The Illinois Biometric Information Privacy Act requires employers and other private entities in the state to safeguard biometric data that can be used to identify an individual. Examples of biometric data covered by the law include fingerprints, voiceprints and eye scans. When private entities violate the provisions of BIPA, the law gives individuals the right to pursue damages of up to $1,000. This figure rises to up to $5,000 when violations are considered reckless.
BIPA requirements
BIPA requires private entities that wish to collect, purchase or otherwise obtain biometric data to inform individuals in writing that their data is being collected and explain how it will be used. The law also requires private entities to:
- Draft a written policy that details how biometric data will be destroyed and share this policy with the individual.
- Destroy biometric data no later than three years after the last contact with the individual.
- Put security protocols into place to protect biometric data that meet or exceed industry standards and are at least as rigorous as the protections in place for other kinds of confidential information.
- Refrain from selling, leasing or otherwise profiting from biometric identifiers.
- Refrain from sharing biometric data unless the individual consents or they are presented with a valid warrant or subpoena.
BIPA lawsuits
Many of the lawsuits filed over BIPA privacy rights violations are class actions against technology companies. In February, a photograph sharing website that uses facial recognition software to scan uploaded images agreed to settle such a case. In March, a social media platform that uses the same kind of software to scan video files agreed to pay $92 million to settle a BIPA lawsuit.
Protecting your privacy
An attorney with experience in this area could point out that individuals can recover damages for a BIPA violation even if they did not suffer harm. They only have to establish that the private entity involved committed a procedural violation. If you believe that your personal data has been collected or used and BIPA has been violated, an attorney could initiate a legal action on your behalf.
Get in touch with us today by calling (800) 483-0998 or by filling out our online contact form.
