# Oral argument — Rivera v. Commonwealth Edison Company > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/argument%3A66019 ## Record - **Collection:** Oral argument - **Document type:** Oral argument - **Published:** October 22, 2019 ## Text Please call the case. You may whoever's arguing, please step up and identify yourself. Good morning, your honors. My name is James Zuris for the plaintiff. Good morning, your honors. Neil Dishman of Jackson-Lewis, representing the defendant's affiliates. Neil what? I'm sorry. Dishman, D-I-S-H-A-N-I-N. Alright, well you guys basically know our procedure, and you know that this mic is not, it's just to record. So please speak up, 15-15-5-1-2-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4-3-4- Thank you, your honor. May it please the court. As I indicated, my name is James Zuras. I represent Monica Rivera and a putative class of employees who we contend were deprived of employment by the defendant for violations under the Illinois Employee Credit Privacy Act. The lower court granted summary judgment in favor of the defendant, holding that the plaintiff had access to confidential, private, personal information as a matter of law, so that she fell within an exception. Her job duties fell within an exception under the We do not. We do not, your honor. We do believe that the lower court made a mistake. This is only the second appellate court case, we believe, to be heard under this act, the first one being the Olay case. We would respectfully ask the court to reverse the grant of summary judgment and remand for further proceedings, including trial. The basic facts are pretty straightforward. Ms. Rivera, Monica, like many Americans, found herself unemployed. She applied for a entry-level, part-time, hourly paid position at ComEd in their call center. All they required was a high school diploma or its equivalent. She interviewed. ComEd gave her an offer. They then ran her credit, and they revoked the offer based on her credit score, and that was the only reason she was Now, we know under the act that there is a prohibition on making hiring decisions based on somebody's credit score. The question here is whether ComEd met its burden to prove that a exception to that act, specifically that she had access to personal and confidential information as a matter of law, so as to deprive her of employment. Ms. Rivera agreed. She got the We, that's correct, Your Honor. We are saying, we are arguing that she did not have access within the definition of the act. So this is one of those one-word cases? This is one of those one-word cases, as Olay was. Unfortunately, the statute itself does not define the word access, and so we have to look at context to figure this out. We don't think she has access, or this job had access, as contemplated by the act. We know from the teaching of Olay that simply transferring information, being a conduit for information, if you will. That's true. As in Olay, she did get it over the phone from a customer. No dispute about that. We're not suggesting that she has not given confidential private information over the phone. She was. As in Olay, where the plaintiff in that case was given private personal confidential information. Well, one could argue that in Olay, the employee was given the private confidential information by a potential credit card applicant. Right. On a piece of paper that she didn't necessarily look at, she didn't necessarily read, the managers were supervising that they didn't open them and look at them. You know, that's a whole different thing. In this case, the customer is speaking directly into the headset that your client is listening to. That is absolutely correct, Your Honor. And we're not acknowledging that reality that in Olay, information was provided in a written form, which the employee in that case may or may not have used. Although, in fairness, they certainly had every opportunity to do that. I think it would get us off track if we sort of discussed the points of order. Okay. It would just stick to what actually happened with your client. Your client heard the information. Yes. And had to input it into a computer system. Absolutely correct. And there's a piece of paper on her desk, and it's not a policy, but it's there for the convenience of the employee so that in case she needs to jot something down and the customer is speaking too quickly or she needs to double check some information, she can make a note of it. That is absolutely correct. And to take that one step further, if I may, it's also the policy that they have to destroy that piece of paper before leaving the room. They're not allowed to take that with them and so forth. Well, you could argue that everybody has a camera in their pocket with their cell phones, so destroying a piece of paper 10 minutes later doesn't tell you anything about what's really going on. There's no question that if somebody were so inclined, there is a means, I suppose, by which to take information out of the room. Somebody could memorize it. We acknowledge that. Somebody could take a picture of it. Somebody could take a... That they could do. They surreptitiously. Surreptitiously, they could do that. On a one-off basis, they absolutely could do that provided the supervisor isn't looking and the employee is willing to break company policy and so forth. All that is true. They could do... You're taking it down from the customer? Did you say Jones, J-O-N-E-S? Did you say 1-2-7-6-9? You could record it? It is conceivable. Yep. Can be done. All right. We agree on that. We agree on that. Sure. Absolutely. Do we also agree that the person who holds this position has continuing access to this database of information, unlike the other case that you were discussing? We... So we don't have an agreement on that. Well, you might disagree as to the extent of what the person can access due to the social security numbers and