The Illinois Supreme Court has ruled that companies that collect biometric data without proper consent may face millions of dollars in penalties. In a 4-3 decision, the court found that a separate claim for damages can arise each time a business fails to seek permission to gather biometric data from workers or consumers or to disclose retention plans for that information.
The ruling answers certified questions posed by the US Court of Appeals for the Seventh Circuit in a case brought by former White Castle manager Latrina Cothron, who alleged the hamburger chain violated her biometric privacy rights by collecting fingerprints without her written consent every time she clocked in and out of the timekeeping system. BIPA, enacted in 2008, provides $1,000 in damages per violation or $5,000 per intentional or reckless violation. The ruling follows the Illinois high court’s recent grant of a five-year statute of limitations to all biometric privacy claims, which may also increase company liability.
The decision could affect pending legislation in several states, including New York, contemplating similar biometric privacy statutes. Attorneys said a critical holding from the decision is that damages are discretionary and not mandatory. The decision clarifies the violation, but several other issues regarding the statute remain unanswered, including which technologies are governed by the biometric law, the extent of its extra-territorial application, when damages should be awarded, and how employers and other businesses should comply with consent regimes they may enact.
The ruling has been viewed as a boon to the plaintiff’s class action bar, which has filed litigation against big tech and social media companies, airlines, railroads, retailers, grocery stores, restaurants, and more. But attorneys say it could also lead to workplace changes, with some employers potentially stopping the use of fingerprint time clocks. The ruling also may cause significant business disruption to companies in Illinois that now face potentially huge damages. For companies with multiple locations and hundreds of employees who use biometric systems each day, adopting the interpretation put forward by Cothron would be catastrophic, businesses had argued.
REFERENCES:
Illinois Supreme Court Allows Big Biometric Privacy Fines (3)