Recently, the Illinois General Assembly have restarted efforts to amend the Biometric Information Privacy Act of 2008 (“the Act”). On January 31, 2024, Senator Bill Cunningham introduced S.B. 2979 ostensibly to answer the call from the Illinois Supreme Court that the General Assembly, “make clear its intent regarding the assessment of damages under the Act” in Cothron v. White Castle, 2023 IL 128004 (Ill. February 17, 2023)
In White Castle, employees used the company’s fingerprint verification system to access their pay records. Once the scan occurred, the company transmitted the data to a third-party vender which verified the fingerprint and would authorize the employee access. The Supreme Court evaluated whether a Plaintiff’s claims accrue each time a company scans and discloses a biometric identifier to a third-party without written consent. On behalf of the class of approximately 9,500 employes, Plaintiff argued that White Castle implemented this collection system and disclosed biometric data to the vender without informed consent, which White Castle secured in 2018.
Plaintiff also argued violations arose that each time the process occurred between 2008 and the date of consent. The Court agreed. It held that White Castle violated the collection and disclosure requirements of Section 15 each time the class members scanned their fingerprints, and the system disclosed this information to the vender between 2008 and 2018. Accordingly, White Castle estimated its damages under the Act may exceed $17 billion. Amici to the decision observed that the damages language in the Act could “result in punitive and ‘astronomical’ damages awards that would constitute ‘annihilative liability’” were damages assessed under the Act in this manner.
Senator Cunningham’s proposal seeks to remedy the issues that Amici and the Supreme Court alluded to. Cunningham’s amendment alters what constitutes consent and streamlines the assessment of damages regarding the collection and transmission of biometric data. The amendment adds electronic signatures from individuals as a valid basis of written consent to collect and disclose biometric data. This aspect of the amendment modernizes the informed consent requirements and streamlines their application concerning the use of biometric identifiers outside of the context of employment, such as in the context of website or application security.
Cunningham’s amendment dramatically changes the manner and method in which violations accrue for improper collection and disclosure under the Act, abrogating the continuous violation theory that the White Castle Plaintiffs employed. Regarding the collection of data, if a company collected an employee’s biometric identifier using a particular manner absent consent, one violation occurs were it to collect the identifier again using the same technique. Cunningham’s proposed language for the dissemination of biometric information follows suit. If a company without consent disclosed an employee’s previously collected biometric information to the same third-party using the same prior method of collection, this is one violation.
In the context of White Castle, the rescanning of Plaintiffs’ fingerprints to facilitate access to the company’s payroll records after the first scan would amount to one violation, until White Castle obtained consent in 2018. Moreover, each time that White Castle disclosed Plaintiffs’ fingerprints to its vender to grant access to payroll records would equal one violation. Essentially, the amendment seeks to aggregate violations on a per-employee basis rather than with each scan or transmission.
As the Supreme Court noted in White Castle, the legislature should solve the policy concerns about excessive damage awards. Cunningham’s proposed amendment attempts to strike a balance between ensuring strong privacy protections under the Act while imposing reasonable penalties on companies for violations. Despite the plethora of failed BIPA-related proposals from 2021-2023, Cunningham’s current proposal may gain traction with the Supreme Court’s implicit directive to revisit the Act’s language.
With the number of stunningly large settlements and verdicts in 2023, it is crucial for companies to take proactive measures to ensure compliance with the Act’s collection, processing, and disclosure requirements.