for how long, but I don't think you can dispute the fact that this position has continuing access to that database. Well, here's what we do dispute, that there is access to the last four digits of a social security number. That is the only thing. Along with a whole host of other information, which is the database. No. We don't agree on that. What we do agree on is the database is encrypted and that there is only limited access... What do you mean by encrypted? In your brief, you give two varying attempts at what you think it means. Well, it's unavailable. It can't be accessed by the employee or anyone else. What's unavailable? The data is unavailable. What data? Because a lot of it is available. But most of it is not. Such as what? Most of the social security number. Only the last four digits is available. After a certain time frame, but you would have to agree that up until a certain time frame, even that whole social security number is available. Under certain circumstances, and that is only when a customer under very, we'll call them unique, unusual situations, calls up. And we've identified three areas, we believe. So, somebody calls up and it turns out that they've presented a duplicate social security number. In that instance, the employee does have access to the full social security. Well, there are a number of instances in which the employee would have access to the full social security. Two others. Two others. There's a situation where if somebody calls up and says, I've filed for bankruptcy, then there is that limited event where somebody could have access to the full number. Or where the social security card is presented in person to the agent. That's pretty significant, what you say. Well, here's the problem. There's really no evidence in the record as to how often, if at all, these events ever really happened. What it means is that we can conceive of a lot of situations where an event might be, you know, it could conceivably happen, but it is not really a job duty. It's not really a normal job requirement. It's not part of the job. In other words, we can't say that somebody, an employee, in some one-off circumstance, some weird circumstance, may have access to something without any corresponding idea as to, well, how often does it happen? Daily? Monthly? Yearly? Ever? Because there's really no record evidence in this case on that part. And that's where I think we get caught up. There's also this problem where even that access is limited based on time. So we have this reference where it's up to 22 days or something. Now, up to 22 days can mean an hour. It can mean a week. It can mean any number of things. So we really have some vagaries here on exactly when that can happen. I don't think anybody disagrees is that it is not a situation where the employee, the CSR, can get into this database at will, no matter when they want to, for whatever purpose they want to, and access everybody's social number or everybody's credit card number or everybody else's, you know, personal information. It's just not part of their job. They can do it under limited circumstances that appear to be extremely rare, unique. And we say that because we're not getting good information at all on, does this really happen? How often does it happen? So we think there's potential for abuse here if we say that, well, we can think up ways, situations, where an employer could tell the employee, hey, if this really weird event happens, okay, well, then you have access to it. Or if this really weird event does not happen, well, then you can have access to it. But for the most part, for the lion's share of the data, for the lion's share of the time, for the lion's share of the duties, it's pretty much uncontested that this customer service representative in the call center doesn't really have access to that information Every new customer has to give the customer representative this information. Oh, yeah, that part. We've already agreed that at the moment that you take that information, John Smith, Social Security number, blah, blah, blah, blah, they've got access to that information. They get that information in their headset over the phone, however they get it. They get it. They have it. So if we're talking about that, you know, three-minute conversation with a new customer to set stuff up, they have got that on their computer screen, maybe on the piece of paper that they just wrote on, maybe in their purse, maybe on their phone. But every single new customer, you're trying to limit it to these three exceptional circumstances. That's not really accurate. Every single new customer has support over this information to this person that they don't know at the other end of the phone. Yes. And to be clear. So it could be millions. It could be hundreds of thousands. It could be, I don't know what their average daily, you know, customer care service people do, but say they talk to 100 people, that's 100 Social Security numbers that they got matched up with names and addresses. It is, we don't have the exact number of people that they would have gotten. More than one. Oh, it's more than one. It's probably more than a dozen on a daily basis, you're on, right? We understand that. The reason we went to the discussion on the three limited circumstances is because we were really struggling with how to distinguish a lay from this when it comes to getting the information in the first place because to be as fair as possible, everything you're saying with respect to their ability and their access to the information applied in that case as well because in OLA they can read all this information, including credit card information. They could have filmed it. They could have recorded notes about it. They could have taken notes about it. And that's why we said, okay, so what is really different about the facts of our case versus OLA? It's simple. The ability to have access to it in the