Businesses and courts continue to struggle with Illinois biometric privacy law scope

A litigating attorney specializing in cybersecurity and related issues is warning that recent lawsuits under Illinois’ Biometric Information Privacy Act (BIPA) against retailers The Home Depot and Lowes show that any company in Illinois capturing images of people, including on video security cameras, should be ready to be targeted by a potential class action suit, the Cook County Record reports.

Litigating Partner Michael F. Buchanan of Patterson Belknap Webb & Tyler of New York says that unlike in other states, BIPA does not recognize different purposes for collecting information, so a wide range of businesses, including fast food chains, hotels, social media companies and airlines could face and have faced legal action.

“Simply put, BIPA is indiscriminate in its application,” he tells the Record.

Buchanan advises companies to work with counsel through implementation issues such as whether they are covered under BIPA and what steps they need to take to comply.

“Businesses also need to be thinking critically about their incident response plans, privacy and data security policies, and ensuring that senior management is involved with the company’s cyber defense regime, especially considering BIPA’s reasonableness requirement for security measures,” he says.

The Record notes that legislation regulating biometrics collection has been introduced in Alaska, Arizona, Delaware, Florida, Hawaii, Massachusetts, Montana, New Hampshire, New Jersey, Oregon, and Rhode Island, but passed in no other state.

Attorneys at Blank Rome LLP recently contributed a two-part series to Biometric Update on dealing with BIPA.

Shutterfly seeks dismissal

An Illinois federal judge should throw out a BIPA suit against Shutterfly because photographs are specifically excluded from protection under the act, the company has argued according to Law360.

Shutterfly has successfully made a very similar or the same argument before, as a suit against it was dropped earlier this year, though a federal judge had previously rejected the argument. The company is now asking U.S. District Judge Mary M. Rowland to rule BIPA’s applicability.

Google has meanwhile been sued for allegedly storing biometric data of Illinois residents for its Google Photos cloud service without meeting the informed consent requirements, The National Law Review writes. The Review suggests the allegations are similar to those in a suit filed recently against Vimeo.

New BIPA lawsuits

Another outbreak of BIPA lawsuits has struck Illinois’ courts, with former employees of Carrington Care, Thyssenkrupp Crankshaft, and Wendy’s all suing over biometric time and attendance systems.

The Cook County Record reports the Carrington Care suit was filed against LCS Community Employment LLC and Carrington Care LLC in Cook County Circuit Court, The News-Gazzette writes the Thyssenkrupp Crankshaft suit was filed in the U.S. Northern District Court, while that the Wendy’s suit has been filed against franchisee All-Star Inc. in state court, per Law360. All three are potential class action suits.

Article Topics

biometric data  |  biometrics  |  BIPA  |  data collection  |  data protection  |  facial recognition  |  privacy  |  time and attendance  |  video surveillance