{"id":1684,"date":"2024-08-05T20:51:46","date_gmt":"2024-08-06T00:51:46","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=1684"},"modified":"2024-08-05T20:51:46","modified_gmt":"2024-08-06T00:51:46","slug":"illinois-corrects-the-bipas-cataclysmic-jobs-killing-damages-regime-in-new-reform-legislation","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2024\/08\/05\/illinois-corrects-the-bipas-cataclysmic-jobs-killing-damages-regime-in-new-reform-legislation\/","title":{"rendered":"Illinois Corrects The BIPA\u2019s \u201cCataclysmic, Jobs-Killing Damages\u201d Regime In New Reform Legislation"},"content":{"rendered":"

\"\"<\/a>By Gerald L. Maatman, Jr., Ryan T. Garippo, and George J. Schaller<\/strong><\/p>\n

Duane Morris Takeaways:<\/em><\/strong>\u00a0 On August 2, 2024, Illinois Governor J.B. Pritzker signed Senate Bill 2979, which amends the draconian penalties under Sections 15(b) and 15(d) of the Illinois Biometric Information Privacy Act (the \u201cBIPA\u201d).\u00a0 Senate Bill 2979 and its reformed language can be accessed here<\/a>.\u00a0 For Companies caught in the BIPA\u2019s crosshairs, this reform ushers in a welcome reprieve to the former statute\u2019s harsh regime of penalties.<\/em><\/p>\n

Background On The BIPA\u2019s Former Construction<\/strong><\/p>\n

The BIPA statute codifies restrictions against companies that collect biometric information and identifiers.\u00a0 See<\/em> 740 ILCS 14\/1.\u00a0 The rationale for this legislation was that \u201c[b]iometrics are unlike other unique identifiers that are used to access finances or other sensitive information\u201d and as such, \u201c[t]he full ramifications of biometric technology are not fully known.\u201d\u00a0 Id.<\/em> \u00a7 14\/5(c)-(f).\u00a0 Consequently, the BIPA prohibited companies from \u201ccollect[ing], captur[ing], purchas[ing], receiv[ing]\u201d or \u201cdisclos[ing], redisclos[ing], or otherwise disseminat[ing]\u201d an individual\u2019s biometric data.\u00a0 Id.<\/em> \u00a7 14\/15(b)-(d).\u00a0 The BIPA further imposed statutory damages in the amount of $1,000 for each negligent violation of the statute, and $5,000 for each intentional violation.\u00a0 Id.<\/em> \u00a7 14\/20.<\/p>\n

As a result, what constituted a single \u201cviolation\u201d of the BIPA had significant consequences for companies.\u00a0 If violations occurred on a \u201cper person\u201d basis, the highest amount of damages that a company could owe an individual was $1,000 or $5,000 respectively.\u00a0 However, if violations occurred on a \u201cper scan\u201d or \u201cper incident\u201d basis, companies would owe damages for each time that they collected or disseminated that data.\u00a0 Under the latter, companies could be required to sometimes pay \u201cclass-wide damages [that] . . . exceed $17 billion\u201d dollars.\u00a0 Cothron v. White Castle System, Inc<\/em>., 2023 IL 128004, \u00b6 76 (Feb 17, 2023) (Overstreet, J., dissenting).\u00a0 Despite the legislature\u2019s concerns with collecting biometric information, many companies argued that this outcome cannot be what the Illinois General Assembly intended.<\/p>\n

Regardless, on February 17, 2023, the Illinois Supreme Court issued a landmark decision on this statutory question.\u00a0 The Supreme Court held that \u201cthe plain language of section 15(b) and 15(d) demonstrates that such violations occur with every scan or transmission.\u201d\u00a0 Id<\/em>. at \u00b6 31.\u00a0 However, the opinion was not unanimous.\u00a0 Justice Overstreet objected to this interpretation of the statute and criticized the majority for adopting an interpretation that caused \u201cIllinois businesses to be subject to cataclysmic, jobs-killing damages, potentially up to billions of dollars, for violations of the Act.\u201d\u00a0 Id<\/em>. at \u00b6 73 (Overstreet, J., dissenting).\u00a0 But Justice Overstreets\u2019 dissents were only dissents, and his interpretation of the law was not adopted.<\/p>\n

Legislative Revisions To The BIPA Under SB 2979<\/strong><\/p>\n

On August 2, 2024, and over a year later, Governor Pritzker and the Illinois General Assembly vindicated Justice Overstreet\u2019s dissents. They explained that \u201cit does not withstand reason to believe the legislature intended this absurd result.\u201d\u00a0 Id.\u00a0 <\/em>SB 2979 makes two major corrections to the BIPA\u2019s draconian reach.\u00a0 First, the reform removes \u201cper scan\u201d violations from the statute.\u00a0 Now, damages under Sections 15(b) and 15(d) of the BIPA accrue on a \u201cper person\u201d basis.\u00a0 Specifically, the statute now states:<\/p>\n

