{"id":7920,"date":"2023-10-09T10:24:40","date_gmt":"2023-10-09T15:24:40","guid":{"rendered":"https:\/\/www.bbrown.com\/insight\/biometric-privacy-recent-bipa-case-developments\/"},"modified":"2023-10-09T10:24:40","modified_gmt":"2023-10-09T15:24:40","slug":"biometric-privacy-recent-bipa-case-developments","status":"publish","type":"insight","link":"https:\/\/www.bbrown.com\/ca\/insight\/biometric-privacy-recent-bipa-case-developments\/","title":{"rendered":"Biometric Privacy | Recent BIPA Case Developments"},"content":{"rendered":"

[vc_row row_style=”page-hero” full_width=”stretch_row_content”][vc_column]\n\t

\n\n\t\t
\n\t\t\t
<\/div>\n\t\t\t\t\t\t\t
<\/div>\n\t\t\t\t\t<\/div>\n\n\t\t
\n\t\t\t
\n\t\t\t\t
\n\n\t\t\t\t\t\n
\n

Property & Casualty<\/p>\n

\n Biometric Privacy | Recent BIPA Case Developments\n <\/h1>\n\t\n <\/div>\t\t\t\t\t\n\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/div>\n\n\t<\/div>\n\n\t\n[\/vc_column][\/vc_row][vc_row][vc_column width=”2\/3″]\n
\n \n

\n Biometric Privacy | Recent BIPA Case Developments\n <\/h1>\n\t\n <\/div>[vc_column_text]In our first article, \u201cBiometric Privacy, Risks, Trends and Mitigation\u201d, we discussed current biometric privacy regulation, trends and potential future regulation and the implications for insurance. Read more here: https:\/\/www.bbrown.com\/insight\/biometric-privacy-risks-trends-and-mitigation\/<\/a><\/p>\n

Many organizations are using biometric data, such as fingerprints and retinal scans, as a convenient way to improve security. From touchpads that unlock devices to scanners providing access to places of business, biometric data is a fast, easy and secure way to authenticate individuals and unlock access. The potential for harm lies in the fundamental nature of biometric identifiers. Unlike passwords or tokens, biometric identifiers are unchangeable and cannot be reissued. With courts, state and federal entities pushing the limits of existing biometric privacy regulations, it is crucial for businesses to remain updated on these matters and the changing landscape of compliance risks.<\/p>\n

The precedent in the biometrics space is the Illinois Biometric Information Privacy Act (BIPA), which established important standards for collecting and using biometric information. BIPA sought to address gaps in earlier data privacy regulations by specifically targeting the collection, use and storage of biometric information. One of the most significant, original features of BIPA is its provision for a private right of action without proving actual harm. BIPA imposes significant penalties for violations: up to $1,000 per violation or $5,000 if the activity is intentional or reckless. This has led to a spike in high-profile lawsuits against companies for allegedly violating BIPA\u2019s requirements. Recent decisions on the interpretation of the law have increased exposure for companies utilizing biometric technology.<\/p>\n

Notable Case Law Developments<\/h3>\n

Renderos v. Clearview AI \u2013 BIPA-Like Results Without BIPA<\/h4>\n

In November 2022, the Alameda, California, County Superior Court decided in Renderos v. Clearview AI, that existing privacy and unfair competition laws applied to biometric privacy violations, even without specific biometric privacy legislation. The case centered on Clearview AI\u2019s alleged scraping of facial data from public platforms and subsequent commercialization through facial recognition databases. The case encompassed claims related to misappropriation of likeness, invasion of privacy and unfair competition. The court found that common law privacy rights, the California constitution and the expansive California Unfair Competition Law offered grounds for private right to action akin to those under BIPA.<\/p>\n

Tims v. Black Horse Carriers, Inc. \u2013 Statute of Limitations<\/h4>\n

On February 2, 2023, the Illinois Supreme Court issued its decision on Tims v. Black Horse Carriers, Inc., providing greater clarity on the applicable statute of limitations. Previously, there was debate about whether a one-year or five-year statute of limitations applied to BIPA claims. The court\u2019s ruling established that all violations of BIPA would be subject to a uniform five-year statute of limitations, overturning a previous appellate court decision that had introduced differentiation between various violation types. In the Tims case, the plaintiff alleged multiple infringements of BIPA by their former employer, including the failure to establish a written biometric data retention policy, lack of informed consent and disregard for disclosure prohibitions. The Illinois Supreme Court\u2019s analysis emphasized the need for clarity and consistency for litigants and concluded that the five-year limitation should apply consistently to all BIPA violations. This decision amplifies potential liability for businesses lacking awareness of BIPA\u2019s provisions and underscores the importance of adopting preemptive measures for adherence to the law.<\/p>\n

Cothron v. White Castle System, Inc. \u2013 How Privacy Violations Are Quantified<\/h4>\n

On February 17, 2023, the Illinois Supreme Court ruled that every instance of scanning or transmitting a person\u2019s biometric identifiers constitutes a separate violation of BIPA. In the case of Cothron v. White Castle System, Inc., the plaintiff, an employee at White Castle, alleged that the company had repeatedly required her to scan her fingerprint without proper consent. With a 4-3 majority, the court agreed that each scan was a distinct violation. This decision has significant implications for damages, as BIPA awards $1,000 for each negligent violation and $5,000 for willful violations. With each scan considered a separate violation, potential damages could reach astronomical levels. For instance, White Castle estimated that damages for a 9,000-person class could amount to $17 billion. The court noted that the legislature should address these potential business-threatening penalties, but also acknowledged the courts\u2019 discretion in avoiding excessive damages that could financially destroy a business. Entities using biometric identifiers in Illinois should assess their compliance with BIPA\u2019s requirements.<\/p>\n

Best Practice Recommendations<\/h3>\n

Risk mitigation in the era of biometric data is more critical than ever. Organizations that collect, or are considering collecting, biometric information on employees, customers or others should implement internal controls and human resources procedures. If a company retains vendors, it should have strict controls and take legal responsibility for any breach\u00a0 or non-compliance. Other steps companies should consider as a baseline for reducing risk include:<\/p>\n