By Anna S. Knight, Patrick J. Castle
Feb. 7, 2018
You can hardly pick up a smartphone these days without reading about — and experiencing — how biometric authentication technology is changing our lives and businesses.
Finger and facial recognition have become so commonplace that you might not think twice before asking your employees to authenticate their time using similar technologies, especially because traditional punchcard systems can be inefficient and vulnerable to fraud or abuse.
But a recent spike in litigation illustrates the legal risks to introducing biometric authentication devices and practices to your business. More than 50 companies are now defending class-action lawsuits under the Illinois Biometric Information Privacy Act, or BIPA, which provides rules for the disclosure, retention and protection of biometric data, and permits any person aggrieved by a violation to recover $1,000 for each negligent violation and $5,000 for each intentional violation.
Texas and Washington have passed similar laws, and New York has a labor law governing the collection of biometric information, but unlike BIPA they do not create an individual right to sue.
BIPA governs “biometric identifiers” and “biometric information.” Biometric identifier means “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” Biometric information means “any information … based on an individual’s biometric identifier used to identify an individual.”
To comply with BIPA, companies that collect or possess biometric identifiers or information must satisfy six statutory provisions.
Courts Interpreting BIPA
Though BIPA was enacted in 2008, it was not the subject of litigation until the past few years, and the most dramatic uptick in filings occurred in late 2017. The majority of those actions involve the same basic factual situation: a current or former employee is suing because they scanned their finger to clock in and out of work.
But the most important BIPA case so far, decided Dec. 21, has a slightly different context. In Rosenbach v. Six Flags, the plaintiff, Stacy Rosenbach, sued Six Flags Entertainment Corp. and Great America LLC under BIPA for scanning her son’s fingerprints to verify his identity as a season pass holder. The Illinois Appellate Court ruled that a plaintiff “must allege some actual harm” to sue under BIPA, adding that “[i]f a person alleges only a technical violation of [BIPA] without alleging any injury or adverse effect, then he or she is not aggrieved and may not recover[.]”
The Illinois Appellate Court’s ruling makes sense. First, looking to BIPA’s language, only a “person aggrieved” is permitted to sue, strongly indicating that a plaintiff must allege an actual injury. Second, from a practical perspective, the vast majority of plaintiffs acknowledge voluntarily scanning their own fingers. Even so, this decision is poised to have far-reaching implications, and it seems likely that the authoritative interpretation of “person aggrieved” will ultimately come from a future decision of the Illinois Supreme Court.
With all this in mind, what can you do to minimize the risk and expense that biometric privacy class actions pose to your business?
First, determine whether any biometric privacy laws apply to your business. This may require consulting with an attorney familiar with biometric privacy laws and professionals who understand your underlying technologies. Even if your business does not collect biometric data from Illinois, Washington, Texas or New York residents, consider whether it might in the future or whether similar laws may be adopted in applicable jurisdictions (Michigan and Connecticut are considering similar laws). Second, if biometric privacy laws apply, understand the requirements and get into compliance. Regardless of whether you have been sued, you will need to determine whether your existing policies and practices satisfy some or all of the biometric privacy legal requirements. For those policies and practices that are noncompliant, you will need to design and implement new ones. Finally, if you have been sued, then in addition to assessing and remediating compliance issues, your attorney will need to consider employing certain strategies inherent in these cases with the potential to reduce litigation costs and increase your chance of success.
The recent spate of BIPA lawsuits represents a coordinated effort by the plaintiff’s bar to catch corporate legal departments off guard. Nevertheless, it is less likely an anomaly than a sign of things to come as biometric technologies continue to pervade our personal and business lives. Companies would do well to assess their technological and legal options and vulnerabilities now and to maintain vigilance over this emerging field in the future.
Anna S. Knight is administrative managing partner and Patrick J. Castle is an attorney with Shook, Hardy & Bacon in Chicago. Comment below or email firstname.lastname@example.org.
We build robust scheduling & attendance software for businesses with 500+ frontline workers. With custom BI reporting and demand-driven scheduling, we help our customers reduce labor spend and increase profitability across their business. It's as simple as that.
Technology4 Ways to Maximize HR and WFM Data
Technology and cloud-based applications and platforms enable companies to gather more data, but can the...
TechnologyHow to prevent workforce management system outages: mitigation through redundancy
Summary Workforce management data breaches and outages are a very real threat Businesses should build r...
data breach, network security, payroll system, system outage, workforce management
TechnologyKronos (UKG) data breach leaves businesses in the dark for “several weeks”
Summary Workforce management company Kronos (UKG) suffers ransomware data breach Kronos Private Cloud a...
data breach, Kronos, ransomware, security, UKG