April 20, 2021

Biometric Proposals May Provide Relief to Employers and Courts

Holland & Knight Cybersecurity and Privacy Blog
Veronica L. Canton

April 29, 2021 Update: The Illinois House of Representatives failed to read Bill 559 by the April 23, 2021 deadline. The failure to read the bill terminates the legislative process to pass revisions to BIPA. One of the revisions would have removed the private right of action and transferred the right to pursue an action for alleged violations to the Illinois Attorney General and State Attorney's offices or the Illinois Department of Labor in the case of employee complaints. Due to the bill being labeled "sine die," the earliest opportunity for BIPA reform is 2022.


Earlier this year, the Illinois 102nd General Assembly introduced Senate Bill 56 (SB 56) and House Bill 559 (HB 559). Both bills propose amendments to the Illinois Biometric Information Privacy Act (BIPA). BIPA regulates how private entities collect, use and share consumers' and employees' biometric data, as well as imposes security requirements.

BIPA provides that "[a]ny person aggrieved by a violation" has a right of action and imposes statutory penalties of $1,000 for each negligent violation or actual damages, $5,000 for each willful or reckless violation or actual damages, reasonable legal fees and other relief as the courts may deem appropriate.

The proposed amendments remove the private right of action, transferring the right to pursue an action for alleged violations to the Illinois Attorney General and State Attorney's offices, or to the Illinois Department of Labor in the case of employee complaints. In addition, the proposed amendments would provide an aggrieved party recovery of actual damages for a negligent violation of the Act or actual damages plus liquidated damages up to the amount of actual damages for willful violation of the Act, reasonable attorneys' fees and costs, and other relief as the court may deem appropriate.

Effect on the Courts

In the 2019 decision in Rosenbach v. Six Flags Entertainment Corp., the Illinois Supreme Court interpreted the Act to mean that an aggrieved individual did not need to "allege some actual injury or adverse effect" outside the violation of their respective rights under the Act to seek relief. This decision opened the doors for plaintiffs to file hundreds of cases in already strained Illinois courts operating with a significant backlog, with 286 cases being filed in Illinois Courts that year.

 

 

2015

2016

2017

2018

2019

2020

Q1 2021

Total

California Superior Court

 

2

         

2

Delaware Court of Chancery

 

1

 

1

 

1

 

3

Delaware Superior Court

         

1

 

1

Illinois Circuit Court

4

3

58

74

286

95

13

533

New York Supreme Court

     

1

     

1

Grand Total

4

6

58

76

286

97

13

540

Plaintiffs filed nearly 400 BIPA-related cases in federal district courts since 2015, including many cases in the Northern District of California.

 

 

2015

2016

2017

2018

2019

2020

Q1 2021

Total

USDC, N.D. Illinois

7

7

29

16

67

114

42

282

USDC, N.D. California

4

3

3

11

3

17

 

41

USDC, S.D. Illinois

   

1

 

8

13

6

28

USDC, C.D. Illinois

 

 

1

 

4

9

5

19

Grand Total

11

10

34

27

82

153

53

370

Employees have filed many of these cases against employers alleging BIPA violations based on the use of biometric-related technologies, such as a time-tracking mechanism for employees to clock in and out of work, to provide access to company premises and other work-related tasks.

Proposed Amendments' Impact on Courts and Businesses

The proposed bills take different approaches to lessen BIPA's litigation risk on businesses, particularly on employers. SB 56 aims to slow the tide of litigation by providing all businesses with an opportunity to cure before a consumer could file suit. The bill would amend BIPA to require an aggrieved party communicate with the business to notify it of the alleged violation and allow the business 30 days to correct the deficiency. If the business cures the deficiency and communicates that to the individual, he or she may not then file suit. On the other hand, if the business does not cure the deficiency or repeats the violation, the individual can bring a cause of action within one year.

HB 559 would make more drastic changes by eliminating the private right of action and creating an administrative process for adjudication of employees' BIPA claims. HB 559 would amend BIPA in several areas, most notably by:

  • exempting violations by an employer for employment, human resources, fraud prevention or security purposes from BIPA's private right of action, instead assigning enforcement authority for such violations to the Department of Labor and requiring that all complaints be filed with the Department within one year from the date of the violation
  • providing that any other violation of the Act constitutes a violation of the Consumer Fraud and Deceptive Business Practices Act, with sole enforcement by the state Attorney General or the appropriate State's Attorney
  • exempting businesses whose employees are covered by a collective bargaining agreement that provides different policies regarding the retention, collection, disclosure and destruction of biometric information

The legislature's primary intent in passing BIPA was to provide guidelines in the use of biometric information at a time when its use was increasing in business, security sectors, security screenings and financial transactions. The proposed amendments in these bills are a recognition that the Act has been applied in ways never originally contemplated. These bills attempt to walk the line and address the negative impact of litigation on both courts and business while also continuing to provide protections for persons impacted by the use of biometric-related technologies.

We Can Help

For more information about BIPA or questions about how the recent interpretation of the law could affect your company, contact the author or Mark Melodia, chair of Holland & Knight's Data Strategy, Security & Privacy Team.

Related Insights