Seyfarth Synopsis: Although the Illinois Supreme Court's recent decision in Rosenbach v. Six Flags may have upped the ante for employers facing litigation under the Illinois Biometric Information Privacy Act ("BIPA"), a recent bill introduced in the Illinois Senate, SB2134, would remove plaintiffs' right to bring private causes of action under Illinois Biometric Information Privacy Act ("BIPA") and instead allow them to file a complaint with the Illinois Department of Labor ("IDOL"), and to be enforced by the DOL and the Illinois Attorney General.
If this proposed bill ultimately becomes signed legislation, it would be the death knell for private party BIPA class actions. As ten or more BIPA class actions are being filed in Illinois state and federal courts on a daily basis, employers should closely follow developments involving this proposed legislation while concurrently pursuing BIPA compliance activities.
* * *
Background On The BIPA Law
As employers with operations in Illinois are likely well aware, the BIPA prohibits an entity from collecting, capturing, purchasing, or otherwise obtaining a person's "biometric identifier" or "biometric information," unless it satisfies certain notice, consent, and data retention requirements. The statute creates a limited right of action for "person[s] aggrieved by a violation" of its terms. A "person aggrieved" by a negligent violation of the BIPA may recover "liquidated damages of $1,000 or actual damages, whichever is greater." A "person aggrieved" by an intentional or reckless violation of the BIPA may recover "liquidated damages of $5,000 or actual damages, whichever is greater."
In Rosenbach v. Six Flags Entertainment Corp., No. 123186, 2019 Ill. Lexis 7 (Ill. Jan. 25, 2019), the Illinois Supreme Court held in its first ever ruling concerning the BIPA that a person need not have sustained actual damage beyond technical violations of the BIPA in order to pursue claims for damages. As the Illinois Supreme Court held, "[w]hatever expenses a business might incur to meet the law's requirements are likely to be insignificant," in light of the potential for "liability for failure to comply with [BIPA's] requirements." Id. at *21.
Employers in Illinois have been confronted with an explosion of BIPA class action litigation over the last two years. No end appears in sight at this point.
Proposed Legislation
In February 2019, Illinois State Senators Jason A. Barickman and Bill Cunningham co-sponsored SB2134 to amend BIPA. The proposed bill would delete language creating a private right of action and instead provide that any violation that results from the collection of biometric information by an employer – for employment, human resources, fraud prevention, or security purposes – is subject to the enforcement authority of the IDOL. It further provides that an employee or former employee may file a complaint with the IDOL alleging a violation, within one year from the date of the violation, by submitting a signed, completed complaint form. Finally, the proposed bill provides that any violation of the Act constitutes a violation of the Illinois Consumer Fraud and Deceptive Business Practices Act, and may be enforced by the Illinois Attorney General.
Implications For Employers
While the passing of SB2134 would certainly be welcome news to employers in terms of aiding to curb future class actions, it is unclear what impact the amendment would have on pending litigation. As such, SB2134 likely will not serve as a "get out of jail free card" for employers currently mired in BIPA class actions. Further, given that it is only proposed legislation, employers should remain vigilant in ensuring compliance with the BIPA. Given the potentially huge ramifications if the bill is sworn into law in regards to minimizing future class action exposure, employers should closely track this proposed legislation.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.