This article appeared in Cybersecurity Law & Strategy, an ALM publication for privacy and security professionals, Chief Information Security Officers, Chief Information Officers, Chief Technology Officers, Corporate Counsel, Internet and Tech Practitioners, In-House Counsel. Visit the website to learn more.
Companies that collect, store, and use biometric data of their employees and consumers are justifiably concerned about running afoul of the Illinois Biometric Information Privacy Act (BIPA). The statute, which imposes written consent and data retention requirements, is the only one of its kind to provide a private right of action, allowing recovery of $1,000 per violation ($5,000 if reckless or intentional), plus attorneys’ fees. The statute has become a favorite tool of plaintiffs’ attorneys, who have filed hundreds of putative class action lawsuits over the last few years.
