Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

On May 16, the Illinois Legislature passed <a href="https://www.ilga.gov/legislation/BillStatus.asp?DocNum=2979&amp;GAID=17&amp;DocTypeID=SB&amp;LegId=152094&amp;SessionID=112&amp;GA=103" target="_blank" rel="noreferrer noopener">Senate Bill (SB) 2979</a>, which amends the state’s Biometric Information Privacy Act (BIPA) to limit damages available to aggrieved parties and expand how organizations can obtain consent under the law. Now subject to Governor J.B. Pritzker’s approval, SB 2979 is a direct reaction to legal proceedings resulting in multimillion-dollar losses to businesses for what many perceive to be minor technical violations of the law. Importantly, an organization can still be held liable under BIPA for unlawfully collecting or otherwise processing an individual’s biometric data and should continuously monitor its data protection programs to ensure compliance with the law.

contentpilot/introduction

core/heading

BIPA regulates the processing of “biometric identifiers and information” and sets forth strict requirements for entities that “possess” and/or “collect” biometric data, which includes retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, or any other information based on these types of biometric identifiers used to identify an individual.

core/paragraph

BIPA sets forth different obligations based on whether a private entity is in “possession of, or has collected or otherwise obtained, biometric data.” More specifically, <a>under Section 15(a) of BIPA, a private entity “in possession” of biometric data is required to</a> undertake the following:

core/list

Further, Section 15(b) of BIPA states that private entities that “<a>collect, capture, purchase, receive through trade, or otherwise obtain” biometric data </a>from an individual are required to, prior to the collection of the data, <a>inform the individual or their representative of </a>the collection and storage; inform the individual or their representative of the specific purpose and length of term for which biometric data is being collected, stored, and used; and receive a written release executed by the subject of the biometric data or their legally authorized representative (see below for more on the “written release” issue).

<a></a><a>Section 15(d) </a>of BIPA, on the other hand, mandates that private entities “in possession” of biometric <a>data </a>are prohibited from selling, <a>leasing</a>, trading, or otherwise profiting from a person’s or customer’s biometric data and disclosing, redisclosing, or otherwise disseminating biometric data, unless certain consent has been obtained, the disclosure or redisclosure completes certain types of financial transactions, the disclosure or redisclosure is required by law, or the disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.

BIPA provides for a private right of action that allows individuals to recover statutory damages if their biometric data is processed in contrast to BIPA’s requirements, and the majority of these claims have been brought against companies that violate Sections 15(b) or 15(d) of BIPA. As originally written, a prevailing party may be entitled to $1,000 or actual damages for each negligent violation, or $5,000 or actual damages for each reckless or intentional violation. In <a href="https://ilcourtsaudio.blob.core.windows.net/antilles-resources/resources/e304b011-82d9-4832-9cae-d8205749a2ec/Cothron%20v.%20White%20Castle%20System,%20Inc.,%202023%20IL%20128004.pdf" target="_blank" rel="noreferrer noopener">Cothron v. White Castle</a>, the Illinois Supreme Court emphasized that BIPA claims accrue each time an individual’s biometric data is unlawfully captured or collected, which the dissent found would impose “punitive, crippling liability on businesses” and “damages wildly exceeding any remotely reasonable estimate of harm.”

Accordingly, <a>SB 2979 </a>limits how individuals can recover damages under BIPA. Specifically, <a>it </a>amends Sections 15(b) and 15(d) to state that an “aggrieved person is entitled to, at most, one recovery” under each sub-section of law. In other words, SB 2979 limits the damages available to one violation per aggrieved person, rather than in each instance their biometric data is disclosed or collected (provided the collection occurs via “the same method”).

Importantly, SB 2979 does not amend how an organization could be liable under Sections 15(a) or 15(c). Although their provisions have not generally been the basis of the same number of lawsuits as other BIPA cases, plaintiffs may now focus on these areas as a method for generating lawsuits. In turn, organizations should continue to evaluate their liability under and compliance with all aspects of BIPA.

As noted above, a written release is a key concept within BIPA, and <a>SB 2979 </a>amends BIPA to insert the term “electronic signature” into the definition of “written release.” Accordingly, if SB 2979 becomes law, “written release” will be defined as “informed written consent, electronic signature, or, in the context of employment, a release executed by an employee as a condition of employment.” “<a>Electronic signature</a>” means “an electronic sound, [a] symbol, or [a] process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record.” By adding the electronic signature verbiage to the law, SB 2979 furnishes greater flexibility to how organizations can obtain permission to collect and use biometric identifiers or information.

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2024/05/Privacy-Cybersecurity-Update-Illinois-Legislature-Amends-BIPA.pdf

Illinois Legislature Amends BIPA to Limit Damages and Expand Consent Options

Services