Ice Miller’s reporting on SB2979 continues. SB2979 amends the Illinois Biometric Information Privacy Act (BIPA) ¹ to limit the statutory damages allowed under the Act. (Click to see Enrolled Bill). On May 16, 2024, the Illinois House passed SB2979 by a vote of 81-30-0 (Click to see Vote Sheet). With the exception of nine members, all of the Illinois House Republicans voted against SB2979 in an apparent “protest vote,” advocating that the bill did not go far enough in reforming BIPA. The bill was previously passed by the Illinois Senate on April 11, 2024, and now goes to Governor Pritzker for signature. If Governor Pritzker does not sign or veto the bill within 60 days of it being presented to him for signature, the bill automatically becomes law. The bill will be immediately effective upon enactment.

As previously reported, the genesis of the bill was the Illinois Supreme Court’s decision in Cothron v White Castle ² in which the court held that each time a collection or distribution of biometric identifiers or biometric information from an individual occurs in violation of BIPA, it is a separate violation compensable by an award of statutory damages of $1,000. For purposes of illustration, the most common BIPA suit filed is a class action against an employer who uses a biometric timeclock and requires employees to clock in and out using a finger scan. Under the Illinois Supreme Court’s decision in Cothron, assuming an employee clocks in and out four times per day, the statutory damages available would be $4,000 per day, $20,000 per week, and $1 million per year (assuming a 50-week work year). Assuming the biometric timekeeping system was in place for a year and the employer has 50 employees the potential statutory damages available in a class action would be $50 million—enough to destroy all but the largest businesses. SB2979 will bring an end to this in most cases going forward.

In its decision in Cothron, the Illinois Supreme Court also indicated that the award of statutory damages under BIPA was discretionary, but it recognized the potential for excessive damage awards under its ruling and it urged the Illinois legislature to review the statutory damages allowed, stating: “[T]here is no language in the Act suggesting legislative intent to authorize a damages award that would result in the financial destruction of a business.” ³ SB2979 was introduced in response to the court’s suggestion.

In the debate on SB2979 on the House floor, it was made clear that the legislative intent of SB2979 was that the bill was not retroactive and it would not apply to pending BIPA cases. In responding to questions from Rep. Didech (D-59) that were posed to establish the legislative intent of the bill, Rep. Williams (D-11), the House sponsor of the bill, explicitly stated that the bill was not retroactive, but that courts in pending cases could consider the legislature’s intent to limit the statutory damages as provided by the bill in making an award of statutory damages. It appears defendants in pending BIPA cases will only have the ability to argue to the court that under Cothron the amount of statutory damages to be awarded is discretionary and that the court should take into account that the legislature has expressed its intent to limit the statutory damages allowed under BIPA.

Several House Members rose to speak to the bill, arguing that it does not go far enough in reforming BIPA. Rep. Keicher (R-70), the Republican conference chairperson, asked whether the bill would be retroactive and whether it would address claims against trucking companies that use “drive-cams” to warn truck drivers of risky and distracted driving behaviors to avoid accidents. There have been a number of BIPA class actions filed against trucking companies alleging that drive-cams are collecting facial scans of drivers and thereby collecting their biometric information in violation of BIPA. Rep. Williams responded that this bill was not retroactive and it was not intended to address the BIPA drive cam cases. Rep. Ugaste (R-65), the Republican spokesperson of the House Judiciary-Civil Committee, which voted the bill to the House floor, noted that Illinois is losing data center projects due to BIPA as data centers are concerned about unknowingly storing biometric information that could subject them to liability under BIPA. He lamented that while the bill’s purpose is admirable, he was going to vote against it as it did not go far enough and that more should be done to reign in BIPA.

Other bills introduced in this legislative session would have provided further BIPA reform but never got out of committee. For example, HB4686 was introduced on February 1, 2024, by Rep. Tim Ozinga (R-37). See HB4686 here. HB4686 would amend BIPA, to among other things, shorten the statute of limitations from the current five years to one year. It would also require that, before filing a lawsuit for a BIPA violation, the aggrieved person would be required to provide the entity that allegedly acted in violation of BIPA with notice of the violation and to allow the violator 30 days to cure the violation and if the violation is cured no action may be filed. The bill also eliminates statutory damages for negligent violations of BIPA and would only allow actual damages. HB4686 never made it out of the House Judiciary Committee and for all intents and purposes it is dead for this legislative session.

While many businesses, business groups, and legislators feel that the legislature should have enacted further BIPA reforms, SB2979 provides at least some reform. For example, under current law, an employee who clocks in and out on a biometric time clock for a year, where the employer did not comply with BIPA, could obtain a million dollar statutory damages award. SB2979 now limits that employee to a single award of $1,000. Also, SB2979 may curb plaintiff’s attorneys from filing individual BIPA actions. Most BIPA cases are filed as class actions. However, some enterprising plaintiff’s attorneys have been filing individual actions knowing that under Cothron each time their client clocked in or out is a separate BIPA violation worth a potential $1,000. These attorneys are avoiding the “hassle” of filing a class action and are apparently content to reap the rewards of their client clocking in an out four times each day to the tune of $4,000 per day. It also appears some attorneys are picking off class members in pending class actions, having them opt out of the class and then filing an individual BIPA action on behalf of their client. SB2927 will likely bring an end to these individual actions, but since BIPA does allow for attorney’s fees to the prevailing party, some incentive to file an individual action may still exist.

While SB2979 did not provide the giant step forward in BIPA reform that many business groups, businesses, and legislators wanted, it does provide one small step in reigning in the potential annihilating damages faced by a BIPA defendant.

Bart Murphy is a Litigation partner in the Chicago office of Ice Miller LLP, where he defends companies in class action litigation including BIPA, GIPA, TCPA, and other consumer class actions.

[1] 740 ILCS 14/1 et seq.
[2] Cothron v. White Castle System, Inc., 2013 IL 128004 (2023).
[3] Id. at ¶42

This publication is intended for general information purposes only and does not and is not intended to constitute legal advice. The reader should consult with legal counsel to determine how laws or decisions discussed herein apply to the reader's specific circumstances.