Securities Attorney for Going Public Transactions

Securities Lawyer Blog

knowledge itself is power

Significant Business-Friendly Changes to Illinois Biometric Information Privacy Act

Introduction: On August 2, 2024, Illinois enacted significant amendments to its Biometric Information Privacy Act (BIPA), a law that has been a source of concern for businesses due to the potential for enormous damages arising from violations. These amendments aim to curb the potential for massive damages and modernize the law's provisions on written consent. However, questions remain about the retroactive application of these changes and how they might impact pending and future litigation.

Reduced Damages Exposure: One of the most impactful changes in the amended BIPA is the limitation of liability to a single violation per individual, regardless of the number of biometric scans, provided that the scans are collected in the same manner. This amendment comes in the wake of the Illinois Supreme Court’s decision in Cothron v. White Castle System, Inc. (February 2023), which held that each individual biometric scan could be treated as a separate violation, potentially leading to devastating financial consequences for businesses. With BIPA providing for liquidated damages of $1,000 or $5,000 per violation, the Cothron ruling had the potential to result in astronomical damages awards. The recent amendments alleviate this risk by clarifying that only one claim accrues per individual, significantly reducing businesses' exposure to liability.

Electronic Consent: The amendments also bring BIPA in line with modern digital practices by expressly recognizing electronic signatures as valid written consent for the collection or sharing of biometric data. This update simplifies compliance for businesses, allowing them to obtain necessary consents electronically, which is increasingly the norm in today’s digital landscape.

Retroactivity Unclear: A key uncertainty surrounding the amendments is whether they will apply retroactively to pending claims or only to violations occurring after the amendments were enacted. The amendments themselves do not explicitly state that they are retroactive, leaving it to the courts to decide how these changes will be applied to cases involving biometric data collected before August 2024. The Cothron decision’s acknowledgment of the discretionary nature of damages awards under BIPA suggests that courts may have some flexibility in moderating damages in ongoing cases. However, until further litigation and judicial precedent clarify this issue, businesses remain at risk for substantial damages awards.

Conclusion: The recent amendments to BIPA represent a positive step for businesses, particularly in reducing the potential for crippling damages awards. However, the question of retroactivity and the ongoing risk of significant damages awards will continue to be a concern until the courts provide further guidance. Businesses operating in Illinois should remain vigilant and continue to ensure strict compliance with BIPA's requirements, particularly concerning consent for biometric data collection and the proper handling of such data.

This blog provides an overview of the recent amendments to Illinois’ BIPA, discussing the implications for businesses and highlighting the uncertainty regarding the retroactive application of the changes.

Gayatri Gupta