Illinois’ strict biometric law is tweaked, but some say it falls short

(The Center Square) – Changes to Illinois’ strict Biometric Information Privacy Act, or BIPA, are now on the books.

Gov. J.B. Pritzker signed Senate Bill 2979 into law that will drastically reduce the penalties companies could face for improperly collecting biometric data from workers and consumers. Effective immediately, the change expands the definition of written release to include electronic signatures and would make multiple violations of BIPA a single violation if committed against one individual.

Phil Melin, executive director of Illinois Citizens Against Lawsuit Abuse, said the old law was crippling to businesses.

“You check into work in the morning, that's one, check out for lunch that's two, check back in from lunch that's three, check out from work, that's four, and it’s five-thousand dollars potentially per violation,” said Melin. “That adds up real quickly.”

The changes to the law effectively overturn an Illinois Supreme Court ruling last year that said companies could be held liable for each time they misused a person's private information and not only the first time.

Companies have faced massive verdicts and settlements in BIPA cases. The most notable case was fast food chain White Castle, which scanned fingerprints of nearly 9,500 employees without their written consent. The company said it could cost more than $17 billion if it lost at trial. White Castle earlier this year settled the case for just over $9 million.

“While this bill is not perfect, the 2nd and 3rd generation manufacturers who are being subject to these lawsuits feel a sense of relief that they can keep their doors open and continue producing for our economy,” said Technology and Manufacturing Association lobbyist David Curtin.

Curtin added that even though the new law does not provide retroactivity for cases already decided or pending, lawmakers made sure to put into the legislative record that “a court or a reviewing court could take judicial notice of our amendment to the Act in determining an initial award or reducing an award.”

The health care industry is exempt from BIPA because of the Health Insurance Portability and Accountability Act, also known as HIPAA.

“Health care providers’ use of automated dispensing cabinets to access medications and medical supplies to treat patients is unquestionably health care treatment under HIPAA,” said attorney Bonnie DelGobbo, who represented health care providers during a case in front of the Illinois Supreme Court.