Illinois biometrics privacy ruling may lead to flood of lawsuits

Violation claims over Illinois’ Biometric Information Privacy Act (BIPA) may start rolling into the state’s court systems after Six Flags was hit with a ruling finding it could be required to pay damages over biometrics violations even if the damages aren’t tangible.

BIPA went into effect in 2008 and requires private entities in Illinois to obtain prior written consent before collecting an individual’s fingerprint, voiceprint, iris scan or other biometric. It also requires companies provide a written document notifying consumers of any biometric collection and the length of the data’s storage.

If a defendant negligently violated the law, plaintiffs may recover attorney fees and liquidated damages of up to $5,000 or actual damages.

Should businesses will be more wary about deploying biometrics?

On Jan. 25, in a unanimous opinion, the Illinois Supreme Court said actual injuries beyond violation of BIPA weren’t needed for the plaintiffs to seek damages.

While the Illinois Supreme Court’s opinion cited various case law that defined damages as intangible, some lawyers said the Six Flags case presented a sea change.

Related: The importance of privacy laws for insurance markets

“Six Flags is a bit of an outlier compared to normal jurisprudence,” said Robert Cattanach of Dorsey & Whitney. “I think the biggest attention-getter is arguably, not everyone will agree, is this being out of somewhat step with the U.S. Supreme Court’s Spokeo [v. Robins] case.” In that case, the U.S. Supreme Court held “you have to show actual harm to the individual. This is a fairly significant sea change in this space,” he explained.

With the Illinois Supreme Court’s decision, now businesses “face exposure and have a lot of hungry plaintiff attorneys looking for people collecting biometric data,” Cattanach added.

Indeed, the possibility of liquidated damages rolled into a large class action suit may stoke the interest of plaintiffs attorneys.

“We think this is a significant victory for employees and consumers in Illinois because the Illinois Supreme Court reaffirmed the protections that the Illinois Legislature intended to impose with BIPA,” said plaintiffs attorney Jim Zouras of Chicago-based Stephan Zouras. He noted his firm has filed 50 class actions over BIPA violations.

Risk of damages

For Downers Grove, Illinois-based plaintiffs attorney Cynthia Pietrucha, the ruling means that BIPA violation claims have been revived in Illinois’ courtrooms.

“Why this is particularly powerful for individuals, now it means if a private company takes biometric data from an individual and an individual has a problem with it they can sue and [possibly] win,” Pietrucha said. “Attorneys may start marketing more [to clients] as, ‘Do you think your biometric data has been impeded on?’” she added.

“The risks of damages that have to be paid versus actual harm is so out of proportion, I think there’s an incentive to file lawsuits,” added Justin Kay of Drinker Biddle & Reath’s Chicago office. “I think businesses will be more wary about deploying biometrics in Illinois.”

Related: Marriott breach exposes weakness in cyber defenses for hotels