Governor Pritzker Signs BIPA Amendment into Law, Providing Relief for Private Entities Against Damage Collection

On August 2nd, Governor J.B. Pritzker signed Senate Bill 2979 into law, amending the Illinois Biometric Information Privacy Act (“BIPA”?or the “Act”) for the first time in 16 years. The Act, which was one of the first of its kind in the nation, regulated the collection and use of biometric information and assigned liability to private entities that violate the Act’s extensive compliance requirements.?The Act touched?off waves of litigation, resulting in nearly 2,000 lawsuits and billions of dollars in settlements paid by companies.?

Section 15(b) of BIPA?imposes various requirements on private entities in possession of biometric data including a need to inform the individual, obtain a signed release, and refrain from sale or disclosure of that information unless otherwise authorized by signed release. Section 20 grants rights of action by aggrieved individuals to seek penalties of $1000 per violation, or $5,000 per reckless violation.?

The Amendment was practically passed in direct response to the Illinois Supreme Court’s decision in?Cothron v. White Castle System,?Inc.,?2023 IL 12800. There, the Court ruled that the?sections combined imply that a private entity may accrue liability for?each and every?occurrence of a misuse of biometric information. This meant that “every scan or transmission” of biometric information could incur damages per Section 20. The Court recognized the litigious implications of this, and even used their opinion to suggest the legislature review the Act.?

The Legislature heeded the call, passing Senate Bill 2979,?which primarily amended the Act in two places. It added clarifying language to Section 20 regarding damages:

• (b) For purposes of subsection (b) of Section 15, a private entity that, in more than one instance, collects, captures, purchases, receives through trade, or otherwise obtains the same biometric identifier or biometric information from the same person using the same method of collection in violation of subsection (b) of Section 15 has committed a single violation of subsection (b) of Section 15 for which the aggrieved person is entitled to, at most, one recovery under this Section.
• (c) For purposes of subsection (d) of Section 15, a private entity that, in more than one instance, discloses, rediscloses, or otherwise disseminates the same biometric identifier or biometric information from the same person to the same recipient using the same method of collection in violation of subsection (d) of Section 15 has committed a single violation of subsection (d) of Section 15 for which the aggrieved person is entitled to, at most, one recovery under this Section regardless of the number of times the private entity disclosed, redisclosed, or otherwise disseminated the same biometric identifier or biometric information of the same person to the same recipient.

This new language characterizing repeated use of biometric information in violation of the Act as a singular comprehensive violation, subject to one single award of damages, is expected to greatly reduce damage collections for private entities and reduce the incentive for litigation.?

The Amendment also added “electronic signature” as a form of written release under Section 15, but this addition is not expected to significantly affect obligations on the part of private entities.?

For more information on BIPA compliance and liability, contact the qualified attorneys at Rock, Fusco & Connelly, LLC.?