Illinois BIPA Reform Law Enacted

By Mitchel D. Torrence

On August 2, 2024, Illinois Governor J.B. Pritzker signed Senate Bill (SB) 2979 into law, enacting much-anticipated reforms to Illinois’ Biometric Information Privacy Act, 740 ILCS ILCS 14/1 (“BIPA”). The amendment, which came in the wake of the Illinois Supreme Court’s opinion in Cothron v. White Castle System, Inc., 2023 IL 128004, reforms BIPA to make clear that a private entity which repeatedly collects or discloses biometric information commits only a single violation of BIPA.

FACTS

SB 2979, which became effective upon Governor Pritzker’s signature,  added the following language to Section 20 of BIPA:

(b) For purposes of subsection (b) of Section 15, a private entity that, in more than one instance, collects, captures, purchases, receives through trade, or otherwise obtains the same biometric identifier or biometric information from the same person using the same method of collection in violation of subsection (b) of Section 15 has committed a single violation of subsection (b) of Section 15 for which the aggrieved person is entitled to, at most, one recovery under this Section.

(c) For purposes of subsection (d) of Section 15, a private entity that, in more than one instance, discloses, rediscloses, or otherwise disseminates the same biometric identifier or biometric information from the same person to the same recipient using the same method of collection in violation of subsection (d) of Section 15 has committed a single violation of subsection (d) of Section 15 for which the aggrieved person is entitled to, at most, one recovery under this Section regardless of the number of times the private entity disclosed, redisclosed, or otherwise disseminated the same biometric identifier or biometric information of the same person to the same recipient.

ANALYSIS

Subsections (b) and (d) of Section 15 state that a private entity may not collect or disclose, respectively, a biometric identifiers or biometric information without first obtaining consent to do so. Following the amendment, private entities that repeatedly collect, or disclose, the same individual’s biometric information or identifiers are only liable for a single violation under BIPA. The amendment comes on the heels of the Illinois Supreme Court’s Cothron opinion , wherein the Court found that the plain text of Sections 15(b) and (d) supported the conclusion that a private entity violates BIPA each time it collected or disclosed an individual’s biometric information or biometric identifiers without first obtaining consent. In effect, the amendment will limit entities’ liability exposure under BIPA for repeated actions.

Learning Point: The amendment undoubtedly represents a win for Illinois business interests who no longer face the prospect of significant damages awards under Sections 15(b) and (d). However, there remain issues which are likely to be the subject of litigation. Namely, the amendment includes no language specifying whether it applies retroactively or only prospectively. As such, the full extent of the amendment’s impact  bears monitoring.