Illinois’ biometric data privacy law could soon be less costly for violators

A proposal to reduce the potential damages that companies must pay for violating Illinois’ one-of-a-kind Biometric Information Privacy Act (BIPA) is quickly moving through the state’s legislature. 

The bill would alter how BIPA liability is determined, changing penalties from $1,000 for each violation of the law, even if it involves the same person, to a $1,000 penalty per person on a one-time basis. The bill could head to the governor’s desk as early as next week.   

The proposal comes in the wake of a potential multibillion-dollar judgment against White Castle in February after the Illinois Supreme Court found the burger chain’s use of a fingerprint program to authenticate employees should be fined based on the total number of times each employee was printed without their consent.

White Castle argued that a per-instance reading of the law would lead to “annihilative” damages, but the court said it was hamstrung by the text of the law, and it asked the Illinois legislature to consider amending the language.

“What the bill is telling the court is, ‘No, it is not the intention of the General Assembly that annihilative liability can attach to companies when they are guilty of technical violations of the law,’” bill sponsor State Sen. Bill Cunningham, a Democrat, said in an interview.

Cunningham said the BIPA law enacted in 2008 is written in a way that forces companies to settle out of court because of the massive judgments they might face based on the law’s overly expansive text.

“Attorneys who were defending the companies who had litigation brought against them were concerned about the runaway liability, and urged them to settle,” Cunningham said.

The bill has already passed the state Senate and is expected to be voted on in the General Assembly next week, Cunningham said.

“There is widespread support for BIPA in Illinois — ordinary citizens absolutely like the idea of knowing there are strong protections in place for the handling of their biometric information,” Cunningham said. 

But he said the law as written is unfair.

“When it comes to holding people or entities responsible for violating the statute, it's important that the punishment fits the crime,” he said.

Illinois plaintiffs’ attorney Jay Edelson, who has won large settlements in several BIPA cases, said he supports the bill.

Edelson said the recent Supreme Court ruling against White Castle struck him as unfair.

Referring to the current version of BIPA, Edelson said it puts “increased pressure on defendants to settle.”

“But that's not a good thing if they're settling just because they're scared that they're going to go bankrupt,” he added. “We want the cases to win or fail based on their merits.”