Categories
Biometric Privacy Legal Landscape Case Law Developments

Q1 Biometric Privacy Litigation Update

Amanda M. Noonan |

In the first quarter of 2022, there have already been significant legal developments in the biometric technology space. Most notably, the Illinois Supreme Court—which has actively taken Illinois Biometric Privacy Act (“BIPA”) cases amid the surge of such class action litigation in federal and state courts—issued several consequential BIPA opinions this year. Though 2022’s most critical BIPA decisions are likely still on the horizon.

Categories
Case Law Developments

Claim Accrual Ruling Could Bring Seismic Shift to Biometric Privacy Landscape in 2022

Amanda M. Noonan |

At the end of 2021, two developments laid the groundwork for a definitive resolution of one of the most significant, yet unsettled, issues under the Illinois Biometric Information Privacy Act (“BIPA”)—claim accrual. While all litigants would appreciate some certainty surrounding this hot-button issue, resolution of when a BIPA violation “accrues” (i.e., occurs) will have a seismic impact on the trajectory of all BIPA litigation for years to come—depending on how the Illinois Supreme Court rules in the coming term.

Watson and Cothron BIPA Decisions

In mid-December 2021, an Illinois appellate panel in Watson v. Legacy Healthcare Financial Services, LLC, held BIPA claims accrue each and every time a defendant captures biometric information in violation of the statute, as opposed to only accruing at the first instance of collection.

Just a few days after Watson, the Seventh Circuit Court of Appeals issued its decision in Cothron v. White Castle System, Inc.—another appeal involving claim accrual. But rather than decide when a BIPA claim accrues, and after acknowledging the existence of Watson, the Cothron court certified the question to the Illinois Supreme Court to provide definitive guidance.

While neither Watson nor Cothron offers a conclusive answer, the issue is now teed up to be definitely decided by Illinois’ highest court.

Impact & Implications

The accrual date is a significant issue in BIPA class action litigation. Depending on the circumstances, accrual can serve as the basis for a statute of limitations defense, which, if successful, may require dismissal. But the issue is even more consequential in the context of damages and determining the overall value of a biometric privacy class action. If continuing BIPA violations constitute separate, independent claims, then the associated statutory negligent damages of $1,000 per violation (or $5,000 if intentional) could begin to compound. And because the law provides for liquidated damages for each violation, a ruling that claims accrue each time a defendant runs afoul of the law’s requirements could expand such liability exponentially.

Conclusion

Companies should pay close attention to how the Illinois Supreme Court decides the Cothron appeal, as the ruling could result in a drastic shift in the biometric privacy legal landscape. In the interim, companies should—with the assistance of experienced biometric privacy counsel—take the time to reassess their compliance with BIPA to ensure they are satisfying the full range of requirements to mitigate potential class action risk.

Categories
Biometric Privacy Compliance Tips Case Law Developments Legislative Developments & Trends

Current BIPA Trends: Class Actions Targeting the Use of Voice Data

David J. Oberly |

2021 has brought with it a sizeable expansion in the types of technology and companies that are now being targeted with bet-the-company Illinois Biometric Information Privacy Act (“BIPA”) class action lawsuits. The first major expansion involved the targeting of virtual try-on technology, a feature made even more popular during the COVID-19 pandemic, which, according to plaintiffs, utilizes facial recognition technology. More recently, a high volume of BIPA class action suits have been filed targeting the use of voice-powered technologies.

BIPA & Voice Data

BIPA regulates the collection, use, and storage of “biometric identifiers,” which includes—among other things—“voiceprints.” However, the term “voiceprint” is not defined in Illinois’ biometric privacy statute. “Voiceprint” is generally defined as a distinctive pattern of curved lines and whorls made by a machine that measures human vocal sounds for the purpose of identifying an individual speaker. It is this hallmark of identifying (or verifying the identity of) an individual that makes voice data a “voiceprint” under BIPA. In this respect, courts have noted that voice biometrics, also known as voiceprinting, is the use of biological characteristics—one’s voice—to verify an individual’s identity.

Thus, a critical distinction exists between general voice data, which is not covered by BIPA, and voiceprint, which fall under the scope of Illinois’ biometric privacy statute—with the important dividing line being the identifying quality of the biometric information. In a 2017 case, an Illinois federal court recognized this distinction, noting the difference between the mere capture of voice data and an actual “voiceprint.” In doing so, the court noted that if an entity simply captures a person’s voice without generating a voiceprint for the specific purpose of identifying ,or verifying the identity of, an individual, then there is no violation of BIPA.

Categories
Case Law Developments Class Action Litigation Defense Strategies

Designing a BIPA Defense: Biometric Manufacturer & Vendor Litigation Strategies

Amanda M. Noonan |

Class action litigation against biometric technology manufacturers and vendors is on the rise. Several courts have recognized the viability of such claims and held manufacturers/vendors may be subject to liability under Sections 15(b) and 15(d) of the Illinois Biometric Information Privacy Act (“BIPA”). 740 ILCS 14/15(b) & (d); Figueroa v. Kronos Inc., 454 F. Supp. 3d 772, 784-86 (N.D. Ill. 2020). The merits of these BIPA claims are yet undetermined. But the risk of having to defend such claims in state and federal courts is real and ongoing.

As the saying goes, the best defense is good offense. Rather than face uncertain liability, or incur exorbitant litigation defense costs, potential BIPA defendants often turn to arbitration provisions. For manufacturers/vendors of biometric technology, however, this approach may not be that simple.

Categories
Case Law Developments

Illinois Appellate Court Clarifies Applicable Limitations Period in BIPA Class Action Litigation

David J. Oberly |

On September 17, 2021, the Illinois Appellate Court First District delivered its much-anticipated decision in Tims v. Black Horse Carriers, Inc., 2021 IL App (1st) 200563 (1st Dist. Sep. 17, 2021), addressing the applicable statute of limitations for causes of action asserted under the Illinois Biometric Information Privacy Act (“BIPA”).

The court held that claims brought under Sections 15(a), (b), and (e)—pertaining to the law’s privacy policy/data destruction, notice/consent, and data security requirements—are subject to a five-year statute of limitations. Conversely, claims asserted under Sections 15(c) and (d)—relating to the law’s ban on profiting from biometric data and disclosure limitations—are subject to a one-year limitations period.

Importantly, in finding that BIPA’s two most commonly asserted provisions, Sections 15(a) and (b), are subject to the longer five-year limitations period, the opinion ensures that the tsunami of class action BIPA filings will continue to flood the courts for the foreseeable future.