October 27, 2021

Volume XI, Number 300

Advertisement
Advertisement

October 27, 2021

Subscribe to Latest Legal News and Analysis

October 26, 2021

Subscribe to Latest Legal News and Analysis

October 25, 2021

Subscribe to Latest Legal News and Analysis

Actual Harm Not Required to Sue Under Illinois Biometric Information Privacy Law

The Illinois Supreme Court has ruled that individuals need not allege actual injury or adverse effect, beyond a violation of his or her rights under the Illinois Biometric Information Privacy Act (BIPA), in order to qualify as an “aggrieved” person and be entitled to seek liquidated damages, attorneys’ fees and costs, and injunctive relief under the Act. Rosenbach v. Six Flags Entertainment Corp. et al.No. 123186 (Jan. 25, 2019).

Potential damages can be substantial, as the BIPA provides for statutory damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation of the Act. To date, no Illinois court has interpreted the meaning of “per violation,” but the majority of BIPA suits have been brought as class actions seeking statutory damages on behalf of each individual affected.

Following this significant decision from the Supreme Court, companies that have not already done so should immediately take steps to comply with the statute. These steps should include reviewing their time management, point of purchase, physical security, or other systems that obtain, use, or disclose biometric information against the requirements under the BIPA. (Biometric information is any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry used to identify an individual.) If there are technical or procedural gaps in compliance, they should be remedied quickly. Examples of such gaps include not providing written notice, obtaining a release from the subject of the biometric information, obtaining consent to provide biometric information to a third party, or maintaining a policy and guidelines for the retention and destruction of biometric information. For additional information on complying with the BIPA, please see our BIPA FAQs.

In reversing and remanding the case, the Illinois Supreme Court held:

The duties imposed on private entities by section 15 of the Act (740 ILCS 14/15) regarding the collection, retention, disclosure, and destruction of a person’s or customer’s biometric identifiers or biometric information define the contours of that statutory right. Accordingly, when a private entity fails to comply with one of section 15’s requirements, that violation constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose biometric identifier or biometric information is subject to the breach. Consistent with the authority cited above, such a person or customer would clearly be “aggrieved” within the meaning of section 20 of the Act (740 ILCS 14/20) and entitled to seek recovery under that provision. No additional consequences need be pleaded or proved. The violation, in itself, is sufficient to support the individual’s or customer’s statutory cause of action.

The Supreme Court’s decision is likely to increase the already significant number of suits, including putative class actions, filed under the BIPA. In the words of the Illinois Supreme Court, “[c]ompliance should not be difficult; whatever expenses a business might incur to meet the law’s requirements are likely to be insignificant compared to the substantial and irreversible harm that could result if biometric identifiers and information are not properly safeguarded; and the public welfare, security, and safety will be advanced.”

Jackson Lewis P.C. © 2021National Law Review, Volume IX, Number 25
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

Nadine Abrahams, Jackson Lewis Law Firm, Chicago, Labor and Employment Litigation Attorney
Principal

Nadine Abrahams is a Principal in the Chicago, Illinois, office of Jackson Lewis P.C. She represents management in employment cases in federal and state courts and before administrative agencies, and she is Co-Leader of the firm's General Employment Litigation practice group.

Prior to joining Jackson Lewis, Ms. Abrahams was a partner with another prominent national labor and employment firm. She previously was Senior Counsel for the Employment Litigation Division of the City of Chicago Law Department. She has been based in...

312-803-2512
Jason C. Gavejian, Employment Attorney, Jackson Lewis, Principal, Restrictive Covenants Lawyer
Principal

Jason C. Gavejian is a Principal in the Morristown, New Jersey, office of Jackson Lewis P.C. and a Certified Information Privacy Professional (CIPP/US) with the International Association of Privacy Professionals.

Mr. Gavejian represents management exclusively in all aspects of employment litigation, including restrictive covenants, class-actions, harassment, retaliation, discrimination and wage and hour claims in both federal and state courts. Additionally, Mr. Gavejian regularly appears before administrative agencies,...

(973) 538-6890
Principal

Joseph J. Lazzarotti is a principal in the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. He founded and currently co-leads the firm's Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the International Association of Privacy Professionals. Trained as an employee benefits lawyer, focused on compliance, Joe also is a member of the firm’s Employee Benefits practice group.

In short, his practice focuses on the matrix of laws governing the privacy, security, and...

973- 538-6890
Jody Mason, Employment Law Litigator, Employer Attorney, Jackson Lewis, Chicago Law Firm
Principal

Jody Kahn Mason is a Principal in the Chicago, Illinois, office of Jackson Lewis P.C. She is an experienced employment law litigator and defends employers before federal and state courts and administrative agencies throughout the midwest.

Ms. Mason handles all types of single plaintiff and class action employment litigation, including claims of discrimination, sexual harassment and retaliation, and matters arising under Title VII, the Age Discrimination in Employment Act (ADEA), the Family and Medical Leave Act (FMLA), the Americans with...

312-803-2535
Jeffrey L. Rudd, Jackson Lewis, Labor claims under Title VII, Lawyer, Discrimination Attorney
Principal

Jeffrey L. Rudd is a Principal in the Chicago, Illinois, office of Jackson Lewis P.C. His practice focuses on employment litigation.

Mr. Rudd has experience in cases involving claims brought under Title VII, the Americans with Disabilities Act (ADA), the Age Discrimination in Employment Act (ADEA), Employment Retirement Income Security Act (ERISA), the Fair Labor Standards Act (FLSA), the Worker Adjustment and Retraining Notification Act (WARN), and various state statutes and common law doctrines relating to employment, including whistleblower...

312-803-2547
Advertisement
Advertisement
Advertisement