Illinois Employers Continue to Be Sued Under the Illinois Biometric Information Privacy Act

By Brian M. O'Neal - McMahon Berger, PC

November 30, 2018

The Illinois Biometric Information Privacy Act (“BIPA”), which became effective in 2008, requires private entities to obtain consent before collecting an individual’s biometric information (information based on an individual’s biometric identifier used to identify an individual) and further requires businesses to establish policies regarding the extent to which they intend to store, share, and destroy the collected information.  “Biometric identifier” for purposes of BIPA “means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.”  Pursuant to BIPA, employers must inform employees in writing what biometric information will be collected, the purpose of collecting it, and the length of time it will be stored and used.  Employers must also secure a written release from the employee allowing for collection and storage of the biometric information.  BIPA further provides a private right of action for aggrieved individuals and relief available under BIPA includes: (1) $5,000 or actual damages, whichever is greater, for each intentional or reckless violation of BIPA; (2) $1,000 or actual damages, whichever is greater, for each negligent violation of BIPA; and (3) reasonable attorney fees and litigation expenses.

As in 2017, there have been numerous lawsuits filed against employers in 2018 alleging violations of BIPA.  Class actions recently have been filed against companies across a broad range of industries, including hospitality, supermarket, nursing home, trucking, and media.  Many of these lawsuits have focused on employers who use fingerprint-based timekeeping systems and allege, among other things, that companies are collecting employee fingerprint scans for time tracking purposes and unlawfully sharing the information without having proper policies in place regarding collection, retention, and destruction of the private information.

In one of the pending lawsuits asserting a violation of BIPA through a class action, the Illinois Supreme Court likely will be providing clarity in the near future regarding the issue of what it means to be an “aggrieved” person under BIPA and whether a technical violation of BIPA without additional harm or adverse effect, such as disclosure to a third party, is sufficient to confer standing for a lawsuit.  If the Illinois Supreme Court indicates only a technical violation of BIPA without additional harm is sufficient for standing to file a lawsuit, an even bigger increase in lawsuits filed under BIPA can be expected.

Regardless, as employers become more and more likely to use the latest technology for security purposes and/or time tracking, including the use of fingerprint scanning devices and finger scanners, you should be fully aware of the requirements of BIPA.  While the use of biometric identifiers can have significant benefits it also creates a substantial risk for liability if proper procedures and policies are not in place and followed by companies.  Employers considering securing and storing the biometric information of employees should ensure that carefully worded policies, releases, and procedures are in place to be able to prove compliance with BIPA and proper safeguarding of employees’ biometric information.

The employment law attorneys at McMahon Berger have been representing employers across the country in labor and employment matters, including those relating to Illinois laws and regulations, for over sixty years, and are available to discuss these issues and others.  As always, the foregoing is for informational purposes only and does not constitute legal advice regarding any particular situation or issue. The choice of a lawyer is an important decision and should not be based solely on advertisements.