(b) For purposes of subsection (b) of Section 15, a private entity that, in more than one instance, collects, captures, purchases, receives through trade, or otherwise obtains the same biometric identifier or biometric information from the same person using the same method of collection in violation of subsection (b) of Section 15 has committed a single violation<\/em><\/strong> of subsection (b) of Section 15 for which the aggrieved person is entitled to, at most, one recovery under this Section<\/em><\/strong>.<\/p>\n

(c) For purposes of subsection (d) of Section 15, a private entity that, in more than one instance, discloses, rediscloses, or otherwise disseminates the same biometric identifier or biometric information from the same person to the same recipient using the same method of collection in violation of subsection (d) of Section 15 has committed a single violation<\/em><\/strong> of subsection (d) of Section 15 for which the aggrieved person is entitled to, at most, one recovery under this Section<\/em><\/strong> regardless of the number of times the private entity disclosed, redisclosed, or otherwise disseminated the same biometric identifier or biometric information of the same person to the same recipient.<\/p>\n

740 ILCS 14\/20 (b)-(c) (emphasis added).<\/p>\n

Second, the statute now also allows for companies to obtain a \u201celectronic signature\u201d in order to secure a release from BIPA liability.\u00a0 740 ILCS 14\/10.<\/p>\n

Impact Of SB 2979 On Class Action Litigation Under The BIPA<\/strong><\/p>\n

The importance of this reform cannot be understated.\u00a0 For example, before SB 2979, at a company like the one in Cothron<\/em>, where each employee \u201cscans his finger (or hand, face, retina, etc.) on a timeclock four times per day \u2014 once at the beginning and end of each day and again to clock in and clock out for one meal break \u2014 over the course of a year,\u201d that company would have collected a single employee\u2019s \u201cbiometric identifiers or information more than 1000 times.\u201d\u00a0 Cothron<\/em>, 2023 IL 128004, \u00b6 78 (Overstreet, J., dissenting).\u00a0 Over the course of five years, that same employee may have scanned over 5,000 times.\u00a0 Tims v. Black Horse Carriers, Inc.,<\/em> 2023 IL 127801, \u00b6 32 (Feb. 2, 2023) (holding 5-year statute of limitations applies for violations of the BIPA).<\/p>\n

Under those circumstances, at a rate of $1,000 per violation, a company may owe $5,000,000 to that employee alone.\u00a0 And, at a rate of $5,000 per violation, a company may owe $25,000,000 to that employee.\u00a0 After SB 2979\u2019s passing, this exact same company would only owe $1,000 or $5,000 to each employee respectively.\u00a0 A such, this reform ushers in a new era of damages limits surrounding BIPA litigation, and peace of mind to corporate counsel charged with defending their companies from such massive liability.<\/p>\n

Implications for Employers<\/strong><\/p>\n

As to companies currently engaged in BIPA litigation, there is reason to believe that such legislation may not be viewed as retroactive.\u00a0 However, even if this legislation is not retroactive, damages under the BIPA are discretionary and are not required to be imposed.\u00a0 See, e.g., Rogers v. BNSF Railway Company<\/em>, 680 F. Supp. 3d 1027, 1041-42 (N.D. Ill. 2023).\u00a0 Companies can expect the retroactive-effect of SB 2979, or lack thereof, to be the next battleground for BIPA litigation.<\/p>\n

Consequently, SB 2979 now places companies in the best position possible to avoid \u201cthis job-destroying liability\u201d until the remaining BIPA cases work themselves through the judicial system.\u00a0 Cothron<\/em>, 2023 IL 128004, \u00b6 86 (Overstreet, J., dissenting).\u00a0 As those cases progress, companies should revisit to ensure continued compliance with the BIPA and monitor SB 2979\u2019s impact in on-going BIPA cases.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr., Ryan T. Garippo, and George J. Schaller Duane Morris Takeaways:\u00a0 On August 2, 2024, Illinois Governor J.B. Pritzker signed Senate Bill 2979, which amends the draconian penalties under Sections 15(b) and 15(d) of the Illinois Biometric Information Privacy Act (the \u201cBIPA\u201d).\u00a0 Senate Bill 2979 and its reformed language can be … <\/p>\n

Continue reading “Illinois Corrects The BIPA\u2019s \u201cCataclysmic, Jobs-Killing Damages\u201d Regime In New Reform Legislation”<\/span><\/a><\/p>\n","protected":false},"author":583,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[125],"tags":[],"ppma_author":[30],"class_list":["post-1684","post","type-post","status-publish","format-standard","hentry","category-bipa"],"authors":[{"term_id":30,"user_id":583,"is_guest":0,"slug":"classactiondefense","display_name":"Class Action Defense","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2020\/10\/dmlogo.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/1684","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/583"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=1684"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/1684\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=1684"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=1684"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=1684"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=1684"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}