Illinois High Courts Set to Resolve Long-Outstanding BIPA Issues After Flood of Litigation

In 2019, the Illinois Supreme Court issued a long awaited decision regarding what constitutes standing under the state’s Biometric Information Privacy Act (“BIPA”). In Rosenbach v. Six Flags, the Court held that an individual “need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Act, in order to qualify as an ‘aggrieved’ person” entitled to relief. This private right of action has made plaintiffs eager to litigate and has presented various issues of first impression that the Illinois courts have agreed to consider and resolve in 2021.

The increase in litigation concerning BIPA claims has presented Illinois high courts with an opportunity to address nuanced issues within the state’s privacy statute and resolve them once and for all.

BIPA governs the collection and storage of biometric information (e.g., iris scan, fingerprint, voiceprint, face scan), and generally forbids a private entity from collecting and retaining this information without first obtaining informed consent. One issue Illinois courts are set to resolve in 2021 is whether employers who use biometric fingerprint data as a method of timekeeping violate the Act by retaining this information without first obtaining written consent. Workers from Popeyes filed a class action against the fast food chain alleging their employer collected and stored their fingerprints in an electronic database without their consent. The lead plaintiff, Latoya Roberts, claims that Popeyes never disclosed to employees that they were retaining this information and violated her privacy rights by doing so. A worker at Jet’s Pizza restaurant filed a separate class action on the same grounds, seeking statutory damages for the unauthorized data collection and use his employer committed by requiring employees to “clock in” with their fingerprints. Since biometric identifiers are unique to each individual, plaintiffs are especially concerned that the database could fall into the wrong hands resulting in identity theft or other unpermitted disclosure of their private information.

Another major issue set to be resolved by the Illinois courts in the upcoming year is whether accusations that a company violated someone’s biometric privacy rights could trigger an insurer’s duty to defend the company as the claims are resolved in court. West Bend Mutual Insurance Co (“West Bend”) is asking the Illinois Supreme Court to reverse two lower court decisions holding that the insurer had a duty to defend a tanning company in an underlying BIPA lawsuit. The lawsuit alleged that the tanning company violated BIPA by disclosing their customers’ fingerprint data to a third-party vendor without informed consent. Under the policy, West Bend was required to cover damages for personal injuries arising out of the “publication of material that violates a person’s right to privacy,” and argued that the allegations in the complaint didn’t fall under the type of injuries covered. The lower court held that disclosing customers’ fingerprints constituted “publication of material,” and as such, was covered by the insurance policy triggering West End’s duty to defend the tanning company against the underlying BIPA complaint. Due to the rise of litigation under BIPA, there are an increasing number of defendants who are now demanding coverage from their insurers for these lawsuits. A resolution of this issue will help policy holders determine whether they need to obtain additional coverage for BIPA lawsuits, or whether their insurers have a duty to defend them from lengthy and costly legal disputes. Finally, the Illinois Appellate Court is set to resolve the applicable statute of limitations window for BIPA claims. Plaintiffs of BIPA lawsuits have largely argued that it should be subject to the state’s inclusive five-year statute of limitations, which is typically applied to laws that don’t explicitly include a time limit. A trucking company, however, is asking the appellate court to subject BIPA claims to a one-year statute of limitations, which is the standard for claims rooted in the invasion of someone’s privacy. A decision in this case could have drastic impacts on an aggrieved party’s ability to file a BIPA lawsuit and recover damages.

The increase in litigation concerning BIPA claims has presented Illinois high courts with an opportunity to address nuanced issues within the state’s privacy statute and resolve them once and for all. The cases on the courts’ docket this upcoming year will provide guidance in unknown and contested areas of the law, and almost certainly will impact the way BIPA claims are litigated throughout the state. With privacy concerns increasing as of late, the decisions issued this year will be closely followed and highly anticipated.

Chris Jones