Illinois has enacted important amendments to its Biometric Information Privacy Act (BIPA), significantly curtailing the financial risks for corporations that violate biometric privacy protocols. The 2008 law originally mandated written consent for the collection or utilization of biometric data and allowed individuals to sue for damages of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation. However, an amendment enacted on August 2 now considers multiple violations involving the same individual’s biometric data as a single violation.
The amendment, approved by the Illinois Legislature in May, effectively reverses a significant 2023 Illinois Supreme Court ruling, which had held that companies could be liable for each instance of biometric data misuse. This decision was pivotal in a class action lawsuit against the White Castle restaurant chain, initiated by an employee. Reuters provided detailed coverage of the legislative updates and their implications, which can be found here.
Squire Patton Boggs attorney Alan Friel stated in the National Law Review that the changes would substantially reduce potential damages and lower the settlement value of BIPA claims. The new amendments also accept e-signature as satisfying the written requirement for consent.
The Illinois statute is singular in allowing individuals to sue for damages, a feature absent in other states’ biometric privacy laws, noted Friel. For example, despite the recent enactment of a BIPA-like law in Colorado, it does not include a private right of action and can only be enforced by the state.
Facebook, in a well-known case, agreed to a $650 million settlement in 2020 following allegations it violated Illinois’ biometric privacy law. Its settlement class members each received over $400. The company’s largest settlement to date, however, is with Texas, where it agreed to pay $1.4 billion following a state complaint about unauthorized facial recognition, as reported here.
Ash Johnson, Senior Policy Manager at the Information Technology and Innovation Foundation, contends the amendment is a step in the right direction, but only slightly. Criticizing BIPA for its overly steep fines and unrestricted private right of action, Johnson argues the statute caused companies to limit available technology or even withdraw from Illinois entirely. His full commentary is available here.
For further details, view Ars Technica’s comprehensive report on the subject here.