By Hannah Meisel
In the wake of a pair of recent decisions from the Illinois Supreme Court strengthening the State’s law governing how companies must treat employees’ and customers’ biometric data, longtime critics of the law see an opening to weaken it.
But backers of Illinois’ Biometric Information Privacy Act (BIPA) are reluctant to renegotiate the strongest-in-the-Nation privacy protections laid out in the law, and they characterize opponents’ uproar following the court decisions as “fear mongering.”
Nearly 15 years after the law’s initial passage, legal interpretations of BIPA are still taking shape, as widespread use of the technology that collects biometric data such as fingerprint and facial scans has only recently caught up to the law’s forward-looking language. The wide adoption of such technology has led to the proliferation of class action lawsuits under BIPA, creating what opponents of the law have called a cottage industry for ambitious attorneys.
A constant refrain in those suits has been that if an individual’s social security number is stolen, it may be a nuisance to get a new one but not impossible. But there’s no remedy for a stolen fingerprint, retinal, voice or face scan, they argue. Under the law, companies deploying this technology must obtain employees’ or customers’ written consent before their biometric information is collected.
Although two other states have imitated Illinois’ first-in-the-Nation biometric privacy law, Illinois is the only of the three states that allow individuals the right to sue over the improper collection and mishandling of biometric data.
Since about 2018, upwards of 2,000 suits have been filed under BIPA, followed by several high-profile, high-dollar settlements, including the $650 million Facebook paid out after settling a class action suit in 2020. Those legal developments, in addition to a series of Illinois Supreme Court decisions interpreting BIPA’s limits in ways that favor plaintiffs, have all spooked the business community.
Fast food chain White Castle, the defendant in the most recent case decided by the State’s high court, claims the court’s ruling could cost the company $17 billion – a figure that businesses warn could bankrupt entire industries.
But even in deciding against White Castle, the majority on the court sought to assuage fears that future damage awards in BIPA cases would force a company to shutter. The court wrote “there is no language in the Act suggesting legislative intent to authorize a damages award that would result in the financial destruction of a business.”
The opinion did, however, “respectfully suggest” the General Assembly review BIPA “and make clear its intent regarding the assessment of damages under the Act.”
Whether the court’s advisory will open the door to bigger changes in BIPA – or whether it will be heeded at all this year – remains to be seen, as proponents say litigation over biometric privacy means the law is working exactly as it should.
Recent decisions
Two major BIPA-related decisions from the state’s high court were issued in February. A unanimous majority found the law unequivocally provided for a five-year statute of limitations on lawsuits against companies that collected biometric information from employees or customers without proper notice – instead of the one-year time limit argued by the business community.
And two weeks later, a divided court ruled that each time someone’s biometric data is collected constitutes a separate violation of BIPA, which under the law means $1,000 in damages for “negligent” violations or $5,000 for “reckless” or “intentional” violations. However, the court didn’t rule on the question of damages specifically, which means the legal question of how damages can accrue under BIPA is still unsettled.
In that case, the justices were charged with deciding whether White Castle violated BIPA each time its employees scanned their fingerprints to access work computers and pay stubs or, as White Castle contended, whether only the initial collection of fingerprints without proper notice constituted a single violation under the law.
In a 4-3 opinion, the majority of the seven-member court – four of whom were not yet on the court when the case was argued last May – reasoned they could not limit BIPA claims to just “the first time a private entity scans or transmits a party’s biometric identifier or biometric information.”
“No such limitation appears in the statute,” the majority wrote. “We cannot rewrite a statute to create new elements or limitations not included by the legislature.”
Taken together, both the White Castle decision and the unanimous opinion solidifying the assumption of a five-year statute of limitations under BIPA have strengthened the law, but the full effects of those decisions won’t be felt until those cases wind their way back down to trial court – if the parties even choose to continue litigation instead of settling. So far, BIPA has only seen one jury test: a federal jury in October granted $228 million in damages in a class action case against BNSF Railways.
Despite the Illinois Supreme Court’s decision in the White Castle case, plaintiffs aren’t guaranteed a win when it returns to trial court; the lawsuit has yet to be certified as a class action, and would also need to go through a lengthy discovery process before going to trial.
The long road ahead for these cases is why State Rep. Ann Williams, D-Chicago, said she won’t be diving headfirst into negotiations to tweak the law any time soon. Williams, who wasn’t yet in office when BIPA passed in 2008, has taken the lead on biometric information and other privacy measures in the House. She said she’s wary of those calling for changes to the law, characterizing them as “sky-is-falling” alarmists who merely want to strip BIPA of its protections before letting the litigation continue to unfold.
“So to react immediately by making a quick change in the law without saying how things play out seems a bit premature to me,” Williams said in an interview.
But Mark Denzler, president and CEO of the Illinois Manufacturers’ Association, said he and other business leaders aren’t sounding a false alarm but are instead heeding very real warning bells.
“I had a conversation with an auto company (recently) that’s no longer going to test autonomous vehicles in Illinois because of this ruling,” Denzler told Capitol News Illinois.
He cautioned that companies becoming fearful of facing expensive BIPA lawsuits in the course of doing business – like collecting images of pedestrians while testing autonomous vehicles – will hinder goals Denzler shares with Gov. JB Pritzker, including making Illinois a leader in high-tech manufacturing.
“Certainly these decisions (from the Illinois Supreme Court) throw cold water on that,” Denzler said.
Capitol News Illinois is a nonprofit, nonpartisan news service covering state government. It is distributed to more than 400 newspapers statewide, as well as hundreds of radio and TV stations. It is funded primarily by the Illinois Press Foundation and the Robert R. McCormick Foundation.
—Capitol News Illinois