Biometric Information Privacy Act
Illinois set forth the Biometric Information Privacy Act on October 3, 2008 in an effort to regulate the collection, use, and handling of biometric identifiers and information by private entities. Notably, the Act does not apply to government entities. While Texas and Washington are the only other states that implemented similar biometric protections, BIPA is the most stringent. The Act prescribes $1,000 per violation, and $5,000 per violation if the violation is intentional or reckless. Because of this damages provision, the BIPA has spawned several class action lawsuits. Provisions. The BIPA requires companies doing  business in Illinois to comply with a number of requirements pertaining to the collection and storage of biometric information. These include a requirement that companies: Standing. BIPA is the only law in the U.S. that provides a private right of action to any individual who is aggrieved by a violation. However, in order to litigate a BIPA action in federal court, the aggrieved person must have federal constitutional standing otherwise known as Article III standing. Generally, Article III standing requires that a plaintiff suffer an injury to a legally protected interest that is causally connected to the defendant's conduct  and such injury will likely be addressed by a court's decision. Legislative history. Senate Bill 2400, which eventually became the Biometric Information Privacy Act, was introduced by State Senator Terry Link on February 14, 2008; it passed both Houses of the Illinois General Assembly on July 10, 2008 and was approved by then-Governor Rod Blagojevich on October 3, 2008. The purpose of the Act was to establish standards of conduct for private entities that collect or possess biometric information. In 2016, Senator Link proposed and later withdrew an amendment to the Act that would have limited the Act 's application to biometrics collected in public. Proposed Federal Regulation. The National Biometric Information Privacy Act. On October 3, 2020, Senator Jeff Merkley introduced the National Biometric Information Privacy Act of 2020 (Senate Bill 4400). While the Act contains provisions similar to BIPA it is more expansive than BIPA. If passed, the Bill would be the first of its kind to regulate biometric information on a national scale. Notable cases. As biometric technology advances, there have been a number of lawsuits related to data collection methods, as well as various levels of protection over data. Using fingerprints as ways of  clocking in and clocking out of work is an example of a technology that fights what is known as "buddy punching" or the practice of using somebody else to clock in for another worker at a job. In Illinois, the Biometric Information Protection Act law allows people to sue employers for mishandling biometric data. According to the "Cook County Record", "In Illinois, both the parent company of Mariano's supermarkets and the Intercontinental Hotel Group have been hit with class action lawsuits alleging they improperly collected and stored employee fingerprints and other biometric data." Federal court cases. "In re Facebook  Biometric Info. Privacy Litig.", 185 F. Supp. 3d 1155 (N.D. Cal. 2016) "Monroy v. Shutterfly, Inc.", No. 16 C 10984, 2017 WL 4099846 (N.D. Ill. Sept. 15, 2017) "Rivera v. Google, Inc.", 238 F. Supp. 3d 1088 (N.D. Ill. 2017) "McDonald v. Symphony Bronzeville Park LLC", N.E.3d (Ill. App. Ct. Sept. 18, 2020). State court cases. "Rosenbach v. Six Flags Entm't Corp.", 2019 IL 123186 Additionally, an employee of the NorthShore University HealthSystem has sued the company for allegedly collecting worker fingerprints without their consent, in violation of the Illinois Biometric Information Privacy Act. In Cook County Circuit Court, the  employee alleged "that the defendant scanned and digitally collected his fingerprints without consent, for use with a biometric employee punch clock." Settlements. On December 1, 2016 the first settlement involving the BIPA was approved by a judge in Cook County, Illinois. The class action lawsuit was against L.A. Tan Enterprises, Inc. and settled for $1.5 million, which included between $125 and $150 for each class member who filed a claim. In February 2021, Judge James Donato approved a $650 million settlement in the federal "In re Facebook Biometric Info. Privacy Litig." case, praising the settlement as  a major win for consumers in the hotly contested area of digital privacy. Two class members have appealed the settlement to the United States Court of Appeals for the Ninth Circuit. Challenges. There is currently a bill (SB3053) pending before the Illinois legislature to amend the BIPA. The bill proposes to exempt private entities from the BIPAs requirements under a number of circumstances, including (1) if the biometric information is used "exclusively for employment, human resources, fraud prevention, or security purposes," (2) if the company "does not sell, lease, trade or similarly profit" from the biometric information, or (3) if  the company protects biometric information at least as securely as it secures other sensitive information. SB3053 is viewed by privacy advocates as an attempt to entirely gut the BIPA. It has received significant opposition from many groups that advocate for digital privacy rights, including the Electronic Frontier Foundation. During Facebook founder Mark Zuckerberg's testimony before Congress on April 10, 2018, in the aftermath of Facebook's scandal with Cambridge Analytica, Senator Dick Durbin questioned Zuckerberg about Facebook's support for SB3053. Related state-level bills and laws. There are a number of similar bills that have been introduced in  states across the country. These include: International equivalents. On May 25, 2018, the EU effectuated the General Data Protection Regulation (GDPR), one of the world's strongest data protection regulations to date.