BIPA Reform on the Horizon: Illinois Legislature Passes Significant Legislation Eliminating Per-Scan Damages

The first—and a significant—amendment to the Illinois Biometric Privacy Act (BIPA) has just passed both chambers of the Illinois legislature and is headed to Governor Pritzker for approval. SB2979 amends BIPA to address the troubling trend of litigants seeking per-scan damages under BIPA, where a handful of enterprising attorneys have, and continue to file, single-plaintiff cases seeking damages on a per-scan basis that exceed six-figures for a single individual.

Imagine on any given day one likely clocks-in and out at least four, if not more, times—and these plaintiffs are seeking either $1,000 or $5,000 each time they did so. The implications if such damages are imposed are clear, yet not unfounded. To the contrary, per-scan damages were green-lit by the Illinois Supreme Court in White Castle, with the caveat that a trial court has the discretion to fashion a damages award so that it does not drive businesses into the ground, which is hardly any respite for businesses facing these lawsuits.

Yet, even in the absence of this disturbing trend, almost all BIPA cases are pled seeking relief on a per-scan basis, and it is a common tactic to drive-up both the costs in discovery and settlement value. Recognizing this alarming strategy, the Illinois legislature appears to have (finally) stepped in to tamp down this often wielded cudgel.

Specifically, SB2979 amends damages as it pertains to two subsections under BIPA concerning: (i) the collection or capture of biometrics identifiers or information, and (ii) prohibiting their disclosure, without consent. Under the proposed amendment, an entity would potentially commit a single violation under each subsection but relief would be limited to “at most, one recovery[.]” The bill provides that the amendment is to take effect immediately upon becoming law.

If the bill is signed and goes into effect, it would provide much needed guidance and be a welcomed development. It would appear that plaintiffs could no longer seek such ruinous damages upon behalf of a single individual (let alone a class of them), and better yet, could not use the threat of them to drive-up costs and settlement. But there are still some open questions that will need to be addressed, likely by the courts. Among them: can this amendment be applied retroactively to businesses already in the throes of litigation? Is there an argument that there can only be one recovery if a scan violates both subsections simultaneously? Certainly there will be debate and argument over these issues and litigants may be incentivized to pursue damages under each separate subsection of BIPA, of which there are five.

Even with this development, the best defense is a good offense and businesses operating in Illinois must be proactive by analyzing whether BIPA applies to your business practices—or could arguably apply such as in the case of recordings made of employees. Companies should take the necessary steps to ensure compliance, in order to stave off these lawsuits all together. While per-scan damages appear to be on the way out, it is a certainty that creative litigants will continue to try to maximize the value of these cases, under BIPA, however they can.