Court Rejected Union Pacific Privacy Immunity Bid
The Seventh Circuit ruled that the rail company is subject to Illinois biometric privacy litigation.
Updated on Sept. 30, 2026 in Cybersecurity
Live Poll
Should companies be exempt from privacy laws when performing work for state and local governments?
The US Court of Appeals for the Seventh Circuit rejected Union Pacific Railroad Co.'s attempt to overturn a lower court ruling regarding privacy protections. This decision confirms that the company is not immune from lawsuits filed under the Illinois Biometric Information Privacy Act (BIPA).
Why it matters
The ruling clarifies the scope of contractor exemptions under BIPA, ensuring that private companies cannot claim immunity unless they are performing work directly for a state agency or local government unit.
The Seventh Circuit held that the BIPA exemption for government contractors applies only to those actively working on a state contract. This interpretation aligns with the unanimous view held by Illinois state courts.
The players
Union Pacific Railroad Co.
A major freight railway network that operates extensive logistics and infrastructure across the United States.
US Court of Appeals for the Seventh Circuit
A federal appellate court with jurisdiction over cases in Illinois, Indiana, and Wisconsin.
Frank H. Easterbrook
A circuit judge for the US Court of Appeals for the Seventh Circuit who authored the court's opinion.
The details
Judge Frank H. Easterbrook wrote that the statute does not grant a blanket exclusion to rail companies simply because they interact with government agencies. Instead, the court applied a narrow interpretation of the privacy provision, limiting the exemption strictly to entities performing work in the course of state or local government contracts. This ensures that private employers remain liable for biometric data handling practices under the Illinois state law.
Timeline
September 30, 2026: The US Court of Appeals for the Seventh Circuit issued the ruling against Union Pacific.
The Tech Race
This decision marks a significant development in the enforcement of the Illinois Biometric Information Privacy Act, confirming that corporate exemptions are narrowly defined by state law. It places the court in alignment with local jurisprudence while establishing a firm precedent for how biometric privacy statutes apply to large-scale infrastructure contractors.
For Illinois residents, this decision ensures that large employers remain accountable for how they collect and store biometric identifiers. Companies now face a clearer legal pathway for being held liable in BIPA lawsuits, regardless of their status as government contractors.
The takeaway
This ruling establishes that private entities cannot circumvent biometric privacy laws through broad interpretations of contractor exemptions. Readers should monitor future BIPA filings against large employers as these cases now proceed toward potential settlements or trials.
Further reading
For more on the legal landscape surrounding biometric data, visit the Cybersecurity section.
Source note: This article includes information reported by Bloomberglaw.
Live Poll
Should companies be exempt from privacy laws when performing work for state and local governments?
