CBA Record November-December 2024

BIPA has several different ways in which holders of biometric information may violate BIPA. Section 15 provides for potential recoveries. Section 15(a) addresses the need for organizations to develop and publish written policies containing record retention sched ules. Section 15(b), one of the more often used provisions under BIPA, forbids private entities from collecting, capturing, pur chasing, receiving through trade, or otherwise obtaining a per son’s biometric identifier or biometric information without prior written consent and disclosure of the purpose and length of the term of collection, storage, or use of the data. Section 15(c) prohibits private entities from the sale, lease, trade, or otherwise profiting from a person’s or a customer’s bio metric identifier or biometric information. Section 15(c) has pri marily been used against vendors rather than employers. Finally, Section 15(d) requires prior consent before an entity may disclose, redisclose, or disseminate biometric identifiers and biometric information. Illinois Supreme Court Rules on Actual Damages In 2019, the Illinois Supreme Court handed down its decision in Rosenbach v. Six Flags Entm’t Corp., which held that “a person need not have sustained actual damage beyond violation of his or her rights under the Act in order to bring an action under it.” The court noted, “[t]hrough the Act, our General Assembly has codified that individuals possess a right to privacy in and control over their biometric identifiers and biometric information” and that the “violation, in itself, is sufficient to support the individu al’s or customer’s statutory cause of action.” The 7th Circuit Court of Appeals has reviewed standing issues as well. In Christine Bryant v. Compass Group U.S.A., Inc., the court held that the complaint had satisfied the injury-in-fact requirement of Article III concerning plaintiff’s claims under Sec tion 15(b) but did not satisfy the hurdle for Section 15(a). Illinois Supreme Court on Magnitude of Recovery In two cases in 2023, the Illinois Supreme Court opened the door to ruinous exposure for employers and potential other defendants facing BIPA litigation. The first, Cothron v. White Castle System, Inc., 2023 IL 128004, held that “a separate [Section 15(b)] claim accrues under the Act each time a private entity scans or trans mits…” The second major case was Tims v. Black Horse Carriers, Inc., 2023 IL 127801, holding a five- year statute of limitations governs claims under BIPA. If held to those standards, White Castle would have faced a potential liability of $17 billion. In many cases, general liability insurance policies have been found not to afford coverage for BIPA allegations, and at least two recent cyber policy coverage decisions have found that BIPA violations are not cyber incidents. The Legislature Amends the Statute In May 2024, the Illinois legislature amended BIPA to clarify that anyone whose biometric identifier or biometric information

is scanned may only recover damages for one violation. SB 2979 has amended BIPA in two ways: significantly limiting potential damages and updating the Act’s “written release” definition to include an “electronic signature.” The first was vital, as it reduces the separate claim analysis in Cothron, limiting Section 15(b) and 15(d) to one violation and one recovery. The next battle will be whether this amendment applies retrospectively. To date, no case has developed testing that idea.

Exemptions BIPA provides several exemptions from its coverage. One of these is the health care worker exemption in the definition of a “biomet ric identifier,” which the Illinois Supreme Court has construed narrowly. The court stated, “the exclusion is not a broad exemp tion of the entire health care industry, like the ones found in sec tion 25.” Section 25 includes exemptions from court admissions of evidence or discovery, HIPAA, Title V of the federal Gramm Leach-Bliley Act of 1999 and the rules promulgated thereunder, the Private Detective, Private Alarm, Private Security, Fingerprint Vendor, and Locksmith Act of 2004 and the rules promulgated thereunder; and contractors, subcontractors, or agents of a State agency or local unit of government when working for the agency or government. To date, little case law has developed on these Section 25 exemptions. Conclusion Practitioners should be familiar with BIPA and how it has been applied in various contexts, as it has the potential to touch on many areas of practice. Given the recent legislative changes, future developments are likely.

Daniel A. Cotter is a member of Dickinson Wright, the 2024-25 President of the National Counsel of Bar Presidents, and a CBA Record Editorial Board member.

CBA RECORD 25