UNITED STATES – Companies that operate in Illinois should take notice of the flurry of litigation that has arisen under the Illinois Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1, et seq. The State of Illinois promulgated the BIPA in 2008 amid the public’s growing concerns relating to companies’ collection of biometric data for business and security purposes. The General Assembly cited “finger-scan technologies at grocery stores, gas stations, and school cafeterias” as an example of the biometric data that it intended to regulate. 740 ILCS 14/5(b). Under the BIPA, among other requirements, a company must inform the person whose biometric data is being collected that it is collecting their data and specific details relating to its data collection and preservation. 740 ILCS 14/15(b). Companies must also receive a “written release” from the person before collecting any biometric data. Id.
Significantly, the BIPA provides a private right of action for any person aggrieved by a BIPA violation, and allows a claimant to recover liquidated damages of $1,000 for each negligent violation, and $5,000 for each intentional or reckless violation (or actual damages, whichever is greater). 740 ILCS 14/20. The BIPA also expressly provides that the prevailing party in a BIPA action may recover its reasonable attorneys’ fees and costs. Id.