Recently, the Illinois Supreme Court considered the consequences of violating the Biometric Information Privacy Act (“Act”). The Act has been on the books for ten years, and during that time, the use of biometric data, such as finger prints, voice prints, or facial recognition, has grown by leaps and bounds. It is possible to unlock an iPhone merely by looking at it—using facial geometry.
As health care facilities move to biometric methods of identifying staff or clients, they will need to consider the ramifications of doing so. The Act requires entities that collect biometric data to first obtain informed consent, in writing, by the individual or their representative. In addition, the entity must have a policy and procedure for destroying the biometric data in accordance with the Act.
According to the Supreme Court, failure to abide by these procedures causes damage to the person whose biometric data was gathered. As a result, the entity can face liability in the amount of $1,000 to $5,000 per violation, or actual damages, plus attorneys’ fees. Considering the real risk of identity theft in this digital age, actual damages could easily exceed the statutory amounts.