CBA Record November-December 2024

What You Need to Know about the Biometric Information Privacy Act By Daniel A. Cotter

I n 2008, the Illinois legislature passed the Illinois Biometric Information Protection Act (“BIPA”). The act regulates the “collection, use, safeguarding, handling, storage, retention and destruction of biometric identifiers and information.” The law was dormant for many years, with only 15 class actions filed in its first nine years. But then plaintiffs’ lawyers discovered that statutory penalties in BIPA provided a potentially large number of recoveries, and in the next few years, the number of class actions rose from 161 in 2019, to over 1,000 suits in 2021. But, in 2024, the number declined substantially, perhaps after several settlements occurred. In recent years, the Illinois Supreme Court has issued impactful BIPA decisions. In July, Governor J.B. Pritzker signed an amendment to limit some of those large exposures. This article addresses what lawyers should know about BIPA, including how it works. what it covers, and significant recent developments. What BIPA Covers BIPA defines a biometric identifier as “a retina or iris scan, finger print, voiceprint or scan of hand or face geometry.” The law was introduced and became law in response to various stores in Chi cago, including Jewel Food Stores, setting up pilot programs in Chicago to test the evolving technology for point-of-sale finger print scanners. School cafeterias and gas stations were also testing the new technology. BIPA provides for the awarding of statutory damages in

amounts of the greater of $1,000 or actual damages for each negli gent violation and $5,000 or actual damages for intentional viola tions, plus reasonable attorney fees, litigation expenses, and costs. Putative class actions were filed beginning in 2016. In December 2016, a court approved the first settlement under BIPA. Suits have been filed against Google, Facebook, Apple, and other platforms using facial recognition software. In addition, hundreds of class actions have also been filed against employers, alleging violations of the act for failing to disclose to employ ees the storage techniques and obtaining employee consent as the statute required. For example, a lawsuit against Roundy’s in 2017, alleged that the supermarket chain required employees to use a “biometric fingerprint time clock” when checking in and out of work. Why Illinois BIPA Has Been Used So Often Illinois is the only state that has enacted legislation addressing biometric information that provides a private right of action against alleged offenders. While Texas and Washington have leg islation like Illinois’ act, as does New York City, neither permits a private right of action — only the attorney general of each respec tive state may initiate action against alleged violators. That is not to say that there are no ways for firms to obtain hefty fees. For example, Texas Attorney General Ken Paxton recently announced a $1.4 billion settlement with Meta, and the attorneys retained by Paxton stand to recover more than $300 million in fees.

24 November/December 2024