Illinois lawmakers have given final approval to a reform measure supporters say will finally shield employers and others doing business in Illinois from potentially ruinous payouts under Illinois' stringent biometrics privacy law.
Business groups have said the reforms are welcome, but they don't believe it goes far enough, and still leaves Illinois businesses too exposed to lawsuits under the Biometric Information Privacy Act, a law which, to this point, has largely allowed trial lawyers to rake in hundreds of millions of dollars in fees without ever having to prove any of their clients were actually harmed.
On May 16, the Illinois House of Representatives overwhelmingly voted to approve legislation known as Senate Bill 2979, intended to mitigate the potential financial harm to Illinois businesses and the state's economy under the BIPA law.
The measure passed in the House 80-31, carried by the Democratic supermajority and a few Republicans.
The House vote came a little over a month since the Illinois State Senate also voted overwhelmingly to advance SB2979, which was introduced by State Sen. Democratic Leader Bill Cunningham, of Chicago.
The measure advances to the desk of Gov. JB Pritzker.
At the time the measure moved through the Senate, Cunningham said the legislation was intended to address concerns raised by judges, attorneys, business advocates and others for the potential of "annihilative" payouts faced by businesses in Illinois from class action lawsuits brought under the BIPA law.
Enacted in 2008, the Illinois BIPA law was ostensibly designed to safeguard the so-called unique identifying biometric information of employees and customers, including their fingerprints, facial geometry and other unique physical characteristics. Lawmakers at the time said the measure was inspired by the collapse of the company known as Pay By Touch, which had been among those pioneering the ability of consumers to pay for goods and services using fingerprint scanners.
Since 2015, however, the BIPA law has been used by a growing cadre of trial lawyers to target businesses of all types and sizes with an onslaught of thousands of class action lawsuits filed in Cook County and other courts in Illinois, and now even in other states.
Some of the lawsuits famously targeted tech giants, like Facebook- and Instagram-parent Meta and Google, resulting in high profile settlements worth hundreds of millions of dollars.
However, the overwhelming bulk of BIPA litigation has come down on employers in Illinois. Such lawsuits have accused them of violating the law by scanning workers' fingerprints, faces, voices and other biometric characteristics, without first obtaining written consent or providing notices about how that information might be stored, used, shared and destroyed, among other technical provisions in the law.
Typically, such lawsuits have claimed employers improperly required workers to scan fingerprints to verify their identity when punching in and out of work shifts or to access secure or sensitive areas in a workplace, such as patient medication lockers in hospitals, cash rooms in retail stores, and rail yards.
A growing number of BIPA class actions have now targeted trucking companies for monitoring drivers on the job by scanning their faces as they drive for signs of fatigue in real time, while others have gone after app operators and other businesses for scanning customers' faces in their ID photos or in uploaded selfies to verify their identities when registering for services or renting equipment or other online or remote interactions.
To coerce compliance, the law gave plaintiffs the so-called right of private action - meaning they can file suit without permission from the state. And those sued under the law can face steep potentially payment demands of $1,000-$5,000 per violation.
However, under a series of decisions offering a broad interpretation of the law, the Illinois Supreme Court has empowered trial lawyers to use the BIPA statute as a club against targeted defendants, to secure relatively quick and easy big-money settlements, often worth millions of dollars.
In 2019, the Supreme Court ruled plaintiffs don't need to prove they were actually harmed by the collection of their biometric data, before bringing such potentially ruinous lawsuits.
Then, the Illinois Supreme Court increased that risk, by explicitly defining "individual violations" under the BIPA law as each time a company scans someone's biometric data. They also declared a five year statute of limitations.
So, when multiplied across entire workforces, for instance, such potential damage awards could turn "annihilative," with total payouts spiraling into the many millions or even billions of dollars, should a jury rule against a business defendant.
Armed with such legal weapons, reform advocates have noted the law firms bringing BIPA class actions have found a lucrative and steady source of revenue, taking in up to 40% of all money paid by businesses targeted by BIPA lawsuits.
A report from the Chamber of Progress, which represents companies in the tech sector, estimated trial lawyers have received, on average, $11.5 million in fees per BIPA lawsuit. In all, the Chamber of Progress report said the lawsuits allowed in Illinois courts under BIPA have resulted in the transfer of at least hundreds of millions of dollars from employers and other Illinois business to trial lawyers in the form of legal fees.
Noting the economically destructive nature of such lawsuits, justices on the Illinois Supreme Court joined with business advocates to call on Illinois lawmakers to bring balance to the law and rein in the ability of trial lawyers and their plaintiffs to bring potentially ruinous demands against businesses, when they cannot prove those businesses actually harmed anyone.
Under SB2979, the BIPA law would be revised to declare that "individual violations" can only be counted per person, not per biometric scan. Thus, BIPA plaintiffs could only demand $1,000-$5,000 each, not $1,000-$5,000 for every time they punched a timeclock or accessed a biometrically controlled system in their workplace.
That change will significantly reduce the potential payout risk faced by businesses targeted by BIPA class actions. In the Illinois Supreme Court case that resulted in the decision broadening BIPA liability to each and every scan, fast food chain White Castle, for instance, noted it could face a payout of as much as $17 billion under the broader interpretation.
Under the more narrow definition, White Castle predicted it would owe about $9.5 million. The company agreed in April to settle for that amount.
Business groups have long called for reform of BIPA, noting the harm the law was inflicting on Illinois' economy and its reputation.
And while they said they welcomed the changes in SB2979, a coalition of business advocates said they believe further reforms are needed. The coalition included the Chicagoland Chamber of Commerce, Illinois Chamber of Commerce, Illinois Hotel & Lodging Association, Illinois Manufacturers' Association, Illinois Railroad Association, Illinois Retail Merchants Association, Illinois Trucking Association and the National Federation of Independent Business Illinois.
They and many Republican lawmakers particularly said the measure should be retroactive, to protect businesses already facing such lawsuits.
Democrats, however, would not agree to that change, ultimately advancing SB2979 without the requested retroactivity.
A spokesperson for the Illinois Manufacturers Association pointed to a statement the BIPA reform coalition issued in March about the legislation, calling for SB2979 to go further than drafted by Cunningham and supported by his fellow Democratic lawmakers.
"Though SB 2979 will place some limits on financial exposure for companies that have yet to be targeted for business-ending judgements under the existing law, it is not retroactive and therefore fails to help the thousands of businesses still fighting against massive judgments even though there is no proof that harm ever occurred," the coalition said in that March statement.
"The sentiments remain," the spokesperson said in an email to The Cook County Record.
A spokesperson for the Illinois Chamber of Commerce issued a statement in response to questions from The Cook County Record following the House vote.
"The Illinois Chamber appreciates Leader Cunningham's amendment of the current Biometric Information Privacy Act via SB 2979. He has been an active proponent of reforming BIPA for many years and has always afforded business a seat at the table," the Illinois Chamber statement said.
"We did not support the bill (SB2979) because we believe that, while it caps damages moving forward, which helps some businesses, it does not address the retroactive damages that have already been filed. These damages amount to billions, and businesses will have to pay to defend or settle.
"Additionally, the bill did not include an exemption for security purposes, similar to what Washington State did (HB 1493). The lack of this exemption recently led to a class action lawsuit being filed on March 11 in Cook County against Target Corporation for their surveillance systems. This serves as another example of the impact of the original BIPA statute, which had little input from businesses in its drafting.
"The Illinois Chamber looks forward to continuing the conversation to further reform the law."