Dirksen Federal Courthouse, Chicago
Editor's note: This is the second installment in a series of stories discussing the legal landscape surrounding the Illinois Biometric Information Privacy Act in the wake of the 2024 BIPA law reform. In a coming story, The Record will discuss the challenges posed by the law on Illinois' push to attract new tech development and infrastructure.
CHICAGO - Even as reforms seem to have edged down the number of biometric privacy lawsuits targeted at businesses in Illinois, appeals courts are being tasked with the job of unraveling yet another legal knot surrounding Illinois' controversial and stringent law, with many millions or even billions of dollars at stake.
This fall and, likely, through the winter months, a federal appeals court in Chicago will hear arguments from trial lawyers and the businesses they are suing on a key legal question surrounding the reforms Illinois state lawmakers enacted last year revising the law known as the Illinois Biometric Information Act (BIPA.)
The dispute will center on competing ways of reading the new version of the BIPA statute. Specifically, the controversy centers on whether the BIPA reforms should be interpreted to apply to lawsuits filed before the law was changed, or if they should only apply to those suits hitting businesses after lawmakers added the key new language, which at least appears to limit the explicit ability of trial lawyers to use the law to level massive demands for money from employers and other businesses operating in Illinois.
In the summer of 2024, Illinois Democratic state lawmakers and Gov. JB Pritzker handed a rare win to businesses in Illinois when their interests collide with trial lawyers, amending the BIPA law by passing the legislation docketed as Senate Bill 2979.
For about a decade, a growing number of trial lawyers have used the BIPA law to hit businesses with thousands of class action lawsuits and a smaller number of individual actions.
The BIPA law, passed in 2008, lays out specific provisions governing how businesses can collect, store, share and use people's unique biometric identifying information, which can include scans of people's fingerprints, retinas and "facial geometry," as well as recordings of their voices. It further requires businesses that scan people's biometrics to provide certain kinds of written notices and secure written authorization from people before scanning those physical features.
Some of the lawsuits have made headlines, generating settlements worth hundreds of millions of dollars from giant tech companies, like Google and Meta, the parent company of Facebook and Instagram.
The lawsuits have been driven largely by the seeming ability for plaintiffs and their lawyers to demand potentially astronomical payouts under the law's statutory damages provision. While other states have biometric privacy laws, Illinois' law is the only one that provides plaintiffs with a so-called right of private action, allowing them to sue businesses directly, instead of relying on a state agency to first move against alleged violations of the BIPA law.
The law gives plaintiffs the ability to demand $1,000 or $5,000 per violation, depending on how malicious plaintiffs can prove defendants may have been in allegedly violating BIPA's rules.
However, until last summer, potential payouts under BIPA lawsuits could have been massive - at least, as interpreted by the Illinois Supreme Court.
Under Illinois Supreme Court rulings, the law was interpreted broadly, as plaintiffs could bring their lawsuits against businesses without showing they were ever actually harmed, and they could demand payment for each and every allegedly illegal biometric scan.
When multiplied across entire workforces, for instance, with each worker scanning a fingerprint multiple times per day, damages under this interpretation could quickly climb up to what even the Illinois Supreme Court called "annihilative damages" of many millions or even billions of dollars.
The prospect of such "per scan" damages also enticed a mounting number of people to bring their own individual claims, as well. For instance, some plaintiffs have sought to cash in on potential claims worth $5,000 for every time they scanned their fingerprint when punching a biometric time clock at work, potentially in pursuit of massive individual windfalls.
In all cases - whether lawsuits brought as class actions or individual lawsuits - their lawyers could typically stand to collect about one third of any money paid out by defendants to resolve the legal claims.
However, under SB2979, state lawmakers added language to the BIPA law, essentially declaring the law should be read to limit damages only to $1,000 or $5,000 per person, not per scan.
While businesses and their lobbying advocates had hoped for more substantial reforms, they still welcomed the changes, which at least appeared to limit the possibility of a business being slammed with potentially catastrophic and business-killing damages at trial, even if plaintiffs can't show anyone was actually harmed by alleged technical violations of the BIPA law.
Preliminary data appears to show the reforms have at least slowed the rate at which BIPA lawsuits were multiplying, based on estimates provided by the law firm of Duane Morris. That firm regularly defends businesses against such BIPA lawsuits.
However, following the passage of the reforms, Illinois courts have continued to address arguments surrounding the reforms, and specifically how to apply the reforms to lawsuits filed before Pritzker signed SB2979 into law.
