Biometric Data & Privacy Litigation

Biometric technology is becoming more accessible, cost-efficient, and effective. The use of digital identification could eventually replace the traditional identification card, personal identification numbers, and passwords. Biometric technology is a more convenient method to verify identification, control access, and monitor activity for businesses and employers.

However, like any emerging technology, there are significant risks with implementing biometrics. Laws and regulations are being implemented to protect consumers’ biometric data from being used to their detriment. There is also significant privacy concerns where biometric data is permanent and, if compromised, could result in liability.

In 2008, Illinois enacted the Biometric Information Privacy Act (“BIPA”) to regulate the collection, use, handling, safeguarding, storage, and retention of biometric identifiers and information. Biometric identifiers and information includes fingerprint and retina scans, as well as facial geometry scans, which could include photographs used to identify individuals.  The Act contains requirements that private entities receive written consent prior to the collection of biometric data, and maintain a publicly available written policy and schedule for the destruction of the data. The Act also includes requirements for private entities that simply possess or retransmit biometric identifiers or information. In early 2019, the Illinois Supreme Court removed barriers for plaintiffs to recover for BIPA violations, resulting in an increasing number of class action lawsuits against private entities that collect, maintain, or transmit biometric identifiers and information. The statute entitles prevailing parties to statutory damages of as much as $5,000 per violation with no aggregate limit on damages. As a result, class actions pose a substantial threat to companies and organizations that have not remained in compliance with the BIPA’s requirements.

Following the lead of Illinois with the BIPA, other states are implementing laws that establish requirements and restrictions on businesses as to the use, collection, and maintenance of biometric identifiers and biometric information. Failing to comply with these laws could lead to fines, penalties, and litigation. As organizations use, collect, and maintain biometric information, they need to become aware of their various obligations.

Freeborn has a team of litigators who are focused on protecting clients as they implement this emerging technology. Cases arising out of the Illinois BIPA generally involve defending class actions, but also include investigating and pursuing indemnity claims against third party biometric technology providers. Freeborn’s litigators have extensive experience representing businesses and employers in each type of action.

Additionally, whether through drafting statutory compliant policies, implementing necessary procedures, or advising on risk allocation and insurance, Freeborn’s transactional attorneys are on the cutting-edge and ready to help mitigate exposure.

With the widespread adoption of biometric technology, businesses need to be on high alert for potential legal ramifications. From initial implementation of the technology all the way to ensuing litigation, Freeborn attorneys are equipped to help any type of business and employer with legal issues associated with biometrics in our increasingly digital world.