The state's business community and other observers are watching to see if Gov. JB Pritzker will sign into law the reforms of the state's biometrics privacy law that cruised through the Democrat-dominated Illinois General Assembly this spring, and which supporters say they hope will ease the financial risk posed by lawsuits under the law to employers operating in the state.
But while the changes may make class action lawsuits under Illinois' Biometric Information Privacy Act less appealing to the state's powerful trial lawyers, employers still should remain on guard for potentially costly litigation lodged under BIPA and a strikingly similar law, the Illinois Genetic Information Privacy Act, say lawyers who help businesses deal with both laws.
"This will help," said Nick Kahlon, a partner attorney with the firm of Riley Safer Holmes & Cancila, of Chicago. "But I don't believe this will serve as a deterrent."
Attorney Nick Kahlon
| Riley Safer Holmes & Cancila
Last week, the Illinois state House of Representatives overwhelmingly passed a reform measure designed to finally reduce the financial risks faced by employers and others doing business in Illinois from potentially ruinous payouts stemming from lawsuits brought under the BIPA law. The measure also had easily passed the Illinois State Senate weeks earlier.
Under the reform legislation known to this point as Senate Bill 2979, lawmakers have for the first time made clear that the BIPA law applies its potentially costly statutory damages provisions on a per person basis, and not per scan of people's fingerprints, faces, voices or other so-called biometric identifiers.
The difference may not seem like much at first glance. But the reform could make a difference between a business paying hundreds of thousands of dollars or even millions, versus hundreds of millions or billions of dollars to resolve BIPA claims.
BIPA reforms
Since 2015, a growing cadre of trial lawyers have used the BIPA law to lodge thousands of class actions and other lawsuits against employers and other businesses. To this point, reports say those lawsuits have largely allowed trial lawyers to gin up hundreds of millions of dollars in fees, while hammering businesses with lawsuits under a legal standard that never requires them to prove anyone was actually harmed.
Some of the lawsuits have famously resulted in high profile settlements worth hundreds of millions of dollars from tech giants, like Facebook- and Instagram-parent Meta and Google. However, the overwhelming bulk of BIPA lawsuits have come down on Illinois employers. The lawsuits have typically accused them of violating the law by scanning workers' fingerprints, faces, voices and other so-called biometric identifiers, without first obtaining written consent or providing notices about how that information might be stored, used, shared and ultimately destroyed.
Typically, such lawsuits have claimed employers improperly required workers to scan fingerprints to verify their identities when punching in and out of work shifts or to access secure or sensitive areas in a workplace, or to monitor workers' actions while on the job to ensure workplace and public safety.
To coerce compliance, the law gave plaintiffs the so-called right of private action, allowing them to sue businesses accused of violating the BIPA law. Those sued can face potentially steep payment demands of $1,000-$5,000 per violation.
Under Illinois Supreme Court rulings, the law was interpreted broadly, as plaintiffs could bring their lawsuits against businesses without showing they were ever actually harmed, and they could demand payment for each and every allegedly illegal biometric scan.
When multiplied across entire workforces, for instance, with each worker scanning a fingerprint multiple times per day, damages under this interpretation could quickly climb to the many millions, or even hundreds of millions of dollars, or more.
At the same time as allowing the law to be wielded in such a fashion against businesses, the state high court also called on lawmakers to revise the law to limit the potential for what they called "annihilative damages."
After turning a largely deaf ear to calls for BIPA reform from Illinois' business community for years, the state's Democratic legislative supermajority responded to the request from the Democrat-dominated state Supreme Court, and voted to enact SB2979, making clear that the court's interpretation of the law to allow plaintiffs to demand thousands of dollars per scan was not the intent of the law.
Business groups have asserted the law doesn't go far enough, as they would like to see the limitations explicitly applied to BIPA lawsuits already filed, as well as other BIPA reforms to further reduce the economic threat posed by the law.
Kahlon and attorney John Ochoa, of the Chicago firm of Amundsen Davis, who also helps businesses defend against such class actions, agreed the changes under SB2979 could help businesses address some of the BIPA risk, should Gov. Pritzker ultimately sign the passed legislation into law.
'The next battles'
Ochoa noted the changes under SB2979 could particularly give the hundreds of businesses currently faced by steep payment demands under currently pending BIPA lawsuits the legal grounds to argue that those payment demands must be toned down, to be in keeping with what Illinois lawmakers have now declared was their stated intent.
