BIPA

At the heart of the digital age, privacy is becoming more and more elusive. The ubiquity of smart devices and online services has made it easier for companies to collect and store vast amounts of personal data. Among this data is biometric information, which includes retina or iris scans, fingerprints, voiceprints, hand scans, facial geometry, DNA, and other unique biological information. While biometric data can be a useful tool for identification and authentication, it can also pose a significant risk to personal privacy.

The Illinois legislature unanimously passed the Biometric Information Privacy Act (BIPA) in 2008 to address these concerns. The initiative was led by the American Civil Liberties Union (ACLU) of Illinois and aimed to give individuals control over their biometric data.

What is BIPA?

BIPA establishes standards for how companies must handle Illinois consumers’ biometric information. The law prohibits any company from selling or otherwise profiting from consumers’ biometric information. BIPA continues to stand as the most protective biometric privacy law in the nation and is the only one of its kind to offer consumers protection by allowing them to take a company who violates the law to court.

BIPA requires companies to:

• Inform individuals in writing about the data they collect, the purpose of the data collection, and how long the data will be stored.
• Obtain written consent before collecting biometric data from an individual.
• Protect individuals’ biometric data from unauthorized access and disclosure.
• Prohibit companies from selling or profiting from individuals’ biometric data.
• Allow individuals to sue companies that violate their rights under BIPA.

The law applies to private companies that collect, store, or use biometric data of Illinois residents. This includes employers, retailers, and other businesses that use biometric data for identification purposes. BIPA does not apply to government agencies or law enforcement, which are regulated by other laws.

What is Biometric Data?

Biometric data refers to unique physical or behavioral characteristics that can be used to identify a person. Some examples include:

• Fingerprint or hand scans
• Facial geometry
• Retina or iris scans
• Voiceprints
• DNA
• Other unique biological information

Why Do We Need BIPA?

A person’s biometric information belongs to them, and only them. This information should never be left to corporate interests who want to collect data and use it for commercial purposes. BIPA is currently the one legislation that makes it unlawful for private companies to use facial recognition technology to identify and track people without their consent. This technology has proven to be both inaccurate and harmful, making it prone to discriminatory effects, especially on women and people of color.

Moreover, BIPA allows individuals to sue companies that violate their rights under the law. If you believe that your biometric data has been collected, stored, or used without your consent, you may be entitled to compensation. The attorneys at Randolph & Holloway can help you assess your case and seek justice.

More than a decade after the law’s enactment, we constantly hear new examples about companies seeking to collect, share, and misuse personal information of millions of people, without their knowledge or consent. At this critical moment, it is important for state decision-makers to continue protecting BIPA under mounting attacks. Unlike a phone number, email address, or other password, biometric information can never be changed. That is why we continue to rely upon BIPA to protect our most sensitive information.

What is the BIPA statute of limitations? 

In Tims v. Black Horse Carriers, Inc., case number is 2023 IL 127801, the Illinois Supreme Court held on May 2, 2023, that the statute of limitations for claims under the Biometric Information Privacy Act (BIPA) is five years, not one year. The plaintiff in this case, Anthony Tims, sued his former employer, Black Horse Carriers, Inc., alleging that the company violated BIPA by scanning his fingerprints without his consent and disclosing the data to third parties. Black Horse argued that the statute of limitations for BIPA claims was one year, because BIPA was enacted as an amendment to the Illinois Consumer Fraud and Deceptive Business Practices Act (ICFA), which has a one-year statute of limitations.

The court rejected Black Horse’s argument, holding that BIPA is a separate and distinct statute with its own statute of limitations. The court found that the legislature’s intent in enacting the law was to provide individuals with a longer period of time to bring lawsuits alleging violations of the law.

The court also noted that the five-year statute of limitations is consistent with the statute of limitations for other privacy laws, such as the Illinois Video Privacy Act. The court’s decision in Tims provides clarity for businesses and individuals alike, as it establishes a clear timeline for filing BIPA lawsuits.

What Can You Do if Your Rights Have Been Violated?

If you believe that your rights under BIPA have been violated, you should consult with our office. We can assess your case, gather evidence, and help you file a lawsuit against the responsible company. You may be entitled to:

• Statutory damages of $1,000 for each negligent violation of BIPA, or $5,000 for each intentional or reckless violation.
• Actual damages for any harm you suffered as a result of the violation, such as identity theft or emotional distress.
• Attorneys’ fees and costs.

At Randolph & Holloway LLC, we are dedicated to protecting the rights of Illinois employees. Our experienced employment law attorneys have a deep understanding of BIPA and can help you seek justice if your rights have been violated. We offer free consultations and work on a contingency basis, which means that you don’t pay us unless we win your case. Contact us today to schedule your free consultation and learn how we can help you.