Biometric privacy litigation has seen an uptick in recent years, and the media has often focused on Illinois because of a distinctive state law. See, e.g., Illinois Bar Journal (IBJ), “Illinois’ biometric privacy law back in the news,” Dec. 2017, Vol. 105, No. 12, p. 13. A February 2019 Illinois Supreme Court decision may have expanded the scope of the Illinois Biometric Information Privacy Act (BIPA). See, e.g., Michael Galibois et al., “Illinois Biometric Information Privacy Act violation does not require an allegation of actual harm,” Lexology, Feb. 25, 2019, at https://www.lexology.com/library/detail.aspx?g=cb125c9e-bad5-486c-b6c6-fa49b52509e2 (last visited Feb. 27, 2019). This article examines the BIPA and the recent judicial decision regarding biometric privacy.
According to the Illinois Bar Journal, “[b]iometric data is a measurement or copy of a unique physical characteristic of an individual.” IBJ, supra. Illinois has been central to discussions of biometric data litigation because it is one of the few states that permits private litigants to sue for injuries sustained due to violations of the BIPA. See, e.g., id. Biometric data is distinct in that it is unique to each individual and, unlike passwords or usernames, cannot be altered. See, e.g., IBJ, supra. The unchangeability of biometric information has raised concerns by some critics about privacy and security, particularly in the event such data is improperly collected, or a breach occurs. See id. BIPA became law in 2008, and it “imposes various obligations on private entities that collect, purchase, or otherwise use certain biometric identifiers – specifically, retina scans, iris scans, fingerprints, or voiceprints – or related biometric information…from or about Illinois residents.” Michael Galibois et al., supra.
Another distinguishing characteristic of BIPA is that in addition to statutory damages, the Act also allows injured parties to collect attorney’s fees. See id. Moreover, Illinois’ highest court interpreted the law, so plaintiffs do “not need [to] allege ‘actual harm’ to plead that they have been ‘aggrieved’ as required to state a claim under BIPA.” Id. A number of legal considerations have arisen in light of the court’s holding, and these factors may increase biometric privacy litigation and impact how lawsuits are resolved. See, e.g., id.
The Illinois Supreme Court broadened the meaning of the term “aggrieved” under the statute, and some analysts believe this will lead to more class action lawsuits under BIPA. See id. This belief is based on the court finding that “the General Assembly intended to grant a private right of action to all persons whose legal rights under the statute were violated – all persons ‘aggrieved’ – rather than all persons suffering cognizable monetary or other damages as a result of a violation.” Id. Expert witnesses may help establish whether an individual’s injuries are representative of a particular class under BIPA and would, therefore, make a case eligible for class certification. Experts in privacy, data collection, biometric data, class actions, and other fields may help quantify injuries to assist attorneys and courts in determining when class certification is appropriate.
In addition to the issue of standing and class actions, a group of attorneys observed that, “many interpretative issues regarding BIPA remain unresolved: what the standard of care might be in claims predicated on an organization’s alleged ‘negligence,’ or ‘willfulness,’ what level of disclosure to individuals is sufficient, whether organization practices actually violate the requirements of BIPA, whether implied consent is a valid defense (especially in the employment context), what constitutes ‘possession’ of biometric data, and what is considered ‘biometric information.’” Id. These questions may be addressed by courts in the near future, and experts are essential to answer them. With respect to the sufficiency of disclosure, expert witnesses may speak to what the industry standard is and whether standard practices adequately protect privacy. Because a large percentage of new BIPA lawsuits involve employers, experts in employment law and practices may provide valuable insight. See, e.g., IBJ, supra. Another sizeable portion of BIPA cases pertains to retailers that purportedly “fail to obtain written authorization before collecting” certain biometric data, and experts in the retail industry can help establish the appropriate policies to resolve alleged violations. See, e.g., id.
One law firm emphasized that in light of the latest Illinois Supreme Court decision, “[i]t will be interesting to follow how courts decide these issues in the years to come, and how organizations and their counsel will adapt their litigation and compliance strategies to account for the increasing costs of doing business in Illinois.” Michael Galibois et al., supra. Consulting experts can help companies with ideas about how to best comply with BIPA, and they can assist attorneys in preparing for possible lawsuits. With the latitude and clarity the recent holding has provided, lawyers on both sides may utilize expert witness assistance in to provide definition when legal uncertainties arise.