Since July 2017, national, regional and local businesses operating in Illinois have been hit with a virtual storm of class actions under the Illinois Biometrics Privacy Act (“BIPA”). BIPA regulates how businesses may record and store biometric data from customers or employees, and these actions create the potential for significant losses, including the costs of defending class action litigation and potential awards of statutory damages. Defending, settling and paying judgments in claims under BIPA may be covered in whole or part under cyberliability, media liability, and/or employment practices liability insurance. Businesses operating in Illinois and states with similar laws (such as Texas and Washington) should carefully review their liability insurance programs to determine whether they may respond to a claim under BIPA or a similar statute, and should provide prompt notice of claim in the event of a suit.
Since July 2017, employees in Illinois have filed at least 26 class action lawsuits challenging the biometric data policies of companies spanning multiple industries, from social media giants and national restaurant and hotel chains, to retail and professional services businesses. Companies increasingly use biometrics such as fingerprints and facial scans for authentication, security, and recording employee work hours (i.e., a thumbprint reader in place of the traditional time card). In 2008, Illinois enacted one of the first laws regulating how businesses may record and store biometric data, the Biometric Information Privacy Act (BIPA), 740 ILCS 14/1 et seq., in response to the legislature’s perception that companies were testing fingerprint scanning technologies to authenticate financial transactions at grocery stores, gas stations, and school cafeterias in and around Chicago. As the current virtual storm of BIPA class litigation indicates, the Illinois statute contains particularly stringent requirements that create the potential for significant losses on the part of businesses, including statutory damages, and also may provide a model for states looking to enact similar legislation. Texas and Washington have also enacted similar legislation. Although the BIPA is largely untested in the courts and companies may have defenses to these claims—including constitutional and statutory standing arguments—companies are likely to incur substantial legal costs defending and settling these claims.