New amendments to Illinois’s Biometric Information Privacy Act (BIPA) expand the ways in which consent may be obtained and reverse a critical holding in Cothron v. White Castle System, Inc.,¹ significantly reducing a company’s potential liability for collecting or sharing an individual’s biometric data without informed consent. This development impacts companies that collect, store, or share biometric data and the individuals whose biometric data is collected, stored, and shared.

Prior to the amendments, the statutory text limited methods of consent to written consent or a release executed by an employee as a condition of employment.² Those methods remain intact. The amendment, however, expands on these methods to include “electronic signature,” which includes any “electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record.”³ This expansion provides clear statutory support for the use of electronic consent forms, such as a user agreement, prior to collection. 

Additionally, the amendments alter the manner in which claims are counted, thereby reducing potential damages available to each claimant.⁴ Since the Supreme Court of Illinois’ decision in Cothron, “a separate claim accrue[d] under [BIPA] each time a private entity scans or transmits an individual’s biometric identifier or information in violation of section 15(b) or 15(d).”⁵ This meant, for example, that an employer would be exposed to new liability each time an employee used a biometric time clock to clock in and out of work. Under the amendment, so long as the method of collection is the same, a single claim accrues for each biometric identifier collected without consent to collect, regardless of the number of times that employee utilizes the alleged collection device.⁶ Similarly, so long as the method of collection is the same and the recipient is the same, a single claim accrues for each biometric identifier shared with the same recipient without having previously received consent to share with that recipient.⁷

The claim accrual amendments will have the effect of reducing the total number of violations levied against companies that collect or share biometric data. However, the impact of these amendments on total damages may be limited. Plaintiffs have historically not sought damages per scan, but rather sought statutory damages per claimant. Furthermore, a second holding in Cothron holding that courts have discretion to adjust the statutory damages provisions of BIPA is not affected by the statutory revisions.⁸

Additionally, whether the amendments will be applied retroactively to claims accrued or cases filed before the amendment’s effective date remains to be determined. However, precedent suggests that the amendments may not apply retroactively. The amendments explicitly are immediately effective but are silent on retroactivity. When the legislature is silent, retroactivity hinges on the absence of substantive effects to the rights, liabilities, or obligations of individuals protected or regulated by the amended statute.⁹ Here, the amendments alter acceptable forms of consent and claim accrual, each of which relate to when a cause of action arises. Accordingly, there is a presumption that the amendments are substantive¹⁰ and will not have retroactive effect. This may lead to disparate damages between those claims subject to the amendment and those not so entitled, and further litigation testing retroactivity is anticipated. 

Footnotes

J. Morgan Dixon also contributed to this article.