Senator Bill Cunningham (D-IL-18) introduced SB2979 in the Illinois legislature on January 30, 2024, to amend the Illinois Biometric Information Privacy Act (BIPA). If passed, the bill could have a dramatic effect on the hundreds of BIPA class action suits pending in state and federal courts in Illinois and elsewhere. BIPA provides that a plaintiff may obtain statutory damages of $1,000 per violation of the Act and $5,000 per violation for intentional violations of the Act. SB2979 would limit in most cases the statutory damages recoverable under BIPA to a single recovery. For example, if an employer is using a biometric timekeeping system that requires employees to submit finger scans to clock in an out and does not comply with the requirements of BIPA, including obtaining a consent from the employee, under existing law each time an employee submits a finger scan constitutes a separate BIPA violation for which a recovery of the statutory damages of $1,000 is available. If an employee clocks in and out four times a day, this represents $4,000 in statutory damages per day, $20,000 in statutory damages per week and roughly $1,000,000 in statutory damages per year, for each employee. The potential statutory damages could quickly add up to millions of dollars. SB2979 would limit the recovery of statutory damages to a single recovery of $1,000 per employee.

The Illinois Supreme Court in its February 23, 2023, decision in Cothron v. White Castle System, Inc., 2023 IL 128004, 2023 WL 4567389 (2023), held “that a separate BIPA violation occurs each time a private entity scans or transmits an individual’s biometric identifier or information in violation of section 15(b) or 15(d).” Id. at ¶1. However, the Illinois Supreme Court also indicated that the award of statutory damages under BIPA is discretionary rather than mandatory. Id. at ¶42. Recognizing the potential crushing effect of the statutory damages allowed under BIPA, the Court noted “[T]here is no language in the Act suggesting legislative intent to authorize a damages award that would result in the financial destruction of a business”. Id. The Court noted that it believes policy-based concerns about potentially excessive statutory damages awards under BIPA are best addressed by the legislature and stated: “We respectfully suggest that the legislature review these policy concerns and make clear its intent regarding the assessment of damages under the Act”. Id. at ¶43.

SB2979 represents the latest legislative effort to address the potential astronomical statutory damages awards created by BIPA. The complete text of SB2979 may be found at here. The bill amends BIPA to provide that if the biometric information of an individual is collected or disclosed by a private entity in the same manner on more than one occasion, a single violation occurs and not multiple violations. Senator Cunningham stated: “Dozens of legislative proposals to update BIPA have been offered in recent years, but most of those efforts have attempted to remove or narrow privacy protections that have been embedded in the law. SB 2979 does not take that approach. Rather, it puts a common-sense formula in place to determine the amount of financial damages that must be paid for violations of the act.” ¹

Bart Murphy and Isaac Colunga are the co-leaders of Ice Miller’s class action defense practice and defend companies in BIPA class action cases.

^{[1]   See Press Release at: https://www.illinoissenatedemocrats.com/caucus-news/26-senator-bill-cunningham-news/5331-cunningham-legislation-reforms-bipa-while-protecting-businesses-and-employees}

This publication is intended for general information purposes only and does not and is not intended to constitute legal advice. The reader should consult with legal counsel to determine how laws or decisions discussed herein apply to the reader's specific circumstances.