Illinois businesses could get some long-awaited protection from potentially ruinous financial judgments and settlements under Illinois' biometrics privacy law, under reform legislation that has cleared the Illinois State Senate.
Much of Illinois' business community, however, say the reform measures still leave Illinois employers and other drivers of the state's economy too exposed to potentially massive class action lawsuits brought by trial lawyers who, to this point, have used the law to generate hundreds of millions of dollars in legal fees, without ever having to demonstrate anyone has actually been harmed.
On Thursday, April 11, the Illinois Senate voted to 46-13 to advance legislation, docketed as SB2979, intended to mitigate the potential financial harm to Illinois businesses and the state economy from the Illinois Biometric Information Privacy Act (BIPA.)
Brad Tietz
| Chicagoland Chamber of Commerce
The legislation, championed in the State Senate by Sen. Bill Cunningham, D-Chicago, would specifically address concerns raised by judges, attorneys, business advocates and others for the potential for "annihilative" payouts faced by Illinois employers and other businesses under the BIPA law.
“This reform to BIPA will protect small businesses from undue financial burden while still providing strong protections for consumers and workers,” said Cunningham in a prepared statement, following the vote. “As technology continues to advance, it’s importance that our laws keep up with the times.”
Cunningham represents portions of Chicago and suburban communities in southwest Cook County.
Enacted in 2008, the Illinois BIPA law was ostensibly designed to safeguard the so-called unique identifying biometric information of consumers and employees, such as their fingerprints, retinas or facial geometry, among others. It was inspired by the collapse of the company known as Pay by Touch, which had been among those pioneering the ability of consumers to pay for goods and services by linking their banking information to one of the unique biometric identifiers, in that case, their fingerprints.
Since 2015, however, the BIPA law has been used by a growing cadre of trial lawyers to target businesses of all types and sizes with more than 2,000 class action lawsuits, with more BIPA-related class actions piling weekly into Cook County Circuit Court, other courts in Illinois, and even in other states, including California.
Some of the lawsuits have famously targeted social media giants, like Facebook-parent Meta and Google, resulting in headline grabbing settlements worth hundreds of millions of dollars.
The overwhelming bulk of the lawsuits to date, however, have pursued employers, accusing them of violating the law for scanning workers' so-called biometric identifiers, such as fingerprints, faces, retinas, voices or other unique identifying physical characteristics, without first obtaining express consent or providing notices concerning how a business might use, store, share or destroy the biometric scans, among others of the law's technical provisions.
Typically, those lawsuits have asserted employers have improperly required workers to scan their fingerprints to punch in and out of work shifts or to access secure or sensitive areas in a workplace, such as patient medication lockers in hospitals, cash rooms in retail stores, or rail yards, which operate under federal security mandates.
A growing number of BIPA class actions, for instance, have targeted trucking companies for using so-called biometric cameras to scan truck drivers' faces to monitor their activities in real time.
To coerce compliance with the law, BIPA included language allowing both a so-called private right of action - meaning individuals can file suit without permission from the state - and steep potential payment demands of $1,000-$5,000 per violation.
However, under a series of Illinois Supreme Court decisions, a broad interpretation of the law has empowered trial lawyers to use those provisions as a battering ram to secure relatively quick and easy settlements, often worth millions of dollars.
In 2019, the state ruled plaintiffs don't need to prove they were ever actually harmed by the collection of the biometric data. The court said it is enough for them to only assert a business may have violated the law's technical provisions.
Most recently, the court upped the risk, by explicitly defining "individual violations" under the BIPA law as each time a company scans someone's biometric data and agreeing to allow a five-year statute of limitations. When multiplied across entire workforces or over untold numbers of customers, such potential damage awards could turn "annihilative," as some judges have observed.
Armed with such legal weapons, reform advocates have noted the law firms bringing BIPA class actions have found a lucrative and steady source of revenue, taking in up to 40% of all money paid by businesses targeted by BIPA lawsuits.
A report from the Chamber of Progress, which represents companies in the tech sector, estimated trial lawyers have received, on average, $11.5 million in fees per BIPA lawsuit. In all, the Chamber of Progress report said the lawsuits allowed in Illinois courts under BIPA have resulted in the transfer of at least hundreds of millions of dollars from employers and other Illinois business to trial lawyers in the form of legal fees.
Noting the economically destructive nature of such lawsuits, justices on the Illinois Supreme Court joined with business advocates to call on Illinois lawmakers to bring balance to the law and rein in the ability of trial lawyers and their plaintiffs to bring potentially ruinous demands against businesses, when they cannot prove those businesses actually harmed anyone.
Cunningham said the SB2979 legislation was in part to answer the request from the Illinois Supreme Court to revisit at least the portion of the law dealing with the financial risk faced by Illinois businesses and the economy from the BIPA law.
Under SB2979, the law would be revised to declare that the law should be interpreted to define "individual violations" as only the first time a person's fingerprints or other biometrics are scanned, and not every subsequent scan.
That measure would significantly reduce the potential payout risk faced by businesses targeted by BIPA class actions. In the Illinois Supreme Court case that resulted in the decision broadening BIPA liability each and every scan, fast food chain White Castle, for instance, noted it could face a payout of as much as $17 billion under the broader interpretation.
Under the more narrow definition, that payout risk would drop to $37.5 million. While still a large payout, it would not risk putting White Castle out of business entirely, the company's lawyers noted.
“This doesn’t change any current privacy protections in the law, it just adjusts the penalty for violating the act," Cunningham said.
While welcoming the potential changes to the law, business groups said the changes fall short of what is needed to align the law's purposes with its negative effects on the Illinois economy.
Since SB2979 advanced out of a Senate committee this spring, a coalition of business advocacy groups lodged opposition, particularly noting the measure does nothing to protect White Castle and other businesses already facing lawsuits.
The coalition includes the Chicagoland Chamber of Commerce, Illinois Chamber of Commerce, Illinois Hotel & Lodging Association, Illinois Manufacturers' Association, Illinois Railroad Association, Illinois Retail Merchants Association, Illinois Trucking Association, and the National Federation of Independent Business Illinois.
"Though SB 2979 will place some limits on financial exposure for companies that have yet to be targeted for business-ending judgements under the existing law, it is not retroactive and therefore fails to help the thousands of businesses still fighting against massive judgments even though there is no proof that harm ever occurred," the coalition said in a statement released earlier this year.
In comments emailed to The Cook County Record, Brad Tietz, government relations director for the Chicagoland Chamber of Commerce, added his organization remains opposed to the legislation in its current form.
"We are sincerely grateful for Leader Cunningham's work on the bill and believe addressing the White Castle (Illinois Supreme Court) decision is a significant step forward," Tietz said. "But we continue to push for additional reforms on behalf of our members."
In their earlier statement, the business group coalition further noted SB2979 doesn't address concerns over interference with businesses' "ability to deploy proven and reliable technology for security and protection purposes, such as managing access to controlled substances, limiting entry to sensitive facilities, preventing violent crime and ensuring roadway safety."
The Illinois Trial Lawyers Association took no position on SB2979. ITLA and its trial lawyer members consistently lavish significant campaign donations to Illinois Democrats in Springfield.
SB2979 will now advance to the Illinois House of Representatives for further consideration during the spring legislative session.