future or not have access. Well, if it's that simple, then. It's pretty straightforward. And that's the distinction of those two cases. Well, then we're going to have to say that even the most hypothetical, conceivable, theoretical access in the future is enough. And I just don't know that that's what was intended. Well, I realize that this may not have been written the most explicit way it could have, but it has been written to try to protect the customer or the people in that. So, therefore, it's not going to be a perfect law, but it does what it's supposed to do, and it did what it did, and it worked in OLA and it's working here. I mean, in the end, it's a balancing test. You know, the company has an obligation to protect this data regardless. So we understand that. And they have safeguards in place for that purpose. In fact, they've created this encrypted database for this information where it's secure. It's placed in a locked safe. It would be impressive if they weren't the ones that put it into the database. If some third person put it in the database and customer care just answered the customer's questions about their bills or something, and they had to pull it up from CMIS, and in that case they only got the redacted screen. If they don't get the redacted screen, they sort of create the screen from the information that the customer has given them in the first place. So I go back to my original point. This is slightly different than OLA. It's slightly different. It's supposed to be shoved into a drawer. Whether it is or not, we can't get into it. But this is directly into your client's head, into her ears. Yes. And that's what we're struggling with. Is it enough, I guess, is what we just said. Is that enough to say that this brings us out of what was, I think the explicit word, was conduit in OLA as opposed to what is happening here. We are having a hard time seeing what these folks do as something above and beyond being a conduit. You know, it would be one thing if the evidence showed something like, okay, they put the information in, and then at will, whenever they like, they can get whatever information they want. Well, it takes 10 seconds to steal an identity. And you realize what happens once this is unleashed. You realize they can buy a car using it. They can get a mortgage using it. They can buy property. So the law should protect, and it should be extreme protection in this situation, not minimal. Although in your OLA, did you argue that case? I did, Your Honor. In that case, although one justice here thinks that's wrongly decided, but I'm saying that is the edge. That's the edge. And so I think that in this situation, it's clear that, you know, you argue the three different things, and you don't like the word or in it, so you think you need all three when you only need one. But the point is, it was put there to protect the average person. And having gone through this once for two years, I have to say I understand what people go through. I have a couple of comments on that, if I may, Your Honor. You know, if somebody is a daft thief, if that is really what they want to do, I don't think they would, you know, choose this method to do it, where they can't. The car dealers have a horrible time with this, because they hire these people, and they're supposedly experts in the financial end of it, and half of them are thieves. And that exactly, I think, establishes what I'm trying to say, that in that instance, I bet it wasn't a one-off theft. It wasn't a one-person situation. I bet it was done on loss, all at the same time. No, the average car dealership has the problem that they hire these people, and they last about two months, and they only do it a couple of times. Right. And then they sell it to somebody. And then they move to another dealer before they're caught. And you know what they sell? They don't sell one or two social numbers. No, no, they do. They do. The professionals do, exactly that. Aren't you also minimizing the access that these customer service reps have to this encrypted information? I mean, you're kind of focusing on the last four of the social, but that's not all that's in there. They have continuing access to that, bank accounts. But there's no evidence of that. That's just not the case, that they have continuing access to that information. That is the case. That's their job. They access that information. Not after it's put in. So after it's put in, after it's put in, they have access to it. Then you call when you're calling a customer service representative. Hi, I want to change my address. Whoa, whoa. I want to check my account to see why the balance transfer I made didn't go through. Where did it go? Well, that's the case. But in terms of what the evidence reveals in this case for these CSRs, their particular job duties, the evidence is pretty clear that, okay, they can access the last four digits of a social number, which there's no black market for that, so we understand that. And then there are these three areas, these three circumstances. If the customer says this, well, within this limited time period, then they can get to that. They can get to additional information, like the full social number. But a few things. Are you standing here telling us that the only thing they have access to is a social security number? Well, I think that is what we are defining as personal, confidential, sensitive information. So you don't consider a bank account to be personal and sensitive? No. Well, no, I would consider that to be sensitive information. Or a credit card account number. Exactly. No, I consider that to be sensitive information, too. I think what I am saying is that I'm just talking about the time after this information is put in, what they have continuing access to. And other than these three circumstances, if I can be corrected, the record evidence is not that they can at will continue to access