CHICAGO — As Illinois courts find their dockets filled with an increasing number of lawsuits brought against companies under a state privacy law for allegedly mishandling their employees' scanned fingerprints, companies should review their current liability insurance coverage and be wary of the law, said an attorney who focuses, in part, on insurance disputes involving employment law.
In 2017, more than 30 lawsuits have been brought in Chicago courts against employers of many types and various sizes under the Illinois Biometric Information Privacy Act, with the suits centering on the use of fingerprints, hand geometry and other so-called biometric identifiers.
Over the previous two years, only 14 lawsuits had been filed under BIPA, with most not touching employment-related matters.
“Any business that, for any purpose, is collecting, capturing, receiving or otherwise storing or in possession of any biometric information from individuals in Illinois must comply with the obligations of BIPA,” said Carolyn M. Branthoover, with the firm of K&L Gates.
While the latest spurt of lawsuits have focused on workers' rights under the BIPA law, other actions have dealt with the asserted rights of customers or users of various tech products and platforms.
“For example, if a business that is selling goods or services to customers in Illinois is also collecting biometric data to allow its customers to access an account or to complete a sale, those activities come within the scope of BIPA," Branthoover said.
Companies have a few different options when selecting insurance plans that cover alleged BIPA violations, according to the attorney, including under several types of insurance typically purchased by commercial policyholders.
“The policies that may potentially respond include commercial general liability, cyber liability and employment practices liability insurance policies, among others," Branthoover said. "Each potentially applicable policy should be reviewed carefully to determine the extent of the coverage provided.”
Having the exact type of coverage when collecting digital data is crucial, she said, as general liability insurance and employment practices liability insurance may not fully cover liability risks under a BIPA-related lawsuit.
“Policies already purchased by a company may provide coverage but even when coverage for biometric risks appears to be provided, it may be limited in scope,” Branthoover said. “A careful review of a company’s existing coverages should be undertaken to determine where gaps in coverage may exist."