BIPA Amended to Axe Per-Scan Liability
by: Benjamin Stein
Last Friday, Governor Pritzker signed into law an amendment to Illinois’ Biometric Information Privacy Act (BIPA). The amendment, SB2979 , directly addresses the Illinois Supreme Court’s 2023 decision in Cothron v. White Castle, previously discussed here.
In Cothron, the Court held that each time an entity collects an individual’s biometric identifier or information, and each time it discloses that same identifier/information, is an independent violation of BIPA’s prohibitions on collection and disclosure without consent (Sections 15(b) and (d) of BIPA). That is: entities would be liable on a “per scan” basis, even if the violative act were something like scanning an employee’s fingerprint every time that person clocked in and out of work. Because BIPA provides for statutory damages of $1,000 per negligent violation and $5,000 per willful violation, the potential liability ramifications of this decision were enormous.
The new amendment expressly does away with per-scan liability. To paraphrase, it establishes that a single entity that repeatedly collects or discloses the same biometric identifier or biometric information, captured from the same individual via the same method, is liable to that person for (at most) one violation of each of the two BIPA sections at issue.
The amendment also clarifies the definition of “written release” to specify that an electronic signature suffices to secure the necessary consent. (Electronic signature is defined as any “electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record.”)
This amendment takes effective immediately.
While – notwithstanding this change – potential BIPA liability remains significant and compliance with BIPA should remain a point of focus for any party that handles the biometric data of Illinois residents, this amendment should offer some measure of relief for those that nonetheless find themselves the target of litigation.
* * * *
Originally published by InfoLawGroup LLP. If you would like to receive regular emails from us, in which we share updates and our take on current legal news, please subscribe to InfoLawGroup’s Insights HERE.