While considering the often-quoted words of Yoggi Berra—it ain’t over ‘til it’s over—the Illinois General Assembly has taken the first step to curtail the potential annihilating statutory damages allowed under the Illinois Biometric Information Privacy Act (BIPA). ¹ SB2979 would amend BIPA to provide that a plaintiff typically would only be allowed to recover once for a BIPA violation and not each time the plaintiff’s biometric information is collected or disclosed in violation of BIPA.

BIPA currently allows statutory damages of $1,000 for a negligent violation of the act or $5,000 for an intentional or reckless violation of the act. ² The Illinois Supreme Court recently held that a plaintiff is entitled to recover the statutory damages allowed for each violation of BIPA. ³ This means, for example, that each time an employee’s finger scan is unknowingly collected in violation of BIPA by a biometric timeclock when clocking in or out of work is a separate violation. If an employee clocks in and out four times per day, the potential statutory damages are $4,000 per day, $20,000 per week, and $1 million per year, per employee. In the context of a class action, the potential statutory damages are multiplied by the number of employees and become even more annihilating.

In the same decision in which it held that each collection or disclosure of an individual’s biometric information or identifiers in violation of BIPA creates a separate award of statutory damages, the Illinois Supreme Court commented that there is nothing in the language of BIPA suggesting the legislature intended to authorize a damages award for a BIPA violation that would result in the “financial destruction of a business” and urged the legislature to review the policy concerns regarding the award of statutory damages under BIPA. ⁴ The Illinois legislature responded to the Illinois Supreme Court’s suggestion and, on January 31, 2024, Sen. Bill Cunningham (D-18) introduced SB2927. See SB2927 here.

SB2979 would amend Section 20 of BIPA to provide that a private entity that collects or otherwise obtains the same biometric information or identifier in violation of BIPA from the same person using the same manner of collection is only liable for a single violation of BIPA, and the individual whose biometric information or identifier was obtained in violation of BIPA would only be entitled to a single recovery of statutory damages. The bill also extends the same limitation on recovery of statutory damages for disclosures of biometric identifiers. This means that in the example cited above, the employee would not get $4,000 per day, $20,000 per week, and $1 million per year, and instead would receive $1,000.

The plaintiff class action bar has filed thousands of BIPA class actions since BIPA was enacted in 2008. The pace of filings increased dramatically after the Illinois Supreme Court issued its decision in 2023 holding that a plaintiff can recover statutory damages for each violation of BIPA. Because of this, we are seeing putative class members in BIPA class actions that have settled, or are in the process of settling, “picked off” by other plaintiff’s counsel who have the class member opt out of the class and then file their own individual BIPA action. SB2927 would stop this practice and it would dampen the plaintiff class action bar’s enthusiasm towards BIPA class actions.

To illustrate the effect SB2927 would have on BIPA litigation, assume the following hypothetical facts: A company has 100 employees who it requires to use a biometric time clock to clock in and out of work using a finger scan, which has been found to be a collection of biometric information. Employees are required to clock in and out four times per day—at the start of the day, for lunch, upon returning from lunch, and at the end of the day. The vendor that sold the company the biometric timekeeping system never told the company about BIPA and the company has no inhouse counsel and was not aware of BIPA. The company never obtained consents from the employees to collect their biometric identifiers and has been using the biometric timeclock system for a year. The company fires an employee who then goes to an employment lawyer, as he feels he was wrongfully terminated. The employment lawyer asks the former employee if the company used biometric timekeeping and the former employee tells his lawyer the company did. The employment lawyer then refers the case to a plaintiff class action lawyer who files a class action lawsuit against the company for violating BIPA and seeks the statutory damages of $1,000 for each time the former employee and the class members scanned their fingers to clock in and out of work.

