The Illinois Supreme Court started off 2023 answering two long-awaited and lingering questions about the reach and scope of the Biometric Information Privacy Act (“BIPA”).  The Court’s decisions in Tims v. Black Horse Motor Carriers, Inc.^[1] and Cothron v. White Castle System, Inc.^[2] undoubtedly increase the litigation exposure for companies conducting business in Illinois and using biometric data of Illinois residents.  In the aftermath of these cases, companies that are subject to BIPA and not in compliance with it face statutory damages of at least $1,000 for each unauthorized scan or other use of biometric data, with a five-year period of limitations for each of those unauthorized scans or other uses. 

Five-Year Statute of Limitations

Because BIPA is silent as to the applicable statute of limitations, courts were left to decide whether claims under BIPA are subject to: (1) the state’s general five year statute of limitations, which applies to all civil cases unless otherwise prescribed by law; (2) the state’s one year statute of limitations, which applies to alleged privacy violations involving unauthorized publication; or (3) some combination of the two. 

In Tims, the Illinois Supreme Court concluded that the sale, disclosure, or dissemination of biometric data without consent, is subject to the state’s five-year statute of limitations, rather than the state’s one-year statute of limitations that applies to cases involving the alleged publication of private data.^[3] Tims clarified that the two sections prohibiting the sale of biometric data or its disclosure or dissemination to third parties without consent is subject to the same five-year statute of limitations as the sections addressing policies on biometric data collection and retention.^[4]

“Per Scan” Basis

Plaintiffs likewise prevailed in Cothron, through which the Court held that a claim under BIPA accrues each and every time a person’s biometric data is scanned or transmitted without prior consent.^[5] The Court acknowledged that, although the decision was not favorable to businesses in Illinois, the Court was bound by the clear intent of the Act and any solution must come from the legislature.^[6]

Glimmers of Hope

In the wake of these two decisions, both the Court and legislature provided glimmers of hope for defendants facing BIPA lawsuits.  It remains to be seen if these glimmers materialize to reduce litigation risks for businesses, or are mere mirages.

Discretion on Damages

In response to the White Castle’s argument that the Court’s decision could lead to ruinous damages, the Illinois Supreme Court noted that “[a] trial court presiding over a class action—a creature of equity—would certainly possess the discretion to fashion a damage award that (1) fairly compensated claiming class members and (2) included an amount designed to deter future violations, without destroying a defendant’s business.”^[7]  However, the Court appeared to leave it to future cases and the legislature to decide how a court might exercise this “discretion” within the confines of the statute, concluding that “[u]ltimately, … we continue to believe that policy-based concerns about potentially excessive damage awards under the Act are best addressed by the legislature.”^[8]

The Legislature to bring Clarity?

The Illinois legislature is considering a number of proposed bills that limit the effects of recent and pending cases.   

Most notably, one piece of proposed legislation includes a mandatory cure period prior to filing suit.^[9] Under the proposal, any claimant must first notify the private entity of the alleged BIPA violation and provide 15-days to cure the alleged violation prior to filing a lawsuit.^[10]

Another piece pending legislation may exempt the use of biometric data for time clock or security lock uses.^[11] Such an exemption could provide an affirmative defense for businesses who require that employees use fingerprint readers to clock in/clock out, and is likely a response to a wave of BIPA lawsuits alleging such conduct violates BIPA.

In response to a case in which Illinois Supreme Court just agreed to receive briefing, the legislature may expand the existing health care exemption to include HR-related uses of biometric data by healthcare entities.^[12]

Three separate proposals aim to bring clarity regarding the “written consent” requirement.^[13] Two of the proposed pieces of legislation clarifies that BIPA’s written consent can be satisfied by electronic signature^[14] or other electronic means,^[15] and a single written consent is effective for repeated processes of biometric data collection.^[16]

Lastly, one proposal would expand the security-purpose exemption to include the use of biometric data when used to protect against real property or bodily harm.^[17]

Other States Join the Party

While only two other states have standalone biometric data privacy statutes, as of this article, legislatures in at least nine other states have introduced standalone biometric data privacy statutes.  All nine of these proposed statutes contain a private right of action like BIPA.  These new bills appear to be inspired by BIPA, if not close copies.  In the absence of clear guidance from those states’ respective legislatures, BIPA’s precedent will likely be instructive for courts grappling with interpreting the scope and reach of those statutes.

Conclusion

The Illinois Supreme Court’s blockbuster BIPA decisions and the pending legislation similar to BIPA should create a sense of urgency for companies to evaluate their biometric data compliance programs.

***
^{[1] Tims v. Black Horse Carriers, Inc., Case No. 127801 (Ill. Feb. 2, 2023).}

^{[2] Cothron v. White Castle System, Inc., Case No. 128004 (Ill. Feb. 17, 2023); Sections 15(b) and (d).}

^{[3] Tims v. Black Horse Carriers, Inc., Case No. 127801 (Ill. Feb. 2, 2023).}

^{[4]  740 ILCS 14/10, Sect. 15(c) and 15(d).}

^{[5] Cothron v. White Castle System, Inc., Case No. 128004 (Ill. Feb. 17, 2023); Sections 15(b) and (d).}

^{[6] Cothron v. White Castle System, Inc., Case No. 128004, paras. 30, 42 (Ill. Feb. 17, 2023).}

^{[7] Cothron v. White Castle System, Inc., Case No. 128004, para. 42 (Ill. Feb. 17, 2023)(emphasis added).}

^{[8] Cothron v. White Castle System, Inc., Case No. 128004, para. 42 (Ill. Feb. 17, 2023).}

^{[9] IL HB 3199.}

^{[10] IL HB 3199.}

^{[11] IL SB 1506.}

^{[12] IL HB 1230; Mosby v. Ingalls Memorial Hospital, 2022 IL App (1st) 200822 (Feb. 25, 2022) (Petition for Leave to Appeal Allowed).}

^{[13] IL HB 3199, IL HB 2252, and IL HB 2335.}

^{[14] IL HB 2325.}

^{[15] IL HB 3199.}

^{[16] IL HB 2335.}

^{[17] IL SB 1511.}