The Biometric Information Privacy Act was passed by the Illinois General Assembly on October 3, 2008. Codified as 740 ILCS/14 and Public Act 095-994, the BIPA guards against the unlawful collection and storing of biometric information. When Illinois passed the law in 2008, it became the first U.S. state to regulate the collection of biometric information. Washington and Texas have since passed similar laws. However, the BIPA remains the only law in the U.S. that allows private individuals to file a lawsuit for damages stemming from a violation. The Act prescribes $1,000 per violation, and $5,000 per violation if the violation is intentional or reckless. Because of this damages provision, the BIPA has spawned several class action lawsuits.
Provisions
The BIPA requires companies doing business in Illinois to comply with a number of requirements pertaining to the collection and storage of biometric information. These include a requirement that companies:
Obtain consent from individuals if the company intends to collect or disclose their personal biometric identifiers.
Destroy biometric identifiers in a timely manner.
Securely store biometric identifiers.
Legislative History
Senate Bill 2400, which eventually became the Biometric Information Privacy Act, was introduced by State Senator Terry Link on February 14, 2008; it passed both Houses of the Illinois General Assembly on July 10, 2008 and was approved by then-Governor Rod Blagojevich on October 3, 2008. The purpose of the Act was to establish standards of conduct for private entities that collect or possess biometric information. In 2016, Senator Link proposed and later withdrew an amendment to the Act that would have limited the Act's application to biometrics collected in public.
Notable Cases
As biometric technology advances, there have been a number of lawsuits related to data collection methods, as well as various levels of protection over data. Using fingerprints as ways of clocking in and clocking out of work is an example of a technology that fights what is known as "buddy punching" or the practice of using somebody else to clock in for another worker at a job. In Illinois, the Biometric Information Protection Act law allows people to sue employers for mishandling biometric data. According to the Cook County Record, "In Illinois, both the parent company of Mariano's supermarkets and the Intercontinental Hotel Group have been hit with class action lawsuits alleging they improperly collected and stored employee fingerprints and other biometric data."
In re Facebook Biometric Info. Privacy Litig., 185 F. Supp. 3d 1155
Illinois Facebook users alleged that the social media platform violated the BIPA when it scanned images of their faces, without consent, in order to run its Tag Suggestions feature; a California federal court certified the class in 2018.
Monroy v. Shutterfly, Inc., No. 16 C 10984, 2017 WL 4099846
Google users sued the company for violating the BIPA, alleging that it created and stored scans of users' faces on its Google Photos service, without user consent. On February 27, 2017, Northern Illinois District Court Judge Edmond E. Chang denied a motion to dismiss the lawsuit but on December 29, 2018 the lawsuit was dismissed for lack of standing.
State Court Cases
Rosenbach v. Six Flags Entm't Corp., 2019 IL 123186
Six Flags was sued for collecting park-goers thumbprints without informed consent. The Illinois Court of Appeals ruled that a mere technical violation of the BIPA was insufficient to maintain an action, because it did not necessarily mean a party was "aggrieved," as required by the statute. This was reversed by the Illinois Supreme Court which ruled that users do not need to prove an injury in order to sue; the mere violation of the act was sufficient to collect damages.
Additionally, an employee of the NorthShore University HealthSystem has sued the company for allegedly collecting worker fingerprints without their consent, in violation of the Illinois Biometric Information Privacy Act. In Cook County Circuit Court, the employee alleged "that the defendant scanned and digitally collected his fingerprints without consent, for use with a biometric employee punch clock."
Settlements
On December 1, 2016 the first settlement involving the BIPA was approved by a judge in Cook County, Illinois. The class action lawsuit was against L.A. Tan Enterprises, Inc. and settled for $1.5 million, which included between $125 and $150 for each class member who filed a claim.
Challenges
There is currently a bill pending before the Illinois legislature to amend the BIPA. The bill proposes to exempt private entities from the BIPAs requirements under a number of circumstances, including if the biometric information is used "exclusively for employment, human resources, fraud prevention, or security purposes," if the company "does not sell, lease, trade or similarly profit" from the biometric information, or if the company protects biometric information at least as securely as it secures other sensitive information. SB3053 is viewed by privacy advocates as an attempt to entirely gut the BIPA. It has received significant opposition from many groups that advocate for digital privacy rights, including the Electronic Frontier Foundation. During Facebook founder Mark Zuckerberg's testimony before Congress on April 10, 2018, in the aftermath of Facebook's scandal with Cambridge Analytica, Senator Dick Durbin questioned Zuckerberg about Facebook's support for SB3053.
Related State-Level Bills and Laws
There are a number of similar bills that have been introduced in states across the country. These include:
