Not too long ago, using fingerprints to pay at vending machines or having a robotic dog felt like something out of The Jetsons. Now, consumers can’t imagine living without the technology that turned science fiction into reality. While most of us live in the digital world, Illinois is stuck in the analog past because of its Biometric Information Privacy Act (BIPA).
BIPA is supposed to make sure businesses properly collect and store biometric identifiers, like fingerprints or facial recognition, but instead, the law has allowed plaintiffs’ lawyers to file hundreds of lawsuits against well-meaning businesses of all sizes. BIPA is highly complex—one small, technical mistake, and a business can find itself on the hook for thousands of dollars in damages per violation. On top of this, the law doesn’t provide a “cure period” for businesses to correct mistakes.
But what makes the law especially problematic is its private right of action (PRA) provision. A PRA allows private lawyers to enforce a law through litigation rather than government agencies. And they can sue a company even if the plaintiffs they represent haven’t actually suffered any injury! ILR Briefly: A Bad Match: Illinois And The Biometric Information Privacy Act spotlights how the law has led to the state becoming a hot bed of privacy litigation.
A Bad Match documents how BIPA-related lawsuits increased in 2016 after the first class-wide settlement was approved for $1.5 million. But the floodgates of litigation opened in 2019 after the Illinois Supreme Court ruled a plaintiff didn’t need to show they suffered actual harm to file a lawsuit. Instead, all they needed to claim was a business violated some aspect of the law.
After that, the number of BIPA lawsuits skyrocketed, with nearly 300 lawsuits filed in 2019 –
almost four times the total in 2018. Moreover, the number is only getting higher: according to a search of court filings, plaintiffs’ lawyers have filed over 900 cases alleging BIPA violations through September 2021.
BIPA’s technical complexity combined with its private right of action provision turned into a lucrative cottage industry for plaintiffs’ lawyers. They routinely pocket significant cuts of settlements or awards won through BIPA lawsuits while consumers miss out on the latest tech gadget or fun app.
As the paper concludes, Illinois should be a lesson in what not to do—giving plaintiffs’ lawyers free rein to sue businesses out of their state–for other states considering enacting biometric laws.
