Illinois has some of the country’s strongest privacy protections in place with respect to biometric information. Violations of the law have led to a number of class action lawsuits in recent months.

What is BIPA? 

BIPA, the Biometric Information Privacy Act, is a state law in Illinois intended to protect the security and privacy of individuals’ biometric information. It became law in 2008 and is considered one of the strongest and most comprehensive biometric privacy laws in the country.  

The law primarily regulates the collection, storage, use, and dissemination of individuals’ biometric information by private entities. The law defines biometric information as data based on a person’s unique physical or behavioral characteristics. Fingerprints, retinal scans, facial scans, and voiceprints are all covered under BIPA.

Key provisions of the law include:

• Consent Requirement: Private entities must obtain written consent from individuals before collecting, capturing, or storing their biometric information.
• Disclosure and Retention Policies: Covered entities must have a written policy that explains their biometric data collection and storage practices, as well as their data retention and destruction policies. They are required to make this policy available to the public.
• Purpose Limitation: Biometric information can only be collected for specific purposes and cannot be used for other unrelated activities without obtaining additional consent.
• Protection and Security: Private entities must use reasonable safeguards to protect biometric information from unauthorized access, acquisition, or disclosure. They must apply the same or greater level of protection as they would for other sensitive and confidential information.
• Prohibition on Sale or Disclosure: BIPA prohibits the sale, lease, trade, or other disclosure of biometric information without consent. Biometric data cannot be used for marketing, advertising, or other commercial purposes without explicit authorization.
• Private Right of Action: BIPA provides individuals with a private right of action, meaning they can file lawsuits against entities that violate the law’s provisions. Individuals can seek damages and injunctive relief for violations of their biometric privacy rights.

BIPA has had a significant impact on businesses and organizations that collect and use biometric information in Illinois. Through litigation, the parameters of the law have changed over time and class action lawsuits are not uncommon. 

Recent Class Action Litigation

As businesses collect more and more information as part of their business models, violations of BIPA have become more common, leading to a series of class action lawsuits, including:

CVS

Plaintiffs claim CVS violated BIPA by allegedly failing to inform customers it uses software that scans their facial geometry when their picture is taken. 

Forman Mills

Forman Mills agreed to pay over $2.38 million to resolve claims it violated BIPA by collecting employee biometrics without using the proper disclosures.

PetSmart

PetSmart LLC will pay more than $424,000 to settle a proposed class action alleging it collected workers’ voiceprints in violation of BIPA.

For more insights on legal trends and more, subscribe to RapidFunds on LinkedIn. RapidFunds has been providing settlement funding for almost 20 years. We’ve completed over 4,000 transactions and have helped thousands of firms with funding. Stop waiting for your legal fees and contact RapidFunds today.