TIARA THOMAS v. CORNERSTONE SERVICES INC (2026)

OPINION

¶ 1 This interlocutory appeal seeks clarification on the scope of an exemption within the Biometric Information Privacy Act (Act). 740 ILCS 14/1 et seq. (West 2024). The pertinent statutory provision, referred to by the parties as the “government contractor exemption,” provides that “[n]othing in this Act shall be construed to apply to a contractor, subcontractor, or agent of a State agency or local unit of government when working for that State agency or local unit of government.” Id. § 25(e).

¶ 2 The dispute concerns the exemption's qualifying phrase “when working for” to which the parties offer competing interpretations. Defendant, Cornerstone Services, Inc. (Cornerstone), argues the phrase is unambiguous, merely temporal, and exempts a government contractor from liability under the Act during the time that it performs services pursuant to a government contract. Under Cornerstone's interpretation, section 25(e) confers categorical exemption to contractors in possession of an active government contract no matter how large or small. The exemption applies, according to Cornerstone's view, irrespective of whether purported violations occurred outside the scope of a government contract. Conversely, plaintiff, Tiara Thomas, asserts the phrase is ambiguous and the exemption only applies when the contracted entity is working as a government contractor.

¶ 3 In October 2023, Thomas filed an amended class action complaint against Cornerstone as her former employer alleging its timekeeping system violated the Act. In denying Cornerstone's motion to dismiss the amended complaint, the circuit court adopted Thomas's position that the exemption does not apply to a contractor's violations occurring outside of its government contract and granted Cornerstone's subsequent motion to certify two questions for review pursuant to Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019):

“Does the exemption under Section 25(e) of BIPA declaring that BIPA ‘shall not be construed to apply to a contractor, subcontractor, or agent of a State agency or local unit of government when working for that State agency or local unit of government’ apply to exempt from BIPA only those contractors or subcontractors who work exclusively for state agencies or local units of government,”

and

“If the answer to the foregoing is ‘no,’ what is the meaning of the phrase ‘when working for the State agency or local unit of government’ as used in Section 25(e)?”

¶ 4 Based on its plain language, we conclude that the government contractor exemption applies only to exempt a contractor from liability when acting within the scope of its government contract. We answer the first certified question in the negative and hold that the Act does not require an exclusive contractual relationship with a state agency or local unit of government for the exemption to apply. We answer the second certified question by concluding that the unambiguous construction of the phrase “when working for” is not merely temporal; rather, it also qualifies the conduct exempted such that a government contractor is immunized from liability under the Act only when its violation occurred when acting within the scope of its governmental contractual relationship.

¶ 5 I. BACKGROUND

¶ 6 Cornerstone is a corporation that provides services and support to individuals in Illinois with intellectual and developmental disabilities. It has a contractual relationship with the State of Illinois and receives funding from the Department of Human Services (DHS), a state agency. Thomas was employed at Cornerstone from 2020 to 2022. During her employment, Cornerstone allegedly tracked Thomas's time on the job through the use of a biometric time tracking system, i.e., a finger-scanning time clock.

¶ 7 Thomas, a putative class representative, filed a class action complaint against Cornerstone for its alleged violations of the Act in its unauthorized disclosure of employee biometric identifiers. The amended complaint included the following factual allegations. Cornerstone has used and stored its employees’ fingerprints for time tracking purposes since around 2008 and had its employees sign a consent form related to its biometric data collection policy. The form did not notify Cornerstone employees, nor did Cornerstone otherwise receive employee consent, that their biometric information would be disclosed to Automatic Data Processing (ADP), a third-party vendor Cornerstone used to process payroll. Cornerstone disclosed Thomas's and the putative class's fingerprint biometric identifiers to ADP in violation of section 15(d) of the Act.

¶ 8 Cornerstone filed a combined motion to dismiss pursuant to section 2-619.1 of the Code of Civil Procedure seeking dismissal, in part, on the grounds that Cornerstone's exempted status as a government contractor barred Thomas's claim. 735 ILCS 5/2-619.1, 2-619(a)(9) (West 2024). Cornerstone pleaded that it received funds from the DHS for providing housing and support services to qualified applicants with disabilities, including more than $23 million annually during the years in which Thomas was employed. Cornerstone attached a declaration of its chief executive officer, Ben Storz, to its motion averring that payments from the DHS constituted 60% to 73% of its revenue during those years. Accordingly, Cornerstone argued it was exempt from liability under the Act because it provided services pursuant to a government contract for the duration of Thomas's employment.