that type of information after it is placed in the encrypted database. And so because of that, that is why we believe this is distinguishable from a situation where, again, whenever you want en masse. Yes. It is, again, minimizing all of the new customers. Every single new customer, the customer service rep validates the customer's identity by requesting the customer's name, full social security number. After it is validated by Equifax, then the customer service rep asks for more information, including the new customer's date of birth and driver's license number. So all the while, whether it takes a minute, whether it takes 30 seconds, whether it takes two minutes, whether they have to ask for re-spelling of the name, can I get that number back again? You're saying that getting that information is not the same as accessing it. Let's just talk about new customers. Let's talk about the three other situations. Or, okay, it's been shoved into the CMIS system, and if they want to pull it up for these three sort of exceptional situations, some of it is cleaned up a little bit, redacted, so they only get the last four numbers of the social, and maybe they only get the last four numbers of the driver's license, whatever. We're not talking about this. We're talking about the hundreds of thousands of new customers every year that come in and talk to these people into their ears and give them this information that they don't want everybody else to have. I can't comment on the number of people because there's no evidence about that, but everything else you said happens. So that person, at that moment, before putting the information, or at the same time. Would you agree that having it, getting it, having it, is the same as having access to it? Because they've now got it. They've got it on their screen for a couple minutes before they push the button to echo text. They've got it. They can write it down. They can take a picture of it. We've already gone through that. So clearly have access to it in that finite period of time that they're getting it from the new customer. Under a definition of access, of course, just like in Olay, under a definition, that person. Olay is different. It's not a separate piece of paper. It was. There's no requirement that the customer from the cashier or the salesperson look at that piece of paper They may have done that, but there's no requirement. But here there is a requirement. They have to hear the information and enter into the system. I follow what you're saying. Are you going to move on to other points? Or are you done? Or have you got other points? I realize we've been asking you a bunch of, but they're becoming repetitive. No, no. You've got three potential arguments, and I haven't heard you argue the other two. Well, I appreciate that, Your Honor, and I appreciate the questioning as well. The lower court also talked about how it didn't believe these were, quote, unquote, low-level employees focusing, again, on the amount of money that they conceivably could have made or she could have made if she were a full-time employee, if she really did all this. I mean, it's just she didn't make a salary. The lower court said she did. It's undisputed. She was paid by the hour. She was a part-time employee, not a full-time employee. And regardless, I don't know that a salary by itself tells us much about low-level or high-level. I think we have to. It's twice the minimum wage. It is. Absolutely. Absolutely. But, you know, it is. She's the one who chose to work part-time, right? I mean, she applied for a part-time job? Yes. But she applied for a full-time job, too. Presumably. Yes. Absolutely. It's still at the $31-plus. To the best of our knowledge, yes. It's a starting salary. Yes. Now, the distinction between this and your favorite case is that this situation is a high level of responsibility, whereas the other one is not. I don't know that it's much higher than the other one. I mean, it requires a high school equivalent. Which is meaningless in this situation if the person is properly trained. I think that's fair, sure. But in terms of, like, the absence of their discretion, the absence of their ability to supervise other employees, for example, or the amount of control they may have over their day-to-day duties, I mean, yes, I suppose they're at a higher level than the employee in a lay, but I don't know that they're at a non-low-level employee status. Whatever that means. And we're kind of struggling with a lot of these words that unfortunately aren't defined. The definition in the dictionaries is low importance or rank, and I don't see that that has any meaning here. It very well may not, Your Honor. It's just something that the lower courts seem to talk about, and so we thought we should address it. The other issue was the select few language. Was this person within the select few? I think it's pretty well uncontested that there are, at any given time, approximately 500 customer service representatives in the same position. Out of 10,000 or 15,000 employees. Yes. And that's not counting the other departments for which we don't have information on the exact numbers that also indisputably have access in billing, security, you know, the new business departments. There's other employees other than these folks at ComEd that clearly have access. Okay. So if you had to supervise that number of employees, you were Mr. ComEd, and you had 115,000 employees that were every day getting this information in their headsets. Right. And you knew that if there was an invasion of privacy or identities were threatened or stolen, that somehow you were going to be responsible for that. Right. Just as a matter of common sense, wouldn't you say, you know, I want to make sure that the people getting this information are the least likely people in the world to be tempted to steal it? I don't know that I can disagree with that as far as it