Three rulings have exponentially compounded the risks to businesses that collect biometric information without consent:

1. The California Superior Court held that claims for collecting biometric information can proceed under California’s constitutional right to privacy, laws protecting against unauthorized use of a person’s identity, and the state’s Unfair Competition Law (Renderos v. Clearview AI, Inc.);
2. The Illinois Supreme Court held that each biometric scan—as opposed to each person—is a violation, subject to a penalty of either $1,000 or $5,000 (Cothron v. White Castle System, Inc.); and
3. The Illinois Supreme Court held that BIPA claims can be brought for up to five years after the first alleged violation (Tims v. Black Horse Carriers, Inc.).

What Is BIPA?

In a previous paper authored by Dentons, we shared with you that, in 2008, the Illinois General Assembly adopted the Biometric Information Privacy Act (BIPA), which applies to businesses that collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier or biometric information, such as fingerprints, voiceprints, retina or iris scans, and face geometry. Plaintiffs can bring claims under BIPA despite having suffered no actual harm or damages.

While the Cothron ruling secures Illinois’ spot as the biggest exposure risk to companies, California law has now been found to apply BIPA-like allegations to similar claims. In this race to the bottom, companies need to be aware that the risk here is neither hype nor hypothetical.

New Risk of Nationwide Classes

Previously, under BIPA, only Illinois plaintiffs could bring a claim, but the Superior Court of California, County of Alameda, has made nationwide class actions possible. There, plaintiff sued Clearview AI, Inc., for violating (i) the common law right of publicity; (ii) the right to privacy under the California Constitution; and (iii) California’s Unfair Competition Law. See Renderos v. Clearview AI, Inc., 2021 WL 1623886 (Super. Ct. Alameda Cnty. April 22, 2021).

In Renderos, the defendant stated that it “provides cutting-edge facial recognition technology to governmental and law enforcement agencies to aid them in the accurate and efficient identification of persons of interest in the course of their criminal justice and national security missions.” The Court noted that the defendant collects the images and biometric information of California residents (including plaintiff) without notice or consent by scraping images from websites and platforms, such as Facebook, Twitter and Venmo.

The Court found that the algorithms used by the defendant supported claims under the right to privacy in the California Constitution, laws protecting against unauthorized use of a person’s identity, and California’s Unfair Competition Law. An Illinois court, likewise relying on California law in another case against that defendant, held that although personal information is not “property” for purposes of California’s Unfair Competition Law and dismissed that claim, the other three claims—right of publicity, misappropriation of likeness and the constitutional right of privacy—may proceed. See In re Clearview AI, Inc., 585 F. Supp. 3d 1111 (N.D. Ill. 2022).

What This Means: Because most states have privacy laws similar to California’s, this ruling may impose far-reaching ramifications—including classes in states other than Illinois and California, and potentially nationwide classes—for all businesses that currently use biometric information for timekeeping or security.

Increased Damages Under BIPA With ‘Per Scan’ Counting for Five Years

The highly anticipated ruling in Cothron v. White Castle System, Inc., 2023 IL 128004 (Feb. 17, 2023), has made BIPA cases potentially the most costly for companies doing business in Illinois. The Illinois Supreme Court ruled in a 4-3 opinion that BIPA supports a per-scan approach rather than a per-person approach, opening the door to billions of dollars in potential damages for companies that use biometric data security measures. The dissenting opinion stated that “[i]mposing punitive, crippling liability on businesses could not have been a goal of the act, nor did the legislature intend to impose damages wildly exceeding any remotely reasonable estimate of harm.”

Additionally, as noted above, the Illinois Supreme Court has ruled that BIPA does not require actual damages. See Rosenbach v. Six Flags Enter. Corp., 129 N.E.3d 1197 (Ill. 2019). This ruling doubles down on another Illinois case, Tims v. Black Horse Carriers, Inc., No. 127801, 2023 WL 1458046 (Feb. 2. 2023) which held that BIPA claims fall under a five-year statute of limitations.

What This Means: Previously, on a per-person approach, a putative class of, say, 100 employees would equate to liability at $100,000 for negligent violations and $500,000 for reckless or intentional violations. After this ruling, the exposure has skyrocketed to numbers with many zeros at the end.

For example, take one employee who uses biometrics for timekeeping and takes two breaks a day and one lunch, clocking out each time. That is eight scans per day for that one employee. If that employee works 5 days a week and 48 weeks a year, that is 1,920 potentially violative scans—$1.92 million in actual damages for negligent violations and $9.6 million for reckless violations. Almost ten million dollars in damages per employee per year. A putative class of 100 would put that exposure at almost $1 billion.

Worse yet, what if an employer uses biometrics to open registers and merchandise cases? That could happen—in a busy retail location 500+ times per day. In a business open 350 days a year, that would add up to 175,000 potentially violative scans, racking up $175 million for negligent violations and $875 million for reckless violations per year.

Those annual numbers, multiplied by the five-year statute of limitations, provide a strong incentive even for an individual employee to bring his or her own multi-million dollar claim.

Do Not Wait; Like Seriously, Do Not!

If an ounce of prevention is normally worth a pound of cure, here the relationship is exponentially larger. The relatively minor preventative costs to comply with BIPA and other privacy laws are nearly immaterial compared to the potentially astronomical damages required to cure a violation. This is not a “no harm, no foul” situation; this is a situation where no actual harm still can leave a business with significant liability.