Search form

Actual Harm Not Required to Sue Under Illinois Biometric Information Privacy Law

By Nadine C. Abrahams, Jason C. Gavejian, Joseph J. Lazzarotti, Jody Kahn Mason, Jeffrey L. Rudd and Jason A. Selvey
  • January 25, 2019

The Illinois Supreme Court has ruled that individuals need not allege actual injury or adverse effect, beyond a violation of his or her rights under the Illinois Biometric Information Privacy Act (BIPA), in order to qualify as an “aggrieved” person and be entitled to seek liquidated damages, attorneys’ fees and costs, and injunctive relief under the Act. Rosenbach v. Six Flags Entertainment Corp. et al., No. 123186 (Jan. 25, 2019).

Potential damages can be substantial, as the BIPA provides for statutory damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation of the Act. To date, no Illinois court has interpreted the meaning of “per violation,” but the majority of BIPA suits have been brought as class actions seeking statutory damages on behalf of each individual affected.

Following this significant decision from the Supreme Court, companies that have not already done so, should immediately take steps to comply with the statute. These steps should include reviewing their time management, point of purchase, physical security, or other systems that obtain, use, or disclose biometric information against the requirements under the BIPA. (Biometric information is any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry used to identify an individual.) If there are technical or procedural gaps in compliance, they should be remedied quickly. Examples of such gaps include not providing written notice, obtaining a release from the subject of the biometric information, obtaining consent to provide biometric information to a third party, or maintaining a policy and guidelines for the retention and destruction of biometric information. For additional information on complying with the BIPA, please see our BIPA FAQs.

In reversing and remanding the case, the Illinois Supreme Court held:

The duties imposed on private entities by section 15 of the Act (740 ILCS 14/15) regarding the collection, retention, disclosure, and destruction of a person’s or customer’s biometric identifiers or biometric information define the contours of that statutory right. Accordingly, when a private entity fails to comply with one of section 15’s requirements, that violation constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose biometric identifier or biometric information is subject to the breach. Consistent with the authority cited above, such a person or customer would clearly be “aggrieved” within the meaning of section 20 of the Act (740 ILCS 14/20) and entitled to seek recovery under that provision. No additional consequences need be pleaded or proved. The violation, in itself, is sufficient to support the individual’s or customer’s statutory cause of action.

The Supreme Court’s decision is likely to increase the already significant number of suits, including putative class actions, filed under the BIPA. In the words of the Illinois Supreme Court, “[c]ompliance should not be difficult; whatever expenses a business might incur to meet the law’s requirements are likely to be insignificant compared to the substantial and irreversible harm that could result if biometric identifiers and information are not properly safeguarded; and the public welfare, security, and safety will be advanced.”

Jackson Lewis attorneys are available to assist employers in achieving compliance with the BIPA.

©2019 Jackson Lewis P.C. This material is provided for informational purposes only. It is not intended to constitute legal advice nor does it create a client-lawyer relationship between Jackson Lewis and any recipient. Recipients should consult with counsel before taking any actions based on the information contained within this material. This material may be considered attorney advertising in some jurisdictions. Prior results do not guarantee a similar outcome.

Reproduction of this material in whole or in part is prohibited without the express prior written consent of Jackson Lewis P.C., a law firm with more than 900 attorneys in major cities nationwide serving clients across a wide range of practices and industries. Having built its reputation on providing premier workplace law representation to management, the firm has grown to include leading practices in the areas of government relations, healthcare and sports law. For more information, visit www.jacksonlewis.com.

See AllRelated Articles You May Like

April 1, 2019

Retail Industry Workplace Law Update – Spring 2019

April 1, 2019

Class Action Trends Report The latest issue of our quarterly report on new developments in class action litigation focuses on independent contractors and covers the following topics: Is an “independent contract” enough? Independent contractors in California Potential strategies to protect your company and tips to defend... Read More

March 11, 2019

New Jersey Bills Would Give Consumers Control Over Their Personal Data Privacy

March 11, 2019

New Jersey has joined a growing list of states considering legislation on data privacy to promote transparency, accountability, and individual choice. One bill would create new obligations for commercial entities whose online website or services collect personally identifiable information (PII) from individuals in New Jersey. A second... Read More

February 27, 2019

U.S. Supreme Court Holds Federal Rule of Civil Procedure 23(f) Is Not Subject to Equitable Tolling

February 27, 2019

In a decision important to class action practice, the U.S. Supreme Court has held that Federal Rule of Civil Procedure 23(f), which establishes a 14-day deadline to seek permission to appeal an order granting or denying class certification, is not subject to equitable tolling. Nutraceutical Corp. v. Lambert, No. 17-1094 (Feb. 26, 2019... Read More