United States: Class Actions Update - April 2024

Potential Changes to BIPA in 2024

In 2008, Illinois became the first state to pass a biometric privacy act, appropriately entitled the Biometric Information Privacy Act (“BIPA”), which has become a common basis for class action lawsuits. 740 ILCS 14/1 et seq. Potential recovery is especially enticing for plaintiffs, because a “prevailing party may recover for each violation”: “(1) against a private entity that negligently violates a provision of this Act, liquidated damages of $1,000 or actual damages, whichever is greater,” or “(2) against a private entity that intentionally or recklessly violates a provision of this Act, liquidated damages of $5,000 or actual damages, whichever is greater.” 740 ILCS 14/20(1)-(2). Plaintiffs may also recover reasonable attorneys' fees and costs, expert witness fees and other litigation expenses, and any other relief that a court deems appropriate, including injunctive relief. 740 ILCS 14/20(3)-(4). 

In February 2023, in a 4-3 decision, the Illinois Supreme Court ruled that “a separate claim accrues under the Act each time a private entity scans or transmits an individual's biometric identifier or information in violation of section 15(b) or 15(d).” Cothron v. White Castle Sys., Inc., 2023 IL 128004, ¶ 1. In that case, the defendant “required its employees to scan their fingerprints to access their pay stubs and computers.” Id. ¶ 4. The Illinois Supreme Court ruled that each scan counts as a separate BIPA violation (rather than per affected employee) even though the defendant could face a $17 billion judgment if found liable. Id. ¶¶ 40-41. The Cothron  decision provided defendants with some hope, holding that “[i]t also appears that the General Assembly chose to make damages discretionary rather than mandatory.” Id. The Illinois Supreme Court further recognized that in the class action context, courts still had the right to “fashion a damage award that (1) fairly compensated claiming class members and (2) included an amount designed to deter future violations, without destroying [a] defendant's business.” Id. ¶ 42 (quoting Century Mutual Insurance Co. v. Tracy's Treasures, Inc., 2014 IL App (1st) 123339, ¶ 72).

Despite this language, the potential exposure to defendants remains high. There have been large settlements both before and after Cothron. In the social media context, Meta settled for $68.5 million for claimed violations by Instagram, which was approved in late 2023. See Parris v. Meta Platforms, Inc., Cir. Ct. DuPage Cty. (IL), No. 2023LA000672. Snapchat settled in 2022 for $35 million. See Boone v. Snap, Inc., Cir. Ct. DuPage Cty. (IL), No. 2022LA000708. Facebook's 2020 settlement dwarfed that: it was $650 million. See In re Facebook Biometric Information Privacy Litig., Master File No. 3:15-cv-03747-JD (N.D. Cal.). Claims involving employees also have settled for large amounts. After the first BIPA jury trial, BNSF was found liable for scanning truck drivers' fingerprints to identify their identities. The judge initially awarded $228 million for 45,600 class members, but then vacated the damages amount on a post-trial motion. Rather than have a second jury trial solely on damages, the parties received preliminary approval for a $75 million settlement on February 28, 2024, with a final approval hearing scheduled for June 2024. See Rogers v. BNSF Railway, No. 19-cv-03083 (N.D. Ill.). Companies are sued for BIPA violations on smaller scales as well, which also result in significant settlements. In late 2023, the parent company of the Jewel grocery store chain received approval for a $1,076,075 settlement for approximately 1,001 class members who worked at one distribution center. See Goree v. New Albertsons L.P., No. 1:22-cv-01738 (N.D. Ill.).Graphic Packaging International has received preliminary approval of a settlement for over $997,800 for using hand-scan timeclocks for 603 employees, with a final approval hearing scheduled for June 2024. See Roberts v. Graphic Packaging Int'l, LLC, No. 3:21-cv-00750 (S.D. Ill.).

But change may be on the horizon in 2024. As the Cothron court noted, “we continue to believe that policy-based concerns about potentially excessive damage awards under the Act are best addressed by the legislature.” 2023 IL 128004, ¶ 43. The Illinois legislature may do just that. Bills recently have been introduced in the both the Illinois Senate (S.B. 2979) and the Illinois House (H.B. 4686) to amend BIPA.

The synopsis of the Illinois Senate Bill introduced on January 31, 2024 describes part of the proposed amendments as follows: “Provides that a private entity that more than once collects or discloses a person's biometric identifier or biometric information from the same person in violation of the Act has committed a single violation for which the aggrieved person is entitled to, at most, one recovery.” S.B. 2979 passed the Illinois Senate judiciary committee on March 13, 2024 and the full State Senate on April 11, 2024 with a 46-13 vote. The bill has been sent to the Illinois House for its consideration.

On February 1, 2024, a different bill was introduced in the Illinois House, which seeks more far-reaching amendments. This proposal includes provisions such as: (i) a 30-day notice and cure period, in which case there would be no cause of action if a private entity expressly states that it has cured the violation and no further violation shall occur; (ii) if the private entity breaches the express statement that it has cured any violation and it would not occur again, only then would there be a cause of action; (iii) potential recovery amounts would be limited to actual damages for a negligent violation or actual damages plus liquidated damages up to the amount of actual damages for willful violations; and (iv) an exclusion for employees covered by a collective bargaining agreement that provides for different policies regarding biometric information. H.B. 4686 was sent to the Civil Procedure & Tort Liability Subcommittee on March 13, 2024 and was re-referred to the Rules Committee on April 5, 2024.

If a bill limiting BIPA claims passes the Illinois state legislature and is signed by the governor, the potential exposure to defendants would be much less than what is currently allowed by BIPA, without having to rely on the discretion (and mercy) of a court in a class action lawsuit. 

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.