The use of biometric data has become pervasive, commonplace, and socially acceptable. In most jurisdictions, few legal hurdles exist to implementing biometric technology, but Illinois has passed the strongest biometric privacy law in the United States—the Illinois Biometric Information Privacy Act (“BIPA”). In adopting BIPA, the Illinois legislature recognized unforeseeable uses and abuses of biometric data and understood that biometric data must be fiercely protected because unlike other personal information, biometric data cannot be changed when compromised. Most importantly, BIPA includes a private right of action.
Although BIPA has existed for over a decade, its significance increases as the use of biometric technology spreads. Today, biometric technologies are booming; they are becoming more accessible, cost-efficient, and effective. This exciting time for technological advancement coincides with heightened legal risk. In 2018, the Illinois Supreme Court held in Rosenbach v. Six Flags Entertainment Corp., et. al. that technical and procedural violations of BIPA are sufficient to establish statutory standing to sue, regardless of actual harm. This ruling, which essentially allows no-injury class actions, has emboldened plaintiffs (and the plaintiffs’ bar) to file more BIPA lawsuits than ever before. Accordingly, the number of class action complaints will rapidly increase in the coming years.
Biometric technology may sound somewhat futuristic, but it is gaining traction in many applications. Several examples of biometric technology being implemented include
- Businesses using fingerprints and other biometric data to manage security access and convenience;
- Employers using fingerprints and other biometric data as timeclocks to track hours worked;
- Amusement parks and gyms using fingerprints to identify persons with season passes/memberships;
- Online social media platforms using face recognition and face geometry to “tag” photos;
- Security teams using biometric information to identify known security risks at live events; and
- Retail establishments using biometric data to identify banned customers who enter stores.
Hahn Loeser’s Biometric Privacy Practice Group provides three primary areas of service to its clients.
- BIPA Client Counseling & Compliance
- BIPA Class Action Defense
- BIPA Insurance
BIPA Client Counseling & Compliance
Businesses that seek to leverage new biometric technology must understand the potential risk. Most BIPA legal exposure can be mitigated with an appropriate BIPA policy. For clients that rely on biometric data for their business operations, we take a proactive approach to preventing legal issues by laying solid groundwork for compliance. We collaborate with our clients to understand the technology they utilize – how the biometric information is captured, stored, protected, transmitted, used, and deleted – and develop BIPA policies to reduce their risk of legal exposure. We also collaborate with our clients to draft agreements to obtain the requisite consents and to place risk with the parties in the best position to manage it.
Our team recently completed a project for a sophisticated real estate client that is incorporating biometric technology into the security system of a marque building in Chicago. With a wave of the hand, building tenants can gain access to the building without a security badge. We counseled this client in designing a BIPA-compliant approach, formulating its BIPA policy, and securing the various participants’ agreements.
BIPA Class Action Defense
Because of the nature of biometric information issues, companies are particularly vulnerable to facing a class action if problems do arise. To date, more than 200 BIPA class actions have been filed in Illinois, and given the recent Supreme Court ruling in Rosenbach, that number is expected to grow. Nearly 95 percent of all BIPA cases filed in the country are filed in Illinois State Court. Companies need counsel who not only understand the intricacies of BIPA but who also have significant experience in understanding the legal landscape in Illinois and how these cases are emerging. In addition to this insight, they need experienced counsel who have the track record and bench strength of handling complex class actions. At Hahn Loeser, we provide clients with this important combination of insight into the evolving biometric privacy issues, a perspective on the issues involved in BIPA class action cases and a substantial history of successfully defending clients in class actions across the country. For more information about our class action experience, see our Class Action practice.
When clients face BIPA allegations, our Biometric Privacy Team will help them review their insurance policies and consider whether an insurance claim is appropriate. We understand the nuances of these insurance policies and the scope of coverage that often relates to BIPA. We counsel clients through their coverage questions and if they face challenges from their insurance companies, we are prepared to litigate the scope of the coverage.