Court Denied Union Pacific BIPA Immunity

The Seventh Circuit ruled that Union Pacific must face lawsuits under the Illinois Biometric Information Privacy Act.

Updated on Sept. 30, 2026 in Cybersecurity

Isometric editorial illustration of a heavy industrial steel rail resting on ballast stones, symbolizing structural accountability in privacy litigation. — The U.S. Seventh Circuit Court of Appeals ruled that Union Pacific Railroad must face potential liability under the Illinois Biometric Information Privacy Act. AI Illustration. Upload story photo >

Live Poll

Should companies be exempt from privacy laws when performing work for state and local governments?

The US Court of Appeals for the Seventh Circuit rejected Union Pacific Railroad Co.'s effort to overturn a lower court ruling that stripped it of immunity from privacy lawsuits. The decision confirms that the company is not shielded from claims brought under the Illinois Biometric Information Privacy Act.

Why it matters

This ruling clarifies the scope of protections available to state contractors under Illinois law. It ensures that businesses performing work for state agencies cannot automatically evade accountability for biometric data privacy violations.

The court determined that the Biometric Information Privacy Act only provides immunity to contractors explicitly performing work in the course of state contracts. This interpretation aligns with the unanimous view held by Illinois state courts.

The players

Union Pacific Railroad Co.

This is a major American freight railroad company that sought immunity from biometric privacy litigation.

US Court of Appeals for the Seventh Circuit

This federal court has jurisdiction over cases originating from Illinois, Indiana, and Wisconsin.

Frank H. Easterbrook

He is a long-serving judge on the Seventh Circuit who authored the opinion rejecting the railroad's immunity bid.

The details

Judge Frank H. Easterbrook authored the opinion, emphasizing that immunity for contractors is limited to specific, authorized state agency work. By denying the appeal, the court cleared a procedural path for ongoing litigation involving the collection and handling of biometric data by the railroad.

September 30, 2026: The US Court of Appeals for the Seventh Circuit issued the ruling against Union Pacific.

The Big Picture

The ruling reinforces the narrow applicability of exemptions within the Illinois Biometric Information Privacy Act. By strictly interpreting these legislative boundaries, the court has prevented a precedent that could have otherwise undermined the statute's effectiveness in protecting digital privacy.

Illinois residents involved in biometric data collection can now proceed with privacy claims against the company without the threat of a broad immunity defense. This ruling ensures that private entities must comply with state privacy standards even when engaged in contract work.

The takeaway

This decision signals that corporate contractors in Illinois must strictly adhere to biometric privacy regulations regardless of their government ties. Businesses should audit their data collection practices to ensure full compliance with the state's privacy framework.