In the ever-evolving landscape of privacy law, one of the central themes over the past year has been the surge in litigation under the Biometric Information Privacy Act (BIPA) in Illinois. While BIPA remains the foremost biometric privacy statute, comparable laws are emerging in various states, making it imperative for companies nationwide to stay abreast of these developments. Recent litigation has underscored the paramount importance of compliance with these statutes, as companies found liable in BIPA class actions face potentially catastrophic damages, threatening their very existence.
Understanding BIPA and Its Implications
Enacted in 2008, BIPA is a groundbreaking piece of legislation that governs the collection, sale, disclosure, storage, and destruction of biometric data. This includes unique physical or behavioral characteristics like retina or iris scans, fingerprints, voiceprints, and scans of hand or face geometry. The law mandates that individuals must provide explicit consent before their biometric data is collected or disclosed, establishing a private right of action for those whose data is mishandled.
The Risks and Stakes Amplified
BIPA imposes significant statutory damages, amounting to $1,000 per negligent violation and $5,000 per reckless or intentional violation. A recent ruling by the Illinois Supreme Court has expanded the scope of liability, considering each biometric scan as a separate violation. This interpretation dramatically escalates the exposure of non-compliant companies, particularly those employing biometric time clocks, where employees may undergo multiple scans daily. Notably, the largest BIPA class-action jury trial resulted in a staggering $228 million verdict, underscoring the potential financial repercussions.
Proactive Measures to Mitigate BIPA Liability
To shield themselves from BIPA liability, companies must implement proactive measures. Key considerations include obtaining explicit consent before collecting biometric information, securely storing such data in compliance with BIPA, and establishing comprehensive privacy policies. To assess exposure to BIPA, companies can ask crucial questions, such as whether they collect, store, or use biometric information and whether they provide advance written notice and obtain affirmative written consent.
BIPA’s Role in Protecting Biometric Privacy
BIPA serves as a crucial safeguard for biometric privacy, emphasizing the individual’s right to control their biometric data. The law ensures transparency by requiring companies to inform individuals in writing about the data being collected, its purpose, and the duration of storage. At a time when facial recognition technology is becoming prevalent, BIPA remains a vital barrier against its potential misuse, particularly concerning accuracy and discriminatory effects, especially on women and people of color.
Navigating BIPA Compliance Across Industries
For private entities, compliance with BIPA is essential. While BIPA is one of the most stringent privacy regulations in the United States, it has inspired similar legislation in other states. The law applies to private entities, excluding state or local government agencies. Certain exceptions are granted for financial institutions and state contractors, underlining the nuanced nature of compliance obligations.
Key Definitions and Obligations Under BIPA
BIPA provides explicit definitions of biometric information and identifiers, outlining what is covered and excluded. Covered entities must adhere to obligations such as maintaining a written retention and destruction policy, providing notice, obtaining written consent, and safeguarding biometric information. Penalties for non-compliance include a private right of action, with potential damages ranging from $1,000 to $5,000, litigation costs, and other relief as deemed appropriate by the court.
Operationalizing BIPA Compliance: A Comprehensive Approach
To operationalize BIPA compliance, organizations must examine and outline procedures for collecting, processing, storing, or transmitting biometric data. Clear written policies, employee training, risk assessments, and obtaining explicit consent are crucial steps. Broadcasting the biometric data policy to employees and stakeholders fosters transparency and demonstrates commitment to protecting individual privacy rights.
The Expanding Impact of BIPA: Beyond Illinois Borders
While BIPA originated in Illinois, its impact is resonating far beyond state borders. Other states are either enacting similar legislation or incorporating biometric data into their broader data privacy and security laws. This evolving landscape underscores the need for companies to adopt a holistic approach to biometric privacy compliance, recognizing the potential impact on a national scale.
Conclusion
In an era where technological advancements continue at a rapid pace, the protection of biometric privacy stands as a paramount concern. BIPA, as a trailblazing legislation, sets the standard for biometric privacy protection. Companies must proactively navigate the legal landscape, ensuring compliance with BIPA and similar emerging statutes to safeguard not only their reputation but also their financial stability in the face of potential litigation. Consulting with privacy counsel and implementing robust policies and practices are essential steps for businesses seeking to build cyber resilience and maintain compliance with evolving biometric privacy laws, as they navigate the intricate web of regulations governing the collection and use of biometric information.