Illinois employers and other businesses operating in the state have secured relief from a mounting blizzard of potentially financially ruinous legal actions filed by trial lawyers under the state's biometrics privacy law, as Gov. JB Pritzker late last week signed a measure into law that would undo a punishing interpretation of the law from the state's high court.
The bill signing came nearly two and a half months since the General Assembly passed the measure.
Such reforms to the BIPA law have remained a top priority of business advocates and employers in Illinois for several years.
Business groups have said the legislation would be welcomed, but they said they believed the reforms should have gone farther, as it still leaves Illinois businesses too exposed to lawsuits under the state's Biometric Information Privacy Act.
The law, to this point, has largely allowed trial lawyers to rake in at least hundreds of millions of dollars in fees at the expense of businesses operating in Illinois for nearly a decade, without ever having to prove any of their clients were actually harmed.
Enacted in 2008, the Illinois BIPA law was ostensibly designed to safeguard the so-called unique identifying biometric information of employees and customers, including their fingerprints, facial geometry and other unique physical characteristics. Lawmakers at the time said the measure was inspired by the collapse of the company known as Pay By Touch, which had been among those pioneering the ability of consumers to pay for goods and services using fingerprint scanners.
Since 2015, however, the BIPA law has been used by a growing cadre of trial lawyers to target businesses of all types and sizes with an onslaught of thousands of class action lawsuits filed in Cook County and other courts in Illinois, and now even in other states.
Some of the lawsuits famously targeted tech giants, like Facebook- and Instagram-parent Meta and Google, resulting in high profile settlements worth hundreds of millions of dollars.
The overwhelming bulk of BIPA litigation, though, has landed on employers in Illinois. Such lawsuits have accused them of violating the law by scanning workers' fingerprints, faces, voices and other biometric characteristics, without first obtaining written consent or providing notices about how that information might be stored, used, shared and destroyed, among other technical provisions in the law.
Typically, such lawsuits have claimed employers improperly required workers to scan fingerprints to verify their identity when punching in and out of work shifts or to access secure or sensitive areas in a workplace, such as patient medication lockers in hospitals, cash rooms in retail stores, and rail yards.
A growing number of BIPA class actions have now targeted trucking companies for monitoring drivers on the job by scanning their faces as they drive for signs of fatigue in real time, while others have gone after app operators and other businesses for scanning customers' faces in their ID photos or in uploaded selfies to verify their identities when registering for services or renting equipment or other online or remote interactions.
To coerce compliance, the law gave plaintiffs the so-called right of private action - meaning they can file suit without permission from the state. And those sued under the law can face steep potentially payment demands of $1,000-$5,000 per violation.
However, under a series of decisions offering a broad interpretation of the law, the Illinois Supreme Court has empowered trial lawyers to use the BIPA statute as a club against targeted defendants, to secure relatively quick and easy big-money settlements, often worth millions of dollars.
In 2019, the Supreme Court ruled plaintiffs don't need to prove they were actually harmed by the collection of their biometric data, before bringing such potentially ruinous lawsuits.
Then, the Illinois Supreme Court increased that risk, by explicitly defining "individual violations" under the BIPA law as each time a company scans someone's biometric data. They also declared a five year statute of limitations.
So, when multiplied across entire workforces, for instance, such potential damage awards could turn "annihilative," with total payouts spiraling into the many millions or even billions of dollars, should a jury rule against a business defendant.
Armed with such legal weapons, reform advocates have noted the law firms bringing BIPA class actions have found a lucrative and steady source of revenue, taking in up to 40% of all money paid by businesses targeted by BIPA lawsuits.
A report from the Chamber of Progress, which represents companies in the tech sector, estimated trial lawyers have received, on average, $11.5 million in fees per BIPA lawsuit. In all, the Chamber of Progress report said the lawsuits allowed in Illinois courts under BIPA have resulted in the transfer of at least hundreds of millions of dollars from employers and other Illinois business to trial lawyers in the form of legal fees.
Noting the economically destructive nature of such lawsuits, justices on the Illinois Supreme Court joined with business advocates to call on Illinois lawmakers to bring balance to the law and rein in the ability of trial lawyers and their plaintiffs to bring potentially ruinous demands against businesses, when they cannot prove those businesses actually harmed anyone.
Following the most recent Illinois Supreme Court rulings, which made clear that businesses could face financial ruin under BIPA, Illinois Democratic leaders at last moved to rein in the law and at least blunt its worst possible outcomes.
Under the legislation known as Senate Bill 2979, the BIPA law is now revised to declare that "individual violations" can only be counted per person, not per biometric scan. Thus, BIPA plaintiffs could only demand $1,000-$5,000 each, not multiplied against potentially hundreds or even thousands of potential biometric scans per plaintiff over five years.
That change will significantly reduce by orders of magnitude the financial risk faced by businesses targeted by BIPA class actions.
Business leaders had pressed lawmakers to include additional reforms, including explicitly stating that the changes should apply to BIPA-related lawsuits already filed or pending in court.
Illinois Democrats, however, refused to include such a provision.
Legal observers have indicated this could likely serve as the next flashpoint in the ongoing legal fight over the scope and reach of BIPA. They noted businesses defending against such lawsuits can now argue in court that, while the law doesn't explicitly say the change in interpretation for damages calculations should apply retroactively, that it is clear that lawmakers did not intend for the law to be interpreted to allow for potential business-ending judgments, as the Illinois Supreme Court had found.
Pritzker signed SB2979 into law without significant fanfare or any kind of statement, as he did for other measures passed by his Democratic allies in the General Assembly. Rather, a release from the governor's communications team merely includes the legislation among a long list of other bills passed in the last legislative session which Pritzker signed into law on Aug. 2.
However, while businesses waited on Pritzker to sign SB2979 into law, trial lawyers in Cook County court and elsewhere in Illinois have continued to file BIPA class actions against dozens more employers and businesses under the old version of the law.
Business groups have indicated they will continue to push for further reforms to the law.