The law remains silent on whether it should be applied retroactively, driving the new controversy.
In court, businesses facing those lingering BIPA suits have argued the law should apply to those past suits, as they say it should be apparent that lawmakers always intended the damages to be restricted to one payout per individual, not multiplied across potentially hundreds of scans.
Judges, however, have largely continued to side with plaintiffs and their trial lawyers, who have argued the lawmakers' silence on the question means the reforms and its damages limits should apply only proactively. Plaintiffs in lawsuits filed before the passage of SB2979 should still be able to claim damages of $1,000 to $5,000 per scan, as allowed under the Illinois Supreme Court's decision.
A number of those cases have been appealed and consolidated before the U.S. Seventh Circuit Court of Appeals in Chicago.
The appeals court has not taken any action on the appeals, to date. But the court has laid out a briefing schedule. An opening brief has been filed by railroad operator Union Pacific, the primary defendant in the consolidated action.
At the same time, the U.S. Chamber of Commerce has waded into the action, as well, filing a brief in support of Union Pacific and other targeted businesses in the appeal.
In that brief, the Chamber called on the court to declare the reforms retroactive, saying it should be apparent that lawmakers intended for the change to protect businesses - and particularly, small businesses - from the risk of financial ruin under the law.
The Chamber noted that in the 12 months before SB2979 was passed, "349 BIPA cases were filed in Illinois state courts, including approximately 75 filed against small businesses."
"Behind these numbers are real employers operating in Illinois and across the country," the Chamber wrote in its brief. "They include nursing homes, employment staffing agencies, a door and window manufacturer, a furniture store, a transportation company, a ping-pong social bar, and a nonprofit organization serving Chicago’s North Lawndale Neighborhood.
"Stalwart Illinois institutions like the Blommer Chocolate Company, Garrett Popcorn, El Milagro tortilla company, and the Windy City Limousine Company were all named in BIPA lawsuits before the legislative amendment went into effect.
"The outcome of this case will determine whether these businesses face the risk of devastating damages awards," the Chamber said.
Despite the potential big stakes, attorney John Ochoa with the firm of Smith Amundsen in Chicago, cautioned that any decision may not necessarily have as substantial an effect on the outcome of many of these cases as some on both sides may hope.
The reason, Ochoa said, is that BIPA settlements have rarely reflected the "per scan" damages demands spelled out in the lawsuits.
"Almost all cases were already settling on a per person basis, even before the (reform) legislation," Ochoa said.
"There were potentially some big numbers, but everyone recognized those were kind of ridiculous.
"The numbers were almost make-believe," he said.
As a result, after SB2979, plaintiffs' settlement demands haven't substantially declined, Ochoa said - at least, not yet.
"If there was a decline, I haven't seen it," he said.
He conceded the outcome of the appeal could play a role in future BIPA settlement negotiations in class actions, where the "threat" under the "per scan" damages interpretation likely "nudged up amounts a little bit."
But while class actions may not be significantly impacted, Ochoa said the outcome of the case could undercut individual BIPA claims. In those cases, a BIPA claim that is now worth hundreds of thousands of dollars or more, could slip to just $5,000 or less.
In one of the consolidated cases pending before the Seventh Circuit, for instance, two individual plaintiffs, identified as Rashaan Edwards and John Gregg, are suing trucking company Central Transport. According to the complaint, Edwards and Gregg worked at Central's facility in suburban Hillside.
Each claimed they worked for Central from Oct. 1-Oct. 31, 2023, and scanned their fingerprints at least four times per work day on the facility's biometric time clock, amounting to at least 88 alleged BIPA violations for each man.
So, they are each seeking payouts of $88,000 to $440,000 or more from Central Transport.
According to court documents, however, without the "per scan" multiplier, the plaintiffs could only seek $15,000 each.
They are represented in the case by attorneys Adam J. Feuer and Nick Wooten, and others with the firm of DJC Law, of Chicago and Austin, Texas.
For those and similar individual plaintiffs - most of whom filed their claims before the reforms of SB2979 were enacted - Ochoa said the viability of their claims will hinge on the outcome of the appeals currently before the Seventh Circuit.
Ultimately, however, the fate of the case may yet fall to the Illinois Supreme Court. The Seventh Circuit may yet punt on the case, deferring to the state high court to answer the key question on retroactivity.
The Seventh Circuit, however, has not yet indicated how it will proceed.
