No-injury Lawsuits
BIPA
Abuse under the state’s Biometric Information Privacy Act hit a fever pitch in 2023 following landmark liability-expanding rulings by the Illinois Supreme Court. Illinois lawmakers enacted the Biometric Information Privacy Act (BIPA) in 2008, but it lied dormant until 2015 when plaintiffs’ lawyers discovered its business potential. BIPA provides a private right of action to a person whose fingerprint, voiceprint, hand or facial scan, or similar information is collected, used, sold, disseminated, or stored in a manner that does not meet the law’s requirements.
BIPA requires companies to inform an individual in writing and receive a written release prior to obtaining or retaining his or her biometric data. If a company fails to follow this procedure or meet other requirements, then any “aggrieved” person can seek the greater of $1,000 or actual damages for each negligent violation, and the greater of $5,000 or actual damages for each violation they allege was recklessly or intentionally committed.
As detailed in the 2023 Judicial Hellholes® report, the Illinois Supreme Court issued two rulings that led to a dramatic increase in BIPA filings. First, the Court ruled that BIPA lawsuits are subject to the state’s “catch-all” statute of limitations, which provides five years to file claims with no defined period, as opposed to the state’s one-year default statute of limitations for privacy actions. The high court agreed with the Cook County Circuit Court, which had held that the five-year period applied. This facilitated substantially larger class actions.
Just a few weeks later, the Illinois Supreme Court issued another ruling that expanded liability for businesses under BIPA. In Cothron v. White Castle, the Court ruled that a BIPA claim accrues each time a business scans a person’s biometric information and each time it is transmitted to a third party, not only upon the first scan and first transmission.
In the two months following the White Castle decision, BIPA lawsuit filings jumped 65%. The lawsuits are brought primarily by small- and medium-sized law firms, with a sizable portion brought by Chicago- based firm Justicia Laboral LLC.
Companies targeted by BIPA litigation range from large national companies like Flowers.com and Krispy Kreme to local Chicago small businesses. This litigation has proven lucrative for these firms. In one case, plaintiffs’ lawyers received a nearly $100 million payday while their clients each received just over $400.
The Legislature Responds
During the 2024 legislative session, the legislature enacted a bill in direct response to the White Castle ruling. S.B. 2979, signed by Governor J.B. Pritzker in August, limits the number of violations occur- ring to a single instance, regardless of how many times a business scans or transmits a person’s biometric information.
S.B. 2979 marks a good first step towards addressing the series of abuses occurring under BIPA. However, concerns remain as “[e]ven at one statutory recovery per plaintiff, the liability implications for the statute are huge and outsized to any actual harm or injury in almost all conceivable situations,” said Matt Provance of Mayer Brown LLP. Just look at the $228 million judgment against BNSF in 2022 (which later settled for a mere $75 million). While it amounted to only one recovery per worker, more than 44,000 drivers included in the class were to receive $5.000 in damages.
Some recent BIPA litigation activity in Cook County include:
- March 2024: A class action against Target accusing their surveillance systems of violating BIPA by collecting biometric data such as face recognition without the consent of the
- July 2024: $2.4 million settlement with Crate & Barrel and its employees. The case involved an alleged BIPA violation stemming from the company’s collection of fingerprint/hand/palm data from employees as they clocked in and out of work between July 2013 and March 2024 without written consent. As a result of the settlement, each of the 1,796 class members will receive a payment of about $860. Meanwhile, the attorneys raked in about $847,000 — about 35% of the total award.
Healthcare BIPA Exception
In late 2023, the Illinois Supreme Court ruled that healthcare providers are exempt from BIPA liability based on a plain language reading of the Act. Section 10 of the Act provides that “biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996.”
Heathcare providers argued that the “or” before information establishes an entire category of information that is not limited to patients. Under this category, they argued that collection, use, and storage of their workers’ information is related to the treatment of their patients. The Illinois Supreme Court agreed and overturned a lower court decision that found otherwise.
An intermediate appellate court almost immediately restricted the application of this sound ruling. In August 2024, the First District Appellate Court upheld a Cook County Circuit Court decision and ruled that the patient-in-healthcare-setting exception to BIPA does not apply to an “online try-on” tool for nonprescription glasses. This ruling came about in a case in which a business sells nonprescription glasses online, with a feature allowing potential customers to use their facial geometry to try glasses on virtually before they make a purchase. The lawsuit alleges that collection of that facial geometry without “written, informed consent” violated BIPA.
The appellate court rejected the defendant’s argument that the healthcare-setting exception to BIPA applied. “We cannot agree that a person providing their biometric identifiers to obtain any of those products becomes a ‘patient in a healthcare setting’ under the Act and therefore falls outside of the Act’s protections,” the appellate court said.
GIPA
As we wait to see the impact of the BIPA legislative reform, the next wave of class action abuse has already arrived. The Illinois’ Genetic Information Privacy Act (GIPA), enacted in 1998, addresses the disclosure and use of an individual’s genetic information. It restricts employers from requiring genetic testing as a condition of employment and states that the results of genetic testing cannot be used to affect the terms of employment. Given their immense success under BIPA, plaintiffs’ lawyers will attempt to exploit GIPA’s broad definition of “genetic information” and the availability of substantial statutory damages.
Seyfarth Shaw LLP reports that over 60 GIPA suits were filed in 2023, and before then only 2 cases were filed under GIPA in the previous 25 years. The statute provides damages between $2,500 and $15,000 for each violation, depending on if the violation is deemed negligent or willful, respectively.