However, Ochoa noted that plaintiffs' lawyers may just as easily argue that, by enacting SB2979, lawmakers actually admitted the previous version of the law allowed for "per scan" damages claims, and amounted to a substantive change to the law, not merely a clarification. So, with no language explicitly stating the law should be applied to cases already filed, they could argue their damages claims should be allowed to remain, Ochoa said.
"That will likely be what the next big BIPA battles will be about (in court)," Ochoa said.
But any changes to the BIPA law could have ramifications for litigation under a different law, dealing with different subject matter, but using very similar language and enforcement mechanism - potentially leveling a very similar threat for businesses.
In recent years, some of the same lawyers who specialized in targeting businesses under the BIPA law have also begun taking aim at Illinois employers under the law known as the Illinois Genetic Information Privacy Act (GIPA.)
Like BIPA, GIPA was enacted decades ago, and has largely lain dormant, until very recently.
Just as BIPA, GIPA was enacted by lawmakers seeking to enact guidelines to require businesses to protect certain sensitive information. In the case of GIPA, that means people's protected so-called genetic information.
And like BIPA, GIPA allows people to bring individual and class action lawsuits, potentially imposing massive payouts on businesses, with statutory damages of up to $15,000 per violation.
Invoking the Illinois Supreme Court's BIPA decisions that broadened the interpretation and risk under the biometrics law, trial lawyers have asserted employers should also similarly pay under GIPA.
The lawsuits have particularly targeted employers who allegedly violate the law by asking job applicants about their personal and family medical histories, either as part of the application process or during a physical examination during onboarding after a job offer has been accepted. The lawsuits assert that, since family and personal medical history are protected by federal law, then they also are protected by state law.
Business targeted under the GIPA law have included such large employers as Ford, Amazon, health and hospital system Advocate Aurora Health and the Chicago Transit Authority, among dozens of others.
While some of the lawsuits have been dismissed, many others remain pending, Ochoa and Kahlon said, with employers facing an uncertain fate in court.
Ochoa noted that, unlike BIPA litigation, no cases have yet resulted in any substantive rulings on the key questions, nor have there been any significant settlements or resolution to any of the lawsuits.
"These GIPA cases are all still in the early stages," Ochoa said. "The litigants who brought these cases are claiming they are similar to BIPA.
"So it may be interesting to see what affect the changes to BIPA may have on GIPA litigation, as well."
However, both Ochoa and Kahlon said they doubted the changes to BIPA under SB2979, should the legislation become law, would significantly alter the legal playing field around GIPA litigation.
Ochoa and Kahlon noted that the BIPA changes are meant to limit the ability of plaintiffs to collect damages for multiple violations of the same legal provisions. Under the current interpretation, the same plaintiff could collect $1,000-$5,000 for each time they scanned a fingerprint, for instance, when punching the clock to begin and end a work shift.
GIPA, however, does not offer such opportunities for multiple collections for stacked violation claims, the attorneys said.
GIPA violations claims are usually one-time "discrete events," said Ochoa.
"Asking about medical history one time is not like clocking in and out multiple times per day," Ochoa said.
Kahlon agreed.
"Employers generally are not going to have some request made of some individual multiple times (for their medical history)," said Kahlon.
He said there is really only certain potential BIPA reform that would generally pull the rug out from under GIPA lawsuits.
Kahlon said state lawmakers could enact legislation to clearly require plaintiffs to prove they were actually harmed by the collection of their information before they can bring their big money lawsuits.
Or they could amend the BIPA law to include a safe harbor provision that could allow employers to defend themselves by claiming they had collected the biometric or genetic information in good faith, believing they were abiding by the law.
While it remains unclear if lawmakers may consider further changes to BIPA or any changes to GIPA, Kahlon and Ochoa urged employers to educate themselves about the laws and take steps to protect themselves from potential lawsuits.
GIPA "filings are growing at an exponential pace," said Kahlon.
"This is a real litigation threat, but somwhat of an unknown threat still," he said. "I think businesses now appreciate the danger posed by BIPA, but that's been years in the making."
Kahlon said he hopes it doesn't take as long - or cost near as much - to get the attention of employers and other businesses in Illinois over GIPA litigation.
"One hope I have," he said. "Now that they (the Illinois business communities) have mobilized to win changes to BIPA, my hope is that will carry over to GIPA, as well."
Pritzker has not yet publicly indicated if or when he might sign SB2979 into law.