Illinois: Employers Are On the Hook for Any Illinois Biometric Information Privacy Act Violation

In Rosenbach v. Six Flags Entertainment Corporation, the Illinois Supreme Court stated that any time a covered entity fails to comply with the Illinois Biometric Information Privacy Act (BIPA), even if there is no injury to the person, the person may sue the entity for the violations. Specifically, any time a person’s “legal right is invaded” under BIPA, the person is “aggrieved” and can bring a claim.

There, an employee was engaged in door-to-door sales to have customers buy electrical or natural gas energy from the employer. Sales were completed when the employee had customers sign an agreement to purchase energy, and the employee’s pay was based purely on commissions related to the sales he made.

Although Rosenbach was not in the employment context, employers should pay close attention to the interpretation of BIPA violations. Specifically, BIPA requires employers who collect or maintain employees’ fingerprints, retinal or iris scans, voiceprints, hand scans, or face geometry, to obtain prior written consent from the employee and have a retention schedule for the biometric data collected. This scenario primarily occurs for employers with biometric timekeeping systems and security systems. Violations can lead to the greater of $5,000 per violation or actual damages, and attorneys’ fees and costs. Employers must ensure their biometric data practices are strictly compliant.