goes. I'm not saying that all of these employees are tempted to steal it. Right. I'm not saying that most of them are tempted to steal it. Right. But just as a prudent business person, wouldn't you want to make sure that you reduce that probability to the lowest number possible? Probably, and I would want to make sure I do it within the confines and the competing interests of folks, you know, to be given a second chance, I suppose, for gainful employment. The position involves access to personal and confidential information, and we've agreed that getting the information in the first place is having access to it. Right. So what's left? Well, I guess what's left is the idea that, you know, the exception here may swallow the rule, not just for these folks, but, I mean, we can all envision, you know, a vendor at Wrigley Field has a driver's license to check, you know, somebody's age. On that ID, imagine what's on there. You have a driver's license. You have a birth date. You have an address. You have a blood type. You have their physical characteristics, their height, their weight, and so forth. No question, they're required to read it. They are getting it. They have access to it. And now we would say that somebody can't be a vendor, for example, at Wrigley Field, and they have no protections under this Act because of that fact. Also, bars, you know, restaurants, similar situations. So absolutely, you know, ComEd is right to take steps to protect the information and is right to impose security. For example, they have people listening on the phone. So do you think it's situational? I mean, the guy who's hearing the beers down the aisles at Wrigley Field, he says, I need your driver's license. He's got 30,000 people watching him, and he's lugging a cart of beers around. Do you think he's writing down that driver's license somewhere? Could it be situational? Oh, I think everything is situational. And I think it has to be driven by the context of the particular facts because, again, we just don't have a lot of guidance here on exactly what's the definition of access. And we are struggling with it. You and I have agreed that getting the information is having access to it. They get it in their ear. They see it. They write it down. They put it in their computer. That's access. We've agreed that under one possible definition of access, that's access. But is it access as defined in this statute? It doesn't define access. Exactly, exactly. So we have to parse it out. Exactly. That's what we're talking about, these one-word cases. One person's fun is another person's misery, Your Honor. We're not going to get into what is is. Let's move on. We will. Thank you. So, you know, again, I'm sure my time is probably well past us at this point. But I just, you know, this is on summary judgment. This is the defendant's burden to show as a matter of law in the light most favorable to us that no reasonable trial or fact could ever think this is not access. And we just don't think the defendant has met their burden to do that. So we would respectfully ask the Court to reverse the trial court's grant of summary judgment. Thank you. Thank the Court for its time. Thank you. Good morning again, Your Honors. Again, I'm Neil Dishman with Firm Jackson Lewis here for the defendant appellees. May it please the Court. The question this appeal presents is whether CSRs have access to confidential information. I think the easiest way to get at the answer to that question is to look at it from the CSR's perspectives. So I'll ask you for a moment. Put yourselves in the shoes of a CSR who is working out in Comet's call center in Oak Brook right now. When this CSR arrived at work today, one of the first things that he did was log in to the CMIS or SIMS database. All day today, he will be working in that database. As he's fielding calls from Comet's customers, whether new or existing customers, this CSR is retrieving information from that database, viewing information in the database, putting new information into it, using that information in various ways. He is the main keeper and user of the information in that database, and he will not log out of it until it's time to go home today. So what information is in this database? For starters, the following pieces, some combination of the following pieces of information, partial Social Security number, partial driver's license number, bank account information, date of birth, address, billing and payment history. That information is in this database for every one of the over four million current and former customers of Comet. In other words, this CSR who is sitting at his computer at our call center right now can access all of that information for four million people at any time he chooses for so long as he is a CSR. Beyond just that, there's a smaller subset of Comet customers for whom their full Social Security number is visible in the system. Now this is a more limited set of customers, and it's more temporary than the other information I just described, typically lasting anywhere from a couple days up to a few weeks for any particular customer. But for those customers whose full Social Security numbers are visible in the database right now, our CSR who is working there right now or any of the CSRs can access and view that information any time they choose. So again, the question in this appeal is that situation that I've just described, that CSR I've just described, does this person have access to confidential information? We believe the answer is of course he does. He's swimming in confidential information. He spends all day working in a database that is full of our customers' confidential information. So Ms. Rivera's task in this appeal then is to convince this court that somehow the situation I just described does not add up to access to confidential information. And the only way she can do that is by taking the word access and the