What happened?

On August 8, 2024, Governor JB Pritzker signed SB 2979, which introduces Biometric Information as protected under the Illinois Biometric Information Privacy Act.

What are the details?

The Illinois Biometric Information Privacy Act (BIPA) has been amended with several key changes:

• Overturning Previous Ruling: The amendments effectively overturned a 2023 Illinois Supreme Court ruling (Cothron v. White Castle Systems, Inc.) that held companies liable for each instance they misused a person’s private information. From now on, companies can only be found liable for one BIPA violation per person, regardless of the number of times the same biometric data is misused.

• Liability Cap: The law caps liability for the most commonly asserted BIPA claim — lack of consent required by Section 15(b) to the collection of one’s biometrics — to one “violation” per person. With statutory damages per violation capped at $5,000, exposure for class claims remains significant, but is no longer potentially annihilating. Exposure to individual claims/demands is reduced to nuisance value.

• Electronic Signature: The amendment clarifies that a person’s electronic signature constitutes a valid “written release” under the law, aligning with the federal E-SIGN Act and the Illinois Uniform Electronic Transactions Act.

• Impact on Class Action Fairness Act: The amendment may complicate the removal of BIPA cases under the Class Action Fairness Act, but is otherwise a significant victory for businesses in Illinois.

• Retroactive Application: The amendment applies retroactively based on the straightforward application of Illinois law, although this issue may be disputed by the plaintiffs’ bar given the impact on BIPA case value.

For additional information, you can visit our previous update: The Illinois Biometric Information Privacy Act (BIPA) Amended to Include Biometric Data (VensureHR)

Business Considerations

• Employers should review their policies and practices related to biometric data to ensure they are in line with the amended law. 
• Employers should establish clear consent mechanisms, including the use of digital consent forms. The amendment clarifies that a person’s electronic signature constitutes a valid “written release” under the law.
• Employers should limit data collection, only collecting biometric data when necessary and avoiding repeated collection to minimize potential violations. This is in line with data minimization best practices.
• Employers should understand that the amendment clarifies the legislature’s intent, which makes the law retroactive. With this clarification supplied by the legislature, it could have implications for how BIPA cases are argued in court.

Source References

• IL SB2979
• BIPA Update: Illinois Limits Liability and Clarifies Electronic Consent for Biometric Data Collection (Greenberg Traurig, LLP.)

Resources

• Cothron v. White Castle Systems, Inc. (2023 IL 128004 – Feb. 17, 2023).

This communication is intended solely for the purpose of conveying information. The present post might incorporate hyperlinks directing readers to websites managed by third-party entities. The inclusion of any links within this communication is meant to serve as points of reference and could encompass opinion articles from various law firms, articles from HR associations, official websites, news releases, and documents of government agencies, and other relevant third-party sources. Vensure has no authority over these external websites and bears no responsibility for their content. Furthermore, Vensure does not endorse the materials present on these websites. The contents of this communication should not be interpreted as legal advice or as a legal standpoint concerning specific facts or scenarios. Nor should it be deemed an exhaustive compilation of facts potentially pertinent to federal, state, or local laws. It is strongly advised that employers solicit legal guidance from an employment attorney when undertaking actions in response to any legal updates provided. This is due to the possibility of future alterations occurring in federal, state, and local laws, regulations, as well as the directives and guidelines issued by governing agencies. These changes may transpire at any given time, potentially rendering certain portions of the content within this update void or inaccurate.