On May 16, the Illinois Legislature passed Senate Bill (SB) 2979, which amends the state’s Biometric Information Privacy Act (BIPA) to limit damages available to aggrieved parties and expand how organizations can obtain consent under the law. Now subject to Governor J.B. Pritzker’s approval, SB 2979 is a direct reaction to legal proceedings resulting in multimillion-dollar losses to businesses for what many perceive to be minor technical violations of the law. Importantly, an organization can still be held liable under BIPA for unlawfully collecting or otherwise processing an individual’s biometric data and should continuously monitor its data protection programs to ensure compliance with the law.
What Is BIPA?
BIPA regulates the processing of “biometric identifiers and information” and sets forth strict requirements for entities that “possess” and/or “collect” biometric data, which includes retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, or any other information based on these types of biometric identifiers used to identify an individual.
BIPA sets forth different obligations based on whether a private entity is in “possession of, or has collected or otherwise obtained, biometric data.” More specifically, under Section 15(a) of BIPA, a private entity “in possession” of biometric data is required to undertake the following:
- Develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric data within certain timeframes
- Comply with its established retention schedule and data destruction guidelines, subject to certain exceptions
- Safeguard biometric data in accordance with certain statutorily defined standards.
Further, Section 15(b) of BIPA states that private entities that “collect, capture, purchase, receive through trade, or otherwise obtain” biometric data from an individual are required to, prior to the collection of the data, inform the individual or their representative of the collection and storage; inform the individual or their representative of the specific purpose and length of term for which biometric data is being collected, stored, and used; and receive a written release executed by the subject of the biometric data or their legally authorized representative (see below for more on the “written release” issue).
Section 15(d) of BIPA, on the other hand, mandates that private entities “in possession” of biometric data are prohibited from selling, leasing, trading, or otherwise profiting from a person’s or customer’s biometric data and disclosing, redisclosing, or otherwise disseminating biometric data, unless certain consent has been obtained, the disclosure or redisclosure completes certain types of financial transactions, the disclosure or redisclosure is required by law, or the disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.
SB 2979: Damages Limits
BIPA provides for a private right of action that allows individuals to recover statutory damages if their biometric data is processed in contrast to BIPA’s requirements, and the majority of these claims have been brought against companies that violate Sections 15(b) or 15(d) of BIPA. As originally written, a prevailing party may be entitled to $1,000 or actual damages for each negligent violation, or $5,000 or actual damages for each reckless or intentional violation. In Cothron v. White Castle, the Illinois Supreme Court emphasized that BIPA claims accrue each time an individual’s biometric data is unlawfully captured or collected, which the dissent found would impose “punitive, crippling liability on businesses” and “damages wildly exceeding any remotely reasonable estimate of harm.”
Accordingly, SB 2979 limits how individuals can recover damages under BIPA. Specifically, it amends Sections 15(b) and 15(d) to state that an “aggrieved person is entitled to, at most, one recovery” under each sub-section of law. In other words, SB 2979 limits the damages available to one violation per aggrieved person, rather than in each instance their biometric data is disclosed or collected (provided the collection occurs via “the same method”).
Importantly, SB 2979 does not amend how an organization could be liable under Sections 15(a) or 15(c). Although their provisions have not generally been the basis of the same number of lawsuits as other BIPA cases, plaintiffs may now focus on these areas as a method for generating lawsuits. In turn, organizations should continue to evaluate their liability under and compliance with all aspects of BIPA.
SB 2979: Written Release
As noted above, a written release is a key concept within BIPA, and SB 2979 amends BIPA to insert the term “electronic signature” into the definition of “written release.” Accordingly, if SB 2979 becomes law, “written release” will be defined as “informed written consent, electronic signature, or, in the context of employment, a release executed by an employee as a condition of employment.” “Electronic signature” means “an electronic sound, [a] symbol, or [a] process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record.” By adding the electronic signature verbiage to the law, SB 2979 furnishes greater flexibility to how organizations can obtain permission to collect and use biometric identifiers or information.
This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.
This document may be considered attorney advertising in some jurisdictions.
© 2024 THOMPSON HINE LLP. ALL RIGHTS RESERVED.