¶ 9 Thomas responded to the motion to dismiss by seeking leave to conduct discovery pursuant to Illinois Supreme Court Rule 191(b) (eff. Jan. 4, 2013) and moved to stay briefing on the motion. She argued the applicability of the exemption depended upon whether Cornerstone collected and handled employee biometrics while providing services pursuant to its government contract and that publicly available information made it reasonable to infer that Cornerstone was not a state contractor at all relevant times. In opposing the motion to stay, Cornerstone argued discovery was unnecessary to respond to its claim of exemption and confirmed it provides services and receives revenue outside of its state contracts. Thomas filed a motion to reconsider the court's February 13, 2024, denial of her motion for discovery and to stay.

¶ 10 On April 24, 2024, the circuit court conducted a hearing on the parties’ outstanding motions and denied Cornerstone's motion to dismiss. It questioned whether the exemption applies for work done outside of the government contractor role, stating: “[y]ou can have two separate roles I suppose you'd say. [Thomas's] whole argument is some of your work clearly is for the state” and “[s]ome of it might not be, so now you have a mixed situation.” The court contemporaneously denied Thomas's motion to reconsider the denial of her Rule 191(b) motion, ordered Cornerstone to answer the complaint, and directed the parties to proceed with discovery.

¶ 11 Thereafter, the court granted Cornerstone's motion to certify the above stated questions for interlocutory appeal pursuant to Rule 308(a). Ill. S. Ct. R. 308(a) (eff. Oct. 1, 2019). On November 19, 2024, this court entered an order denying Cornerstone's application for leave to appeal under that rule. However, our supreme court issued a supervisory order on March 26, 2025, directing that we vacate our order, allow the application, and answer the certified questions.

¶ 12 II. ANALYSIS

¶ 13 The circuit court granted Cornerstone's motion to certify questions pursuant to Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019). Certified questions present questions of law subject to de novo review. Rozsavolgyi v. City of Aurora, 2017 IL 121048, ¶ 21. The scope of review under a Rule 308 appeal is limited to answering the certified questions (Spears v. Association of Illinois Electric Cooperatives, 2013 IL App (4th) 120289, ¶ 15) and does not reach the propriety of the underlying claims (Coldwater v. Village of Elwood, 2020 IL App (3d) 190247, ¶ 13). A certified question that requires an answer that is advisory, provisional, or depends upon the underlying facts of a case is improper. Rozsavolgyi, 2017 IL 121048, ¶ 21.

¶ 14 To answer the certified questions before us, we must interpret the language of the Act by engaging in statutory construction. Statutory construction presents a question of law also subject to de novo review. Hayashi v. Illinois Department of Financial & Professional Regulation, 2014 IL 116023, ¶ 16. The cardinal rule of statutory construction is to ascertain and give effect to the legislature's intent. Mosby v. Ingalls Memorial Hospital, 2023 IL 129081, ¶ 30. A statute's language is the best indicator of legislative intent, “ ‘and we give that language its plain and ordinary meaning.’ ” Id. (quoting In re E.B., 231 Ill. 2d 459, 466 (2008)). “ ‘We construe the statute as a whole and cannot view words or phrases in isolation but, rather, must consider them in light of other relevant provisions of the statute.’ ” Id. (quoting E.B., 231 Ill. 2d at 466).

¶ 15 If the statute's language is clear and unambiguous, it must be applied as written without resort to extrinsic aids of statutory construction. Blum v. Koster, 235 Ill. 2d 21, 44 (2009). If the statute's language is ambiguous, it is construed “to avoid rendering any part meaningless or superfluous.” Id. Beyond the statute's language, in efforts to determine legislative intent, courts may consider “ ‘the reason and necessity for the law, the evils sought to be remedied, and the purpose to be achieved.’ ” Lavery v. Department of Financial & Professional Regulation, 2025 IL 130033, ¶ 22 (quoting In re Detention of Lieberman, 201 Ill. 2d 300, 308 (2002)).

¶ 16 In 2008, the General Assembly enacted the Act seeking to protect a “weary” public's “welfare, security, and safety” from the precipitously growing field of biometrics by regulating “the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” 740 ILCS 14/5(g) (West 2024). The definition of “[b]iometric identifiers” includes fingerprints and hand scans. Id. § 10. Corporations such as Cornerstone are among the defined “private entit[ies]” at risk of being held legally responsible for violating the Act. Id. §§ 10, 15. Absent consent or other exceptions not germane to our inquiry, the Act proscribes private entities in possession of biometric identifiers from disclosing a person's biometric identifiers. Id. § 15(d).