word confidential and twisting them beyond recognition. If I may, I'll spend a few minutes on that word access. We do have some, even though the statute doesn't define it, we do have some prior guidance as to what access means. That's a sports decision in Oley v. Neiman Marcus. That was the key issue in that case. And the logic of the Oley ruling firmly supports Comet's position here. The key distinction between, distinction is plural, between the employees at issue in Oley and the employees at issue here is that the employees in the Oley case sold dresses at a retail store. They would sometimes receive a credit card application from a customer. That application would have confidential information on it, full Social Security number, bank account information, and so forth. But critically, what that employee at Neiman Marcus would do with that information is then either input it into a computer or in some cases just hand it off physically to another department or that department to keep and use that information. The employee would then never see that information again. They did not even have access to the database in which that information was kept. After they handed off that information, they would just go back to selling dresses. That was their job. The question in Oley is whether or not that counted as access. And the court in Oley found that that was not access, basically because it was such a temporary and fleeting touch with the information. The distinction the Oley court drew, they said, this person who's selling dresses and occasionally takes a credit card application and gives it to someone else, that's not the person who meets the exemption. The people who meet the exemption are the people that she gives the information to. So she's a conduit who hands off this information to someone else who keeps the information and uses it for various purposes, such as, the Oley decision specifically mentioned, people in the customer service department. Those people, those are the ones who meet the exemption, not her. This case, Your Honors, presents exactly that question. The CSRs in this case are those people. They're the ones who are the primary keepers and users of this information, unlike in Oley. That's the distinction, the key distinction between the two cases. So that's why I say that the logic of the Oley decision, the line that the Oley court drew is what demands that the CSRs in this case meet the exemption. I also want to correct, if I may, Ms. Rivera's attempts, particularly in her briefs, to misstate or overstate her argument here. She said in her briefs, and counsel alluded to it here a few minutes ago, they believe that our reading of the exemption and our reading of Oley is so broad that the exception would swallow the rule, that every customer service representative in the state of Illinois would then be exempt. Or a beer vendor at Wrigley was the example that counsel disused. That is not our position, and it's also not accurate. We are not claiming that everyone in Illinois who has the title of customer service rep, and certainly we're not claiming anyone who's selling beer at Wrigley Field meets this exemption. Only the subset of customer service representatives who actually handle the kind of confidential information that's at issue in this case would meet the exemption. There are plenty of customer service reps out there who perform customer service functions, but presumably do not deal with things like people's full Social Security numbers. To use the example of the vendor at Wrigley Field, I've been to Wrigley Field a number of times. I've never given my Social Security number to a vendor at Wrigley Field, nor does that vendor have access to a database that includes my Social Security number or a portion of my Social Security number and that of 4 million other people. So the parade of horribles that Ms. Rivera is urging is going to follow, a ruling for comment here is just not going to follow the exemption, not swallow the rule in this case, as the court feared it might in Owing. I also want to address some points discussed earlier regarding the issue of full, The record in this case is undisputed that there are situations where not just in the examples that Your Honor was giving when the CSR initially takes the information, the full Social Security number, but then at any time there are certain customers whose full Social Security numbers are visible in the system to any CSR. Those are the three examples that counsel was referring to. It's when there's a Social Security mismatch. In other words, a new customer gives a Social Security number that is already associated with another account and that has to be resolved. Also, if a customer calls and says they've gone into bankruptcy, and also in the situation where a customer prefers to give a physical form of ID rather than giving their Social Security number. Those are the three situations that the briefs in counsel were referring to where the full Social Security number isn't visible for some period of time. Counsel earlier described this as unique, unusual, could-possibly-happen type of situations. That is not the case. There is unrebutted testimony in the record that these things happen frequently. We have declarations in the record from Eric Leslie. Eric Leslie is one of the people who trains CSRs. And also from Kit Adorsi. Kit Adorsi used to be a CSR for several years and has since become a supervisor of CSRs. Both of them said in unrebutted declarations that these situations happen frequently. That is why ComEd trains CSRs to know how to handle those situations. I can't give you statistics as to exactly how often this happens or how many times a year full Social Security numbers become visible for some period of time. But there's unrebutted testimony that it is frequent, not unusual. It's key to understand, too, that this is not just limited to the CSR who happens