In the aftermath of the Illinois Supreme Court's Rosenbach decision, Illinois employers have faced a wave of class action litigation filed under the Biometric Information Privacy Act ("BIPA"). Employers hoping for relief from the statute's private right of action must wait for another day (or another session) as Senate Bill 2134 ("SB 2134") did not report out of committee by the March 28, 2019 deadline.
As we previously reported, the Illinois Supreme Court held in Rosenbach that a claimant need not allege some actual injury or adverse effect to be "aggrieved" and have statutory standing under BIPA. As a result, individuals who have not suffered a concrete injury (such as identity theft, for instance) have filed class action lawsuits in record numbers in Illinois state courts.
In response, the Senate introduced SB 2134, aimed at amending BIPA and deleting language creating a private right of action. Instead, the legislation would ha10ve amended BIPA to read that any violation that results from the collection of biometric information by an employer for employment purposes is subject to the enforcement authority of the Department of Labor and must be enforced by the Attorney General. Passage of the bill likely would have stemmed the wave of class action lawsuits filed by individual claimants in courts. But, SB 2134 was denoted as having a procedural deadline of March 28, 2019 for the committee to report the bill, and did not report by the deadline. Typically, this means the bill may not see further action.
This is not the first time legislation amending BIPA was introduced in the Illinois legislature. In May 2016, an amendment to House Bill 6074 was introduced that would have expressly excluded both physical and digital photographs from the definition of "biometric identifier" and limited the definition of "scan" to in-person scans. The legislature did not act on the amendment. Then, last year, the Senate introduced SB3053 that would have amended BIPA by deeming BIPA inapplicable to a private entity collecting, storing, or transmitting biometric information if, among other things, the biometric information is used exclusively for employment, human resources, fraud prevention, or security purposes. Like the recent SB2134, SB3053 failed to advance out of committee.
While employers welcomed introduction of the legislation, until legislation is actually passed stripping an individual's private right of action, Illinois employers will likely continue to face an onslaught of class action lawsuits filed in Illinois state courts. It is important employers are familiar with and follow BIPA's notice and consent requirements in order to limit their risk of exposure. Among other things, employers should ensure they have established a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information, informed the individual in writing that a biometric identifier or biometric information is being collected or stored, informed the individual in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored and used, and received a written release executed by the individual subject of the biometric identifier or biometric information. The cost of implementing statutorily-required policies as soon as possible could save companies from huge damages awards in the future.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.