June 26, 2019

June 26, 2019

Subscribe to Latest Legal News and Analysis

June 25, 2019

Subscribe to Latest Legal News and Analysis

June 24, 2019

Subscribe to Latest Legal News and Analysis

Actual Harm Not Required to Sue Under Illinois Biometric Information Privacy Law

The Illinois Supreme Court has ruled that individuals need not allege actual injury or adverse effect, beyond a violation of his or her rights under the Illinois Biometric Information Privacy Act (BIPA), in order to qualify as an “aggrieved” person and be entitled to seek liquidated damages, attorneys’ fees and costs, and injunctive relief under the Act. Rosenbach v. Six Flags Entertainment Corp. et al.No. 123186 (Jan. 25, 2019).

Potential damages can be substantial, as the BIPA provides for statutory damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation of the Act. To date, no Illinois court has interpreted the meaning of “per violation,” but the majority of BIPA suits have been brought as class actions seeking statutory damages on behalf of each individual affected.

Following this significant decision from the Supreme Court, companies that have not already done so should immediately take steps to comply with the statute. These steps should include reviewing their time management, point of purchase, physical security, or other systems that obtain, use, or disclose biometric information against the requirements under the BIPA. (Biometric information is any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry used to identify an individual.) If there are technical or procedural gaps in compliance, they should be remedied quickly. Examples of such gaps include not providing written notice, obtaining a release from the subject of the biometric information, obtaining consent to provide biometric information to a third party, or maintaining a policy and guidelines for the retention and destruction of biometric information. For additional information on complying with the BIPA, please see our BIPA FAQs.

In reversing and remanding the case, the Illinois Supreme Court held:

The duties imposed on private entities by section 15 of the Act (740 ILCS 14/15) regarding the collection, retention, disclosure, and destruction of a person’s or customer’s biometric identifiers or biometric information define the contours of that statutory right. Accordingly, when a private entity fails to comply with one of section 15’s requirements, that violation constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose biometric identifier or biometric information is subject to the breach. Consistent with the authority cited above, such a person or customer would clearly be “aggrieved” within the meaning of section 20 of the Act (740 ILCS 14/20) and entitled to seek recovery under that provision. No additional consequences need be pleaded or proved. The violation, in itself, is sufficient to support the individual’s or customer’s statutory cause of action.

The Supreme Court’s decision is likely to increase the already significant number of suits, including putative class actions, filed under the BIPA. In the words of the Illinois Supreme Court, “[c]ompliance should not be difficult; whatever expenses a business might incur to meet the law’s requirements are likely to be insignificant compared to the substantial and irreversible harm that could result if biometric identifiers and information are not properly safeguarded; and the public welfare, security, and safety will be advanced.”

Jackson Lewis P.C. © 2019

TRENDING LEGAL ANALYSIS


About this Author

Nadine Abrahams, Jackson Lewis Law Firm, Chicago, Labor and Employment Litigation Attorney
Principal

Nadine Abrahams is a Principal in the Chicago, Illinois, office of Jackson Lewis P.C. She represents management in employment cases in federal and state courts and before administrative agencies, and she is Co-Leader of the firm's General Employment Litigation practice group.

Prior to joining Jackson Lewis, Ms. Abrahams was a partner with another prominent national labor and employment firm. She previously was Senior Counsel for the Employment Litigation Division of the City of Chicago Law Department. She has been based in...

312-803-2512
Jason C. Gavejian, Employment Attorney, Jackson Lewis, Principal, Restrictive Covenants Lawyer
Principal

Jason C. Gavejian is a Principal in the Morristown, New Jersey, office of Jackson Lewis P.C. and a Certified Information Privacy Professional (CIPP/US) with the International Association of Privacy Professionals.

Mr. Gavejian represents management exclusively in all aspects of employment litigation, including restrictive covenants, class-actions, harassment, retaliation, discrimination and wage and hour claims in both federal and state courts. Additionally, Mr. Gavejian regularly appears before administrative agencies, including the Equal Employment Opportunity Commission, the Office for Civil Rights (OCR), the New Jersey Division of Civil Rights, and the New Jersey Department of Labor. His practice also focuses on advice/counseling employers regarding daily workplace issues.

Mr. Gavejian represents companies with respect to inquiries from the HHS/OCR, state attorneys general, and other agencies alleging wrongful disclosure of personal/protected information. Mr. Gavejian negotiates vendor agreements and other data privacy and security agreements, including business associate agreements. His work in the area of privacy and data security includes counseling and coaching clients through the process of investigating and responding to breaches of the personally identifiable information (PII) or protected health information (PHI) they maintain about consumers, customers, employees, patients, and others, while also assisting clients in implementing policies, practices, and procedures to prevent future data incidents.

Mr. Gavejian’s litigation experience, coupled with his privacy practice, provides him with a unique view of many workplace issues and the impact privacy, data security, and social media may play in actual or threatened lawsuits.

Mr. Gavejian regularly provides training to both executives and employees and regularly speaks on current privacy, data security, monitoring, recording, BYOD/COPE, biometrics (BIPA), social media, TCPA, and information management issues. His views on these topics have been discussed in multiple publications, including the Washington Post, Chicago Tribune, San Francisco Chronicle (SFGATE), National Law Review, Bloomberg BNA, Inc.com, @Law Magazine, Risk and Insurance Magazine, LXBN TV, Business Insurance Magazine, and HR.BLR.com.

Mr. Gavejian is the Co-Chair of Jackson Lewis’ Hispanic Attorney Resource Group, a group committed to increasing the firm’s visibility among Hispanic-American and other minority attorneys, as well as mentoring the firm's attorneys to assist in their training and development. Mr. Gavejian also previously served on the National Leadership Committee of the Hispanic National Bar Association (HNBA) and regularly volunteers his time for pro bono matters.

Prior to joining Jackson Lewis, Mr. Gavejian served as a judicial law clerk for the Honorable Richard J. Donohue on the Superior Court of New Jersey, Bergen County.

(973) 538-6890
Principal

Joseph J. Lazzarotti is a Principal in the Morristown, New Jersey, office of Jackson Lewis P.C. He founded and currently helps to co-lead the firm's Privacy, e-Communication and Data Security Practice, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the International Association of Privacy Professionals.

In short, his practice focuses on the matrix of laws governing the privacy, security and management of data, as well as the impact and regulation of social media. He also...

973- 538-6890
Jody Mason, Employment Law Litigator, Employer Attorney, Jackson Lewis, Chicago Law Firm
Principal

Jody Kahn Mason is a Principal in the Chicago, Illinois, office of Jackson Lewis P.C. She is an experienced employment law litigator and defends employers before federal and state courts and administrative agencies throughout the midwest.

Ms. Mason handles all types of single plaintiff and class action employment litigation, including claims of discrimination, sexual harassment and retaliation, and matters arising under Title VII, the Age Discrimination in Employment Act (ADEA), the Family and Medical Leave Act (FMLA), the Americans with...

312-803-2535
Jeffrey L. Rudd, Jackson Lewis, Labor claims under Title VII, Lawyer, Discrimination Attorney
Principal

Jeffrey L. Rudd is a Principal in the Chicago, Illinois, office of Jackson Lewis P.C. His practice focuses on employment litigation.

Mr. Rudd has experience in cases involving claims brought under Title VII, the Americans with Disabilities Act (ADA), the Age Discrimination in Employment Act (ADEA), Employment Retirement Income Security Act (ERISA), the Fair Labor Standards Act (FLSA), the Worker Adjustment and Retraining Notification Act (WARN), and various state statutes and common law doctrines relating to employment, including whistleblower...

312-803-2547