BIPA INSURANCE ALERT
BIPA Statutory Overview and Insurance Availability
The Illinois Biometric Information Privacy Act (“BIPA”) presents substantial potential liability to any company doing business in the state. It provides for draconian damages for the use of biometric information that is commonplace in other states.
In 2008, Illinois became the first state to enact a biometric privacy law that restricts a private company’s ability to collect, store, or transmit employees’ biometric information. “Biometric information” protected under BIPA includes facial-recognition technology, fingerprint scans, iris and retina scans, palm-print readings, and voiceprints. 740 ILCS 14/10.
In short, if a company requires employees to clock into work via a fingerprint scan or retina scan (for example), that company is required to comply with BIPA’s requirements. Failure to obtain its employees’ consent, establish a written policy regarding the handling of biometric data, and take reasonable care in securing that data gives rise to the potential for a class action BIPA claim in which the potential liability is considerable.
A BIPA violation occurs every time an employee clocks in or out using his/her biometrics, and BIPA allows private individuals to recover liquidated damages of $1,000 for each negligent violation and $5,000 for each reckless or intentional violation. Cothron v. White Castle Sys., Inc., 2023 IL 128004 (Il. Sup. Ct. 2023).
The Illinois legislature recently amended BIPA to limit the recovery to a “per-person” rather than a “per-scan” basis, significantly reducing the exposure for companies facing BIPA claims. However, this amendment is not retroactive, meaning that past violations prior to August 2, 2024, are still subject to the draconian per-scan damages.
Fortunately, insurance coverage is often available for BIPA claims. In West Bend Mutual Ins. Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978 (Il. Sup. Ct. 2021), the Illinois Supreme Court held that BIPA suits triggered the personal and advertising injury coverage of a commercial general liability policy. While some policies may contain exclusions that bar coverage for BIPA claims, such as the “Access or Disclosure” exclusion or a specific “Biometrics” exclusion, many do not.