Major BIPA Amendment Signed Into Law

A game-changing amendment to Illinois’ biometric privacy law is now officially on the books. On August 2, 2024, Illinois Governor JB Pritzker signed into law S.B. 2979, a significant amendment to the Illinois Biometric Information Privacy Act (BIPA). The new law specifies that multiple instances of collecting the same biometric identifier from the same person using the same method in violation of BIPA’s notice and consent requirements will now count as a single violation.

The amendment aims to reduce the potential liability for businesses under BIPA by ensuring that each aggrieved person is entitled to, at most, one recovery for a single collective violation.

Previously, companies could face substantial penalties for each instance of biometric data collection without proper consent. For example, an employer using a biometric timekeeping system without the required notice and consent could be liable for a violation each time an employee used the system. Under the amended law, the employer would only be liable for one violation, significantly reducing the financial risk. The change is expected to decrease the incentive for plaintiffs to file multiple suits under BIPA.

The amendment overturns the Illinois Supreme Court’s decision in Cothron v. White Castle Systems, Inc. In that case, the court ruled that a new claim accrued with each scan or transmission of biometric data without informed consent, leading to potentially excessive damage awards. The court had emphasized that it could not rewrite the statute to include new elements or limitations, leaving it to the legislature to address these concerns. The new amendment addresses these policy-based concerns by changing the fine structure from a per-scan to a per-person basis.

Importantly, the amendment also allows for electronic consent, defining an electronic signature as an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record. This clarification means that online “clickwrap” releases are now considered valid forms of consent under BIPA.

The legislative change went into effect immediately upon the governor’s signature. It represents a significant shift in the enforcement of BIPA, and will likely reduce the volume of class action lawsuits that have previously targeted businesses for non-compliance with the act’s stringent requirements.

Sources: The National Law Review, Inside Privacy

–

August 5, 2024 – by Cass Kennedy and Alex Perala