¶ 17 Section 25 delineates certain circumstances excepted from the Act's ambit. See id. § 25. In its entirety, the exemption at issue here reads that “[n]othing in this Act shall be construed to apply to a contractor, subcontractor, or agent of a State agency or local unit of government when working for that State agency or local unit of government.” Id. § 25(e). Both certified questions depend on the construction of this provision, and more narrowly, turn on an interpretation of the clause that concludes the provision—“when working for that State agency or local unit of government.” Id. This clause functions as an adverbial element of the preceding clause. Paul R. Kroeger, Analyzing Grammar An Introduction 219 (2005). Typically, as is the case here, adverbs that supply “clause information such as *** time often occur after the first auxiliary” verb. Bryan A. Garner, Garner's Modern English Usage 31 (5th ed. 2022). In this instance, the adverbial phrase modifies when the Act shall not apply, i.e., when a government contractor will be exempt. We must determine the meaning behind the adverbial phrase “when working for” in order to define the scope of the exemption.

¶ 18 Enriquez v. Navy Pier, Inc., 2022 IL App (1st) 211414-U, ¶¶ 5-6, 19, an unpublished Rule 23 order, is the only state appellate decision to date to interpret the Act's government contractor exemption. The crux of plaintiff's putative class action in Enriquez and that before us are the same. Both alleged their private-entity employers violated the Act through the wrongful dissemination of their fingerprints related to the use of a biometric time clock. Id. ¶¶ 2, 12. The employer in Enriquez, Navy Pier, Inc. (NPI), also sought dismissal pursuant to the Act's government contractor exemption. Id. ¶ 14.

¶ 19 The Enriquez court explained the government contractor exemption applies when a private entity is “(1) a contractor (2) of a unit of government and (3) was working for that unit of government at the time it collected or disseminated biometric information” and had little difficulty holding NPI was exempted from the purview of the Act under those parameters. Id. ¶¶ 19, 25. NPI's sole purpose was to develop, operate, and maintain Navy Pier in place of a local government unit that relinquished its authority over these responsibilities to NPI. See id. ¶¶ 8, 10. NPI and the local government unit entered into a lease for a nominal fee in exchange for the exclusive authority to operate and manage the pier. Id. ¶ 10. Because the local government unit was statutorily required to undertake these functions, the First District ruled that NPI held the designation of a government contractor by performing these “core governmental services” pursuant to its contract. Id. ¶ 22. It similarly held that NPI was “working” for the local government unit, which merely meant it was “in some type of employment or services relationship” with the unit. (Internal quotation marks omitted.) Id. ¶ 23. Furthermore, while not raised by the plaintiff, NPI's actions forming the basis of the class action complaint “were within the scope of its work” for the local government unit, and it therefore was exempted from the Act's purview. Id. ¶ 25.

¶ 20 Beyond the factual similarities, however, Enriquez’s guidance on this appeal's certified questions is limited. NPI operated “exclusively” for the purpose of fulfilling governmental functions for Navy Pier in place of the local government unit ((internal quotation marks omitted) see id. ¶ 8), whereas Cornerstone offers privatized services outside of its work for DHS.

¶ 21 A. Certified Question No. 1

¶ 22 The first certified question asks whether the Act's government contractor exemption applies only to contractors that work exclusively for state agencies or local units of government. Inversely, the question asks whether there are circumstances wherein a contractor that engages in private undertakings and government contracts may invoke the exemption.

¶ 23 While government contracts “must of necessity be different in nature from private undertakings” (Hunt v. Blasius, 55 Ill. App. 3d 14, 20 (1977)), nothing in the plain language of the Act rescinds a government contractor's ability to assert the exemption by virtue of engaging in separate private undertakings. Had the legislature intended to limit the exemption to apply only to contractors in an exclusive relationship with the government, it would have included language to that effect. Goldberg v. Astor Plaza Condominium Ass'n, 2012 IL App (1st) 110620, ¶ 42 (“[I]f the legislature had intended to include words in the statute, it would have done so.”). We refuse to depart from the statute's plain language by reading into the exemption a limitation that the legislature did not express. Mosby, 2023 IL 129081, ¶ 31. The language exempting a contractor's purported violation of the Act “when working for” the “State agency or local unit of government” hinges on the time and nature of the contractor's work, not the extent of its contractual relationship with the government. 740 ILCS 14/25(e) (West 2024). We therefore answer the first certified question in the negative, holding that a contractor need not have an exclusive contractual relationship with a state agency or local government for the Act's government contractor exemption to apply.

¶ 24 B. Certified Question No. 2

¶ 25 Having answered the first certified question in the negative, we turn to the second certified question, which seeks the determination of when the Act's government contractor exemption applies through the construction of the phrase “when working for.” Id.

