Duane Morris Takeaway: This week’s episode of the Class Action Weekly Wire features Duane Morris partner Jennifer Riley and associate Tyler Zmick with their discussion of significant rulings and developments in the biometric privacy class action sphere.
Check out today’s episode and subscribe to our show from your preferred podcast platform: Spotify, Amazon Music, Apple Podcasts, Google Podcasts, the Samsung Podcasts app, Podcast Index, Tune In, Listen Notes, iHeartRadio, Deezer, YouTube or our RSS feed.
Episode Transcript
Jennifer Riley: Thank you for being here for the next episode of our weekly podcast, the Class Action Weekly Wire. I’m Jennifer, Riley, partner at Duane Morris, and joining me today is my colleague Tyler Zmick. Thank you for being on the podcast, Tyler.
Tyler Zmick: Thanks, Jen, very happy to be here.
Jennifer: Today on the podcast we are discussing the Illinois Biometric Information Privacy Act, or sometimes called BIPA, as well as notable decisions from courts over the past 18 months, highlighting a recent 2024 ruling. Tyler, could you give our listeners a brief overview of the BIPA?
Tyler: Absolutely, Jen. So the statute was enacted in 2008, and BIPA is a state law that regulates the collection, use, and handling of biometric identifiers and biometric information by private entities. Subject to a couple limited exceptions, BIPA generally prohibits the collection or use of a person’s biometric data without first providing the required notice, obtaining their written consent, and also posting a publicly available retention and destruction schedule.
Jennifer: Thanks very much for that overview. There are two major Illinois Supreme Court rulings from 2023 that govern the BIPA landscape and significantly impacted the way BIPA litigation is playing out. Tyler, you no doubt know which two cases I’m referring to – could you tell our listeners a bit about them?
Tyler: Sure, absolutely. So, these two decisions, which are a little bit old at this point – they were both issued in February of 2023 – had a profound impact on the interpretation of BIPA and the landscape of BIPA litigation. So the first ruling was issued in a case called Tims v. Black Horse Carriers, and in that case the Illinois Supreme Court held that a 5 year statute of Limitations applies to all claims brought under BIPA. So this really adds to the risks that employers and other companies who do business in Illinois face in terms of class action exposure, as the court rejected defendants attempts to argue that a shorter one or two year statute of limitations applies.
The other ruling, issued later in February of 2023, came in a case called Cothron v. White Castle, and in that case the court decided whether each fingerprint or other type of biometric data being scanned is its own discrete violation of the statute. And so, as background, the Seventh Circuit, the federal appellate court, was uncertain how to answer that sort of novel question of state law. And so it kicked it over to the Illinois Supreme Court to ask for clarification, and the court held that BIPA claims accrue not only once upon the initial collection or disclosure of biometric data, but rather each independent time that a company collects or discloses biometric information. And so this ruling, it really exponentially increased the monetary damages in BIPA class actions that a company can face, especially in the employment context – because you generally have a fact pattern where employees are scanning their fingerprints to clock in and out. And so they’re doing that multiple times a day when they start their shifts, when they go on their lunch breaks, and then when they clock in after lunch, and then clock out for the day. And so Cothron basically held that each time they scan their fingerprint is a separate and independent violation. And this could, for just one employee amount to, you know, over 200 work days per year – we’re talking a lot of potential damages.
All of that said, the Illinois Supreme Court acknowledged that it’s ruling on the violation issue and the accrual issue was somewhat Draconian, and so that invited the Illinois legislature to tackle the issue by clarifying that, you know, maybe a violation only occurs upon the first scan of biometric data. The legislature, as it’s you know, customary to do, took its time, drag its feet a little bit, but they did get around to passing a statutory amendment that now clarifies that for purposes of collecting or disclosing biometric data, the violation only occurs the first time that a company scans that type of information. And so both houses of the Illinois legislature have actually approved and passed the amendment. As of today, the governor is waiting to sign the bill, he’s expected to do so. Once Governor Pritzker signs off, that law will take effect, and Cothron will basically be no longer good law on a going forward basis.
Jennifer: Thanks, Tyler, great overview. So the Tims and Cothron rulings really eviscerated two of the key BIPA defenses used by companies over the past several years, however, companies still can use other defenses – such as whether biometric data was actually collected, used, or stored; such as whether and to what extent alleged violations actually occurred in Illinois for purposes of satisfying extra territoriality limitations; as well as the constitutionality of the potentially excessive or crushing damages that could resolve from a finding that each scan was a separate violation; companies can also call upon Rule 23(b)(3) arguments regarding whether a class action really is the appropriate vehicle to litigate a bit of a dispute based on superiority or predominance concerns.
Tyler: Exactly, Jen. You know, those defenses do exist, however, companies really need to be aware of the dangers associated with collecting or storing biometric data without BIPA compliant policies in place. As just one example, very recently the U.S. District Court for the Northern District of Illinois granted class certification to a class action plaintiffs where there are at least 160,000 class members, probably much more. And the case involves Amazon’s “virtual try-on” technology. Basically, it is a virtual technology where a person can upload a photo or video of themselves and then superimpose maybe make up or other fashion products onto their face to see how the product would look, and plaintiffs claim that that technology involves biometric data in the form of scans of face geometry. And in granting class certification in this case, the court dealt Amazon a significant blow in its efforts to block class certification. This decision is really the most recent example of success by the plaintiffs’ bar in a string of victories for class action privacy lawsuits across Illinois, and it illustrates that even the largest and most sophisticated companies can face legal exposure in connection with their biometric collection and retention practices.
Jennifer: We will certainly keep listeners updated on the developments in that case. What about settlement numbers in 2023, in BIPA class actions – what were the monetary totals paid out to plaintiffs?
Tyler: Sure – in BIPA related class actions, 2023 saw robust settlements, but actually a decline when compared to 2022. So if you’re looking at the top 10 BIPA class action settlements in 2023, they totaled $147.86 million, and that is compared to in 2022, $278.9 million.
Jennifer: Well, perhaps a bit of good news then, for employers and companies on the declining settlement value front. Thanks so much for being here again today, Tyler, and thank you so much to our listeners for tuning in.
Tyler: Thanks for having me, Jen, and thanks again to all of our listeners.
Jennifer: See you next week on the Class Action Weekly Wire!