The first jury verdict to address violations under Illinois’ Biometric Information Privacy Act (BIPA) resulted in a $228 million judgment against BNSF Railway. The case involved a class of more than 40,000 truck drivers who had their fingerprints scanned for identity verification purposes – without the required notice and consent – when they visited BNSF railyards to pick up and drop off loads. The jury determined the statute was violated 46,500 times, an amount equal to the number of drivers who had their fingerprints scanned, and that the violations were reckless or intentional, a finding that carries a price tag of $5,000 per violation.

The case presents two issues that have yet to be resolved by courts.  The first issue is whether damages should be calculated per person or each time biometric information is scanned. This issue is currently before the Illinois Supreme Court, but no ruling has been issued. The second issue is whether a company who contracts with a third-party vendor who in turn collects biometrics can be held liable for any BIPA violations. This issue is likely to be decided by the Seventh Circuit Court of Appeals if and when BNSF appeals the verdict.

Regardless of the ultimate answers to these questions, this case demonstrates the importance of auditing current privacy practices to ensure compliance with applicable law, as well as ensuring third-party contracts have clear provisions regarding compliance and indemnification. This is particularly true as more states enact BIPA-like statutes.