Under the current version of BIPA, the potential statutory damages recoverable under the hypothetical class action filed against the company would be astronomical—$100 million. Each employee would claim statutory damages of $4,000 per day, $20,000 per week, and $1 million per year (assuming a 50-week work year). Since the system was in use for a year, that means that each employee/class member can claim $1 million in statutory damages. The total statutory damages for the class of 100 employees would be $100 million with a potential attorney’s fee award of $33 million. If SB2927 is enacted, the potential statutory damages recoverable in the class action would drop from $100 million to $100,000—$1,000 for each of the 100 employees, with a potential attorney’s fee award of $33,000. BIPA does allow for the recovery of attorney’s fees, so it is likely that plaintiff’s counsel would eschew the common fund approach to fee awards and instead seek a fee award based on actual time plus a lodestar.

Unlike other bills that were introduced in the current and prior legislative sessions to reform BIPA and were left to die on the vine, never making it out of Committee, SB2979 gained traction as a “compromise bill” and was passed by the Illinois Senate on April 11, 2024, by a vote of 46-13-0. For example, HB4686 was introduced in the Illinois House this session on February 1, 2024, by Rep. Tim Ozinga (R-37). See HB4686 here. HB4686 would amend BIPA, to among other things, shorten the statute of limitations for a BIPA claim from the current five years to one year. It would also require that, before filing a lawsuit for a BIPA violation, the aggrieved person would be required to provide the entity that allegedly acted in violation of BIPA with notice of the violation and allow the violator 30 days to cure the violation—if the violation is cured no action may be filed. The bill also eliminates statutory damages for negligent violations of BIPA and would only allow actual damages. HB4686 never made it out of the House Judiciary Committee and for all intents and purposes is dead for this legislative session. Provisions of HB4686 could be added as amendments by the House to SB2927.

While SB2927 is seen as a pro-business bill reforming BIPA, many business groups are not happy with the bill and feel it does not go far enough. There were 29 witness slips submitted to the Illinois Senate Judiciary Committee in opposition to SB2927, including submissions by pro-business organizations such as the Illinois Chamber of Commerce, Illinois Manufacturers’ Association, Illinois Retail Merchants Association, Illinois Hotel & Lodging Association, Illinois Trucking Association, Chicagoland Chamber of Commerce, Illinois Railroad Association, and the Security Industry Association. These organizations want to see further reform of BIPA.

Capitol Fax ⁵ reported that Illinois Senate President Harmon spoke at the Illinois Chamber of Commerce’s annual lobby day on April 10, 2024 (the day before SB2927 was brought to the Senate floor for a vote), and was asked about making amendments to SB2927 to further protect businesses. He is reported to have stated that SB2927 addresses the annihilative liability issue created by the statutory damages, but that he did not see “an appetite for additional amendments.” Capitol Fax also quotes President Harmon as stating that he was “a bit disappointed” at the opposition to SB2927 from business groups.

We are delivering a huge win for Illinois businesses. It's [SB2927] not everything they want, but if you listen to my speech, progress is good. Nobody gets everything that they want. … I also recognize that many bills are awful and horrible and the end of the world until they pass, when they're suddenly really good. And I hope that the business community will recognize the importance of this reform when it passes.

SB2927 now goes to the Illinois House where the legislative “sausage-making process” will continue. The House could pass SB2927 as is or amend it and send it back to the Senate for approval of the House amendments. The legislative process will most likely end when the Illinois legislature adjourns in the end of May 2024. If passed by the Legislature and signed by the Governor, the bill would be effective upon enactment. It appears SB2927 is likely to pass either as is or with minor amendments, and it is assumed the Governor will sign it and that businesses will obtain some relief. But remember—it ain’t over till it’s over.

Bart Murphy is a Litigation partner in the Chicago office of Ice Miller LLP, where he defends companies in class action litigation including BIPA, GIPA, TCPA, and other consumer class actions. 

^{[1] 740 ILCS 14/1 et seq.
[2] 740 ILCS 14/20
[3] Cothron v. White Castle System, Inc., 2013 IL 128004 (2023). 
[4] Cothron, 2013 IL 128004 at ¶¶42-43. 
[5] Capitol Fax is a newsletter that covers the Illinois legislature and Illinois politics.}

This publication is intended for general information purposes only and does not and is not intended to constitute legal advice. The reader should consult with legal counsel to determine how laws or decisions discussed herein apply to the reader's specific circumstances.