COOK COUNTY, ILLINOIS BIPA LAWSUITS ON THE RISE AGAIN AFTER TEMPORARY SLOW-DOWN
Illinois lawmakers enacted the Biometric Information Privacy Act (BIPA) in 2008, which provides a private right of action for those whose biometric information is improperly collected, used, sold, disseminated or stored. This has opened Illinois-based businesses up to massive potential liability, but nowhere has it hit quite as hard as Cook County, which has become “ground zero” for BIPA lawsuits. From August 2017 to March 2018, Cook County courts alone have received more than 40 proposed class action complaints claiming violations of the act.
BIPA requires companies to inform an individual in writing and receive a written release prior to taking or retaining his or her biometrics. If a company fails to follow this procedure then any “aggrieved” person can seek the greater of $1,000 or actual damages for each violation negligently committed, and the greater of $5,000 or actual damages for each violation recklessly or intentionally committed.
Following BIPA’s enactment, class-action trial lawyers immediately sought to cash in by targeting businesses with often unfounded allegations of negligent, even reckless handling of employees’ and customers’ biometric information, such as iris scans, fingerprints and facial recognition data used increasingly to keep physical workplaces and sophisticated communications and cyber systems safe. These lawsuits do not allege any harm from collection of the information (which is encrypted) but seek substantial civil penalties along with attorneys’ fees and litigation costs.
Dozens of lawsuits are currently pending in courts throughout the state. For example, Wendy’s, Loews, Southwest Airlines and Amcor Rigid Plastics have each been accused of violating the law by using fingerprint scans to track employee hours. The plaintiffs complain they were not fully informed about the specific purpose and time frame for which their fingerprints were being collected, or that they did not offer written consent to the collection in the first place.
A balanced opinion issued by the Second District Appellate Court of Illinois in late December of 2017, slowed the rate of filings because the court held that “a plaintiff must allege more than a mere technical violation of BIPA’s notice and consent provisions in order to state a cognizable claim.” The plaintiffs alleged that Six Flags violated BIPA when it fingerprinted the plaintiffs without notice of—or an opportunity to consent to—their biometric collection, storage, use, and destruction policies.
Since the court’s decision, at least two Illinois trial courts have followed suit and dismissed BIPA claims; however, on May 30, 2018, the Illinois Supreme Court granted leave to appeal the Second District Appellate Court’s decision, once again opening the flood gates. Following this announcement, plaintiffs’ lawyers filed eight new BIPA cases in the month of June alone.
In 2019, the Illinois Supreme Court will decide this case, Rosenbach v. Six Flags, and determine whether BIPA’s private right of action, requires at least an allegation of actual harm from the collection of biometric information.
Due to the growing controversy surrounding the large volume of BIPA litigation, the Illinois legislature has been urged to amend the statute to limit its reach. Currently, it is considering S.B. 3053, which would carve out exemptions to the statute for entities that “collect biometric data exclusively for employment, human resources, fraud prevention or security purposes; collect biometric data but do not sell, lease or trade such information; or collect, store, transmit or protect biometric data in a manner that is equivalent to the manner in which the entity handles confidential or sensitive information.”
An amendment to the bill would go even further and expressly exclude things such as digital photographs, limit “biometric identifier” and “biometric information” by requiring the data be linked, and exempt entities that do not retain data for more than 24 hours.
If the Illinois Supreme Court reverses the Rosenbach decision, and allows BIPA lawsuits where there is no actual harm, Cook County courts can expect an even greater flood of BIPA lawsuits, and legislation like S.B. 3053 will be even more critical.
Illinois was the only state with a private right of action for violations of a biometric privacy law until California followed its poor example in 2018.