Illinois Enacts BIPA Amendment Limiting Violation Accrual

On August 2, 2024, Illinois' governor signed into law S.B. 2979, a significant amendment to the Illinois Biometric Information Privacy Act (BIPA). The bill states that an entity that, in more than one instance, obtains the same biometric identifier or biometric information from the same person using the same method of collection, in violation of BIPA's notice and consent requirement has committed a single violation. As a result, each aggrieved person is entitled to, at most, one recovery for a single collective violation.

For instance, an employer who requires employees to use a biometric timekeeping system without providing the requisite notice and obtaining consent would, under the amended law, be liable only for one violation of BIPA, rather than one violation for each day the employer had used the timekeeping system. This is significant because the law imposes a penalty of $1000 per violation, or $5000 per intentional or reckless violation. Due to this amendment, plaintiffs' incentive to file suit under BIPA may decrease.

This law overturns the Illinois Supreme Court's decision in Cothron v. White Castle Sys., Inc., 2023 IL 128004 (July 18, 2023). In that decision, the court held that "a claim accrues under the Act with every scan or transmission of biometric identifiers or biometric information without prior informed consent." The court reasoned that the "plain language of the statute" regulated acts such as "collection" and "capture," which can happen more than once. The holding also emphasized that it "cannot rewrite a statute to create new elements or limitations not included by the legislature." The court explicitly stated that the legislature was best suited to address "policy-based concerns about potentially excessive damage awards under the Act," which the legislature has now done.

The bill also provides that consent from data subjects may be obtained via electronic signature, which is defined as "an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record."

The law went into effect upon the governor's signature.