to put that full Social Security number into the system. To use the first example, a customer calls up wanting to set up a new account, gives a Social Security number, that gets flagged in the system because that Social Security number belongs to another account already. In that case, the CSR who is handling the call will put some information, including that full Social Security number, into what's called a workflow management form in the system. It's a WFM. The CSRs actually call them WFMs. So not only the CSR who creates that WFM with the full Social Security number in it can then access it for as long as it's active. Any CSR can look at any WFM at any time. Council also made some comments or arguments about these concepts of low-level employees or a select few employees, which candidly confused me because I thought I heard Council say at the beginning of this argument that they agreed that there's confidential information at stake here. And those two concepts are just part of the potential definitions of confidential information. So unless the Court has any particular questions on those aspects, I'll skip over those. So for those reasons, we believe that not only is there confidential information at stake in this case, but also that the decision in OLE, the reasoning of OLE, demands that we also find that this counts as access to that information where the facts of the OLE case did not. One other concluding thought, too. I want to jump off a point I believe Your Honor made about the balance that the legislature was trying to strike here. The legislature clearly was... The main thrust of the statute is to provide some protections for employees and applicants. The legislature has made the judgment that for most jobs in Illinois, credit should not be a factor. And even people with bad credit should be able to compete for those jobs without it being disqualifying. However, the legislature struck a key balance here in that it's not just the interests of applicants like Monica Rivera to positions like this that need to be protected. The people who really need this Court's protection today are the 4 million innocent consumers who have entrusted ComEd with this sensitive personal information. Keep in mind also that these 4 million folks in the database didn't really have a choice as to whether to share this information. Anyone who lives in northern Illinois and who wants electricity, which is pretty much everyone I would assume, has to have an account with ComEd. They have to give this information to ComEd, and they trust ComEd to do everything that it can to protect that information. And so the balance that the legislature struck here is that while protecting most employees, most applicants for most jobs from their bad credit or their credit being a factor, the legislature recognized that in circumstances where an employer is going to trust someone with the most sensitive financial information of their customers, the employer should be entitled to consider how that person has handled their own finances. That's the balance that the legislature struck. That's why the exemption exists. And so, again, the folks here that need the Court's protection today are those 4 million people who are counting on ComEd to do everything in its power to use every tool at its disposal to protect this information without which their identity could be stolen. For that reason, for those reasons, we believe that the Circuit Court made the correct decision here in finding that the CSRs were exempt and that it was correct in granting summary judgment to ComEd, and we ask the Court to affirm that judgment. What did you think of the Olay decision? Did you think it was a good decision? Well, I argued it, and I was on the losing end of it. So I can't say I enjoyed it. Also, you guys have been together once before. We have. We have. But I think the key point here is that affirming the Circuit Court's ruling today, regardless of what any one of your honors might think of that decision, does not require you to determine whether or not that decision was wise or well-reasoned or not. Rightly or wrongly, Olay drew a line, and all we are asking is for the Court to recognize that this position falls on the other side of that line. Thank you. Thank you, Your Honors. Well, we certainly can all agree that it's important for companies to use proper tools at their disposal to protect sensitive data. They have to do it without running afoul of the law. We acknowledge, as we have gone over, that when these folks are on the phone with a new customer, and by the way, we don't know how often a new customer is on the phone, but, you know, presumably it's a certain percentage of their activities, that they do hear the full version of this information. Afterwards, I think it's pretty clear, and there's really nothing disputing what we're saying here, nothing in the record, nothing from counsel, that after that point there's no full access to anything other than in three situations where we talk about at length. And counsel has indicated that they have some evidence that those events, those three events, happen, in their words, frequently. But it's not frequently enough to say once a day, once a week, once a year. There's just nothing in there. It's just one person's, basically, opinion on what frequently may mean. And, of course, everybody's definition of that word could be subject to a difference of opinion, too. If there's nothing else, I will conclude my remarks. Thank you very much. Thank you, Your Honor. The arguments were interesting and entertaining, and it's kind of a special case knowing that you guys have previously dealt with each other, so that's kind of interesting. And the briefs are very well done. I appreciate your time and effort. Thank you, Your Honor. Thank you. --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/argument%3A66019. Public record. Not legal advice.