CHICAGO — As the number of class action lawsuits filed under a state privacy law continue to mount against employers, Illinois companies should take notice of the wave of actions involving biometric data collection that has swept the state this year.
And then, they should take action to reduce their risk of becoming the next target, said David Cummings, an attorney at Reed Smith LLP, in Chicago.
Since the summer of 2017, employees in Illinois alone have filed dozens of class action lawsuits "challenging the biometric data policies of companies spanning multiple industries, from social media giants and national restaurant and hotel chains to retail and professional services businesses,” Cummings told the Cook County Record.
The lawsuits center around Illinois' Biometrics Information Privacy Act (BIPA), a state law enacted in 2008 to regulate the use, collection and storage of "biometric information," such as fingerprints and retinal, ear, facial and other features that can uniquely identify a person. Penalties for BIPA violations can be costly, Cummings said.
“The text of BIPA itself provides that plaintiffs may recover the greater of either actual damages incurred because of a violation, $1,000 for each ‘negligent’ violation, or $5,000 for each ‘intentional or reckless’ violation,” he said. “This doesn't factor in attorneys' fees and costs, which are also available under the act.”
Thus far, insurance companies for businesses sued in violation of BIPA have not challenged their obligations to fund a defense or settlement, Cummings said.
“That being said, we are just now at a point in time where BIPA litigation is beginning to spike, so I would be surprised if we don't start to see such pushback from insurers in the very near future,” he said. “Because BIPA litigation is very new, there will likely be a lot of uncertainty in the insurance coverage space moving forward.”
Cummings noted that Illinois law, in particular, can be very unforgiving to an insurer if it wrongfully refuses its duty to defend without a reservation of rights or a declaratory judgment action.
“So, a seasoned insurance company knows it's in the company's best interest to pursue a declaratory judgment right away,” Cummings said.
Being insured against BIPA is key to keeping a business free of fraudulent fingerprint collection.
“It's very important for an employer to review the full universe of its liability insurance program with its risk management team to make sure it understands the coverage currently in effect,” Cummings said.
Cummings said that in the future, Illinois employers should discuss BIPA coverage with insurance agents and professionals, specifically seeking out policies that provide adequate coverage for these lawsuits.
“If the employer has coverage counsel or is in a position to retain coverage counsel, it is a good idea to consult with them,” Cummings said. “These attorneys often deal with unique coverage disputes and can be strong resources for new or unusual legal issues, such as is the case with coverage for BIPA lawsuits.”
Cummings said Illinois employers should be cautious about the class action suits that are sweeping across the state.
“It is critical that an employer examine BIPA and evaluate its compliance requirements against its own practices,” Cummings said. “The sooner an employer can make sure it is consistently complying with all of BIPA's requirements, the better chance it has at avoiding potentially costly litigation, or at least limiting its exposure as much as possible.”