iTogether, those decisions make it more important than ever that businesses collecting biometric data seek counsel to ensure compliance with BIPA and to develop legal strategies for successfully resolving BIPA claims. In this latest update, we review those decisions and other noteworthy developments in BIPA class action litigation in 2023.
Regulatory Background
Enacted in 2008, BIPA regulates the collection, use, storage, retention, and destruction of biometric identifiers and biometric information. A “biometric identifier” is a biologically unique personal identifier, including a fingerprint, voiceprint, face geometry, or a retina or hand scan. “Biometric information” is any information based on an individual’s biometric identifier used to identify an individual.
Subject to limited exceptions, BIPA generally prohibits the collection or use of a person’s biometric identifiers and biometric information without providing notice, obtaining written consent, and developing a publicly available retention and destruction schedule. Companies in possession of biometrics may not profit from the data.
BIPA provides a private right of action, permitting any person “aggrieved” by a violation to bring suit in state or federal court. The Illinois Supreme Court has held that a person may be “aggrieved” by a BIPA violation even if their biometric data was never misused, and they were never actually injured. It is sufficient for a plaintiff to point to solely technical violations of the statute. A prevailing plaintiff may recover actual damages or statutory damages of $1,000 for each negligent violation and $5,000 for each reckless or intentional violation.
Landmark Statute of Limitations and Claim Accrual Decisions
In February 2023, the Illinois Supreme Court issued two decisions that significantly affect the number and scope of potential claims available in BIPA class actions.
In Tims v. Black Horse Carriers Inc., 2023 IL 127801, the Illinois Supreme Court held that all claims under BIPA are subject to a five-year statute of limitations. The appellate court had held that BIPA is governed by two statutes of limitations depending on the type of claim at issue — some claims by a one-year limitations period and others by a five-year period. The Illinois Supreme Court concluded that one statute of limitations should govern all BIPA claims and concluded that a five-year statute is more consistent with the legislature’s goal of protecting the public against disclosure of highly sensitive biometric information while ensuring certainty and predictability in the administration of limitations periods. We previously reported on the Tims decision here.
In Cothron v. White Castle Systems, 2023 IL 128004, a split Illinois Supreme Court held that a separate BIPA violation accrues for each undisclosed or unconsented-to scan or transmission of biometric data, not merely the first such instance. The court analyzed the statutory language of the BIPA sections White Castle allegedly violated and concluded that the language applied to each instance of a company “collecting,” “capturing,” or “disclosing” biometric data. The court also concluded that each statutory violation is itself an injury for purposes of a BIPA claim, not just the first such disclosure in which individuals lose control of their biometric data. Though the court acknowledged that separate claim accrual for each scan or transmission could arguably result in “astronomical” damages awards, it deemed that a “policy-based concern” to be addressed by the state legislature. We previously reported on the Cothron decision here.
First BIPA Jury Verdict Vacated and Case Settles
In July 2023, in the first case to go to trial under BIPA, a federal judge vacated a $228 million award of statutory damages. The judge concluded that damages under BIPA are discretionary and ordered a new trial on damages. We wrote about that decision here. In September 2023, the parties reported that they had reached a settlement and executed a binding term sheet. The parties are still in the process of finalizing their settlement, the details of which have not been disclosed.
Health Care Industry
In November 2023, the Illinois Supreme Court issued a highly anticipated decision impacting BIPA class actions in the health care industry. The court held that BIPA does not apply to biometric information of health care workers collected, used, or stored for health care treatment, payment, or operations, as those functions are defined by the Health Insurance Portability and Accountability Act (HIPAA). Mosby v. The Ingalls Memorial Hospital, 2023 IL 129081 (Nov. 30, 2023). The case involved consolidated class actions filed by hospital nurses alleging their employers required them to scan their fingerprints for identification to access medication dispensing systems and to store materials and medications for patients. In holding that the workers’ fingerprint information is exempt from protection under Section 10 of BIPA, Mosby may be a potent defense for health care providers facing BIPA lawsuits.
Insurance Exclusions for BIPA Coverage
In December 2023, an Illinois appellate court panel held that two insurance companies owed no duty to defend a BIPA lawsuit under the terms of their policies. In National Fire Ins. Co. v. Visual Pak Co., 2023 IL APP (1st) 221160, the insurance companies filed suit for a declaration that they did not owe a duty to defend or indemnify Visual Pak in a lawsuit alleging that Visual Pak violated BIPA by failing to obtain an employee’s informed, written consent before requiring him to enroll in a database using a fingerprint scan for tracking his time at work. The insurance companies argued that coverage was barred by a policy exclusion for lawsuits alleging violations of statutes prohibiting or limiting “the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information.”
The appellate court affirmed a lower court ruling that the exclusion barred coverage, concluding “it is simply impossible to deny” that BIPA fits within the exclusion because BIPA “regulates the collection, dissemination, and disposal of one’s biometric identifiers and information.” The Visual Pak case raises an insurance coverage issue that is significant to both BIPA plaintiffs and defendants, which may ultimately be decided on further appeal by the Illinois Supreme Court.