¶ 26 Cornerstone's interpretation concentrates on the word “when,” arguing its ordinary meaning is “at what time” or “at or during which time.” Merriam-Webster Online Dictionary, https://www.merriam-webster.com/dictionary/when (last visited Apr. 24, 2026) [https://perma.cc/BC29-DZEM]. According to Cornerstone, a government contractor is exempt so long as it is working under a government contract at the same time as a potential claim arises. Thomas interprets the word “when” as a subordinate conjunction explaining under what circumstance the exemption shall apply. Read as part of a conjunctive phrase, she argues the word “when” can encompass multiple meanings: one similar to Cornerstone's construction (“at or during the time that”) and others indicating the word denotes an understanding beyond a mere timeframe (“just at the moment that” and “in the event that”). Merriam-Webster Online Dictionary, https://www.merriam-webster.com/dictionary/when (last visited Apr. 24, 2026) [https://perma.cc/BC29-DZEM]. She argues that in light of these multiple meanings, the exemption is ambiguous.

¶ 27 The Act's government contractor exemption is clear and unambiguous. The parties’ erroneous readings stem from assigning too much import on one word in the exemption which, as a result, divorces the word “when” from the remainder of the exemption's adverbial phrase. In construing a statute, we cannot view words in isolation. Mosby, 2023 IL 129081, ¶ 30. The definition of “working (for)” means “as in serving” and “to be a servant for.” (Emphasis in original.) Merriam-Webster Online Dictionary, https://www.merriam-webster.com/thesaurus/working%20%28for%29 (last visited Apr. 24, 2026) [https://perma.cc/C9BP-B87B]. Read in its entirety, the adverbial phrase is more than just a temporal question, as Cornerstone suggests, in that it exempts a government contractor at which time it is serving the state agency or local unit of government. As such, a government contractor is exempt under the Act when operating within the scope of its governmental contractual relationship. A government contractor is not exempt when it violates the Act while pursuing private undertakings outside of its government contractual responsibilities.

¶ 28 Had the legislature intended to afford government contractors categorical exemption during the time in which they possess a government contract, the exemption's qualifying clause— “when working for that State agency or local unit of government”—would be rendered meaningless. 740 ILCS 14/25(e) (West 2024). The inclusion of that phrase conveyed the legislature's intent that there must be a nexus between the violation of the Act and the scope of the defendant's work with the government for the exemption to attach. Payton v. Union Pacific R.R. Co., No. 24 C 153, 2025 WL 2462963, at *3 (N.D. Ill. Aug. 25, 2025), motion to certify appeal granted, No. 24 C 153, 2025 WL 3012662 (N.D. Ill. Oct. 28, 2025). We answer the second certified question by concluding that the phrase “when working for the State agency or local unit of government” exempts a government contractor's actions only when it possesses a government contract and its alleged violation was within the scope of its government contractual work.

¶ 29 We note that this holding is congruent with the Enriquez decision. 2022 IL App (1st) 211414-U, ¶ 25. There, NPI was created to subsume the role of the local unit of government it contracted with. See id. ¶ 8. Therefore, there was no question as to whether its alleged violations occurred when working for that governmental unit. Id. ¶¶ 19, 23. Nonetheless, the First District clarified the actions complained of arose out of NPI's contractual relationship with the local unit of government to operate and manage Navy Pier. Id. ¶ 25.

¶ 30 We briefly address Cornerstone's argument concerning the practical adverse effect of answering the second certified question in this fashion. Cornerstone forewarns that the reading that we have adopted creates an “unworkable scheme” where some operations by government contractors are exempt and others are not. Under such arrangement, Cornerstone states government contractors need to separate portions of their workforce to ensure compliance with the Act. Such concerns are beyond our purview where the language of the Act is plain and unambiguous. Parenthetically, we observe that the Act provides various alternatives for private entities to comply with the dissemination of biometric identifiers and information, e.g., receiving the necessary consent. See 740 ILCS 14/15 (West 2024).

¶ 31 The purpose behind enacting the Act and the ramifications of the parties’ interpretations may be considered. See Lavery, 2025 IL 130033, ¶ 22. It is presumed that by enacting the Act, the legislature “did not intend absurdity, inconvenience or injustice.” DeLuna v. Burciaga, 223 Ill. 2d 49, 60 (2006). Cornerstone's interpretation would afford a categorical exemption by mere possession of any government contract regardless of the contract's scope and would insulate a private entity from responsibility under the Act for all of its activities, even those not connected with the contract. That interpretation would invalidate the intended purpose of the Act, which seeks to protect the public from private entities that compromise biometric data. See 740 ILCS 14/5, 15 (West 2024).

¶ 32 III. CONCLUSION

¶ 33 For the foregoing reasons, we answer the first certified question in the negative and hold a contractor need not have an exclusive contractual relationship with a state agency or local government for the Act's government contractor exemption to apply. We answer the second certified question and determine that the plain language of the exemption and its qualifying phrase “when working for” exempts a government contractor from liability under the Act only if its violation occurred when acting within the scope of its governmental contractual relationship.

¶ 34 Certified questions answered.

¶ 35 Cause remanded.

JUSTICE BERTANI delivered the judgment of the court, with opinion.