The PREP Act’s immunity provision states that covered persons are immune from suit and liability under federal and state law with respect to all claims for loss caused by, arising out of, relating to, or resulting from the administration to or the use of a covered countermeasure if a proper declaration of a public health emergency has been made. Amazon contended that this provision granted it immunity from the worker’s BIPA claims. The worker contended that her claims fell outside the scope of the PREP Act immunity because PREP Act immunity applies only to “certain tort claims,” and not claims under BIPA for statutory violations, and only if those claims result in one of the specific types of loss listed in BIPA.

Plain language. For the court, “[t]he starting and ending point of the Court’s analysis is the plain language of the PREP Act.” The PREP Act’s text makes clear that the worker’s suit was a claim for loss. The Act covers “all claims for loss,” and the court found the use of “all” to indicate “sweeping statutory reach.” The scope of immunity is also broad, according to the court, as it expressly applies to “any” claim for loss with “a causal relationship with the administration to or use by an individual of a covered countermeasure, including a causal relationship with the . . . administration . . . or use of such countermeasure.” Therefore, nothing in the Act limits the scope of immunity to “certain tort claims” or excludes claims for “statutory violations,” as argued by the worker.

Context. The court also looked to the broader statutory context of the PREP Act to confirm its interpretation that the Act provides Amazon immunity from suit and liability for the worker’s BIPA claims. According to the court, the PREP Act has only one exception to its grant of immunity, which is for a federal action for “death or serious physical injury proximately caused by willful misconduct.” Because the worker made no such allegations, the PREP Act’s only exception to immunity did not include the BIPA claims.

Advisory opinion. The worker also attempted to use HHS’s Advisory Opinion 20-04, in which HHS’s General Counsel stated that “PREP Act immunity is limited to claims for death, physical, mental or emotional injury, illness, disability or condition, fear of such harm or need for medical monitoring, and damage to property, including business interruption loss,” to support her claims. However, the court found the advisory opinion itself states it is not binding on federal courts and that the opinion provided no analysis for its conclusion. Because “the General Counsel’s opinion is contrary to the plain text of the Act . . . it is not persuasive and is entitled to no deference on the question of whether the PREP Act immunity is limited to personal injury or damage to property claims,” stated the court.

Causal nexus. Finally, the worker argued that her claims were not causally related to Amazon’s use of thermal cameras because her claims stem from Amazon’s failure to follow BIPA’s informed consent requirements, not the actual use of the camera systems. Here, the court found that the PREP Act’s use of the broad language of “arising out” of or “relating to” means that the use of the cameras “need not be the sole cause of her injury, but simply one that played some role in that situation, which . . . it plainly did.” Following precedent and distinguishing a case in which the PREP Act was found to not preempt an employee’s claims for financial injury caused by unpaid time stemming from an employer requirement for early arrival to allow for COVID-9 screening (see Haro v. Kaiser Found. Hosps.), the court found that since the administration and use of the thermal cameras played a role or contributed to the worker’s claimed injury, the PREP Act applied.

This case is No. 20 C 6485.

Judge: Harjani, S.

Attorneys: Ryan F. Stephan (Stephan Zouras, LLP) for Cynthia Redd and William Naughton. Ryan Spear (Perkins Coie LLP) for Amazon.com, Inc. and Amazon.com, LLC.

Companies: Amazon.com, Inc.; Amazon.com, LLC

Cases: CaseDecisions FederalLegislation Covid19 EHRNews GeneralNews HIPAANews CyberPrivacyFeed DataSecurity IllinoisNews DataPrivacy