"NO-INJURY" LAWSUITS FLOOD ILLINOIS JUDICIAL SYSTEM
BIPA LITIGATION SPREADING
Illinois lawmakers enacted the Biometric Information Privacy Act (BIPA) in 2008, but it lied dormant until 2015 when plaintiffs’ lawyers discovered its business potential. BIPA provides a private right of action to a person whose fingerprint, voiceprint, or hand or facial scan, or similar information is collected, used, sold, disseminated or stored in a manner that does not meet the law’s requirements. The number of BIPA class actions surged from just 6 in 2015 to 161 in 2019.
BIPA requires companies to inform an individual in writing and receive a written release prior to obtaining or retaining his or her biometric data. If a company fails to follow this procedure or meet other requirements, then any “aggrieved” person can seek the greater of $1,000 or actual damages for each negligent violation, and the greater of $5,000 or actual damages for each violation they allege was recklessly or intentionally committed.
Following BIPA’s enactment, class action lawyers immediately sought to cash in by targeting businesses that use iris scans, fingerprints and facial recognition data that are used increasingly to keep physical work- places and sophisticated communications and cyber systems safe. These lawsuits do not allege any harm from collection of the information (which is encrypted) but seek substantial civil penalties along with attorneys’ fees and litigation costs.
In January 2019, the Illinois Supreme Court issued its long-awaited decision in Rosenbach v. Six Flags Entertainment. The Court found that a plaintiff does not need to have suffered actual harm to maintain and win a lawsuit filed under BIPA. As a result of this decision, BIPA lawsuits, which were already flooding Illinois courts, surged.
Facebook, in January 2020, agreed to pay out a $550 million settlement of a BIPA lawsuit brought back in 2015. The class action alleged that Facebook violated BIPA by collecting facial recognition data of its users without disclosure. In 2019, the Ninth Circuit allowed the action to proceed, concluding that “the development of face template[s] using facial recognition technology… invades an individual’s private affairs and concrete interests.”
Since the settlement, similar suits are popping up – a class action complaint filed in July directs a similar facial recognition suit toward Microsoft.
In another example from 2020, a franchise owner of several Illinois McDonald’s was hit with a class action alleging its locations required employees to provide fingerprint scans to clock in and out and keep track of hours in violation of BIPA. The complaint, filed in Cook County Circuit Court, alleges the McDonald’s franchise failed to inform its employees why and how it was storing their biometric data, and did not get the employees’ statutorily-required informed consent to collect the data.
In another 2020 case, an employee filed a class action lawsuit under BIPA against Chicago’s Trump Tower Hotel in Cook County Circuit Court. Included in the complaint are allegations that the hotel did not obtain written consent for biometric scanning from its staff and did not publish a policy about collection, retention, use and dissemination of information. The workers also claim the hotel disseminated biometric information to third parties for “timekeeping, data storage, and payroll purposes.”
BIPA CLAIMS NOT PREEMPTED BY ILLINOIS’ WORKERS’ COMPENSATION LAWS
An Illinois appellate court ruled that claims for actual injury under BIPA are not preempted by the Illinois Workers’ Compensation Act (IWCA). Employees are not required to file a grievance through the workers’ compensation process, and can pursue litigation against their employer. As one litigator correctly pointed out, “The statute is largely shaping up to be, for all intents and purposes, largely a strict liability statute.” And given the significance of the decision, the Illinois Supreme Court is likely to hear an appeal and deliver the final word. Illinois’ BIPA litigation has immense economic consequences for employers, and if liability continues to expand, it will ultimately drive even more businesses out of the state.
CASE TO WATCH
The Illinois Supreme Court also is considering another line of “no-injury” litigation that could impact future BIPA cases. In Soto v. Great America LLC, a consumer brought a class action suit against an amusement park alleging a violation of the federal Fair and Accurate Credit Transaction Act (because more than five digits of her credit card number appeared on her receipt). The trial court dismissed the case for lack of standing. The appellate court reversed, however, finding that plaintiffs could bring the case because the statute provides for a private right of action for statutory damages where an individual willfully fails to comply. Accordingly, the Sotos were not required to even claim that they experienced an actual injury because they had sufficiently alleged that the amusement park had willfully failed to comply with FACTA’s truncation requirement. Despite FACTA being a federal statute, the Illinois Supreme Court will decide whether a willful violation (which the appellate court viewed as simply failing to follow a requirement that a company knew or should have known of), without actual injury, is sufficient to bring a lawsuit.