Recent Decisions Clarify Scope of Illinois Biometric Privacy Law

The stream of BIPA suits filed each week remains steady, and multi-million dollar settlements have become commonplace. For users of biometric information subject to BIPA's rigorous requirements, the last two years have brought mostly bad news, most notably a smattering of unfavorable decisions on the question of whether plaintiffs must suffer an injury in order to avail themselves of BIPA.

Against this backdrop, however, courts have issued decisions on other aspects of BIPA, including the jurisdictional reach of the statute across state lines, the application of the law to third-party data vendors, the statute's health care data exemption, and the preemptive effect of labor laws. Although these decisions may not grab the same headlines as a half-billion-dollar settlement, they should begin to define the contours of the law and give parties to BIPA litigation some much-needed clarity.

Article III Standing

A central question in BIPA litigation has, thus far, been whether a plaintiff needs to allege an actual injury, separate and apart from a statutory violation of BIPA. The Illinois Supreme Court held, in January 2019, that no such requirement is imposed for complaints filed in Illinois state courts, including because the Illinois Constitution does not have an analog to the US Constitution's Article III injury-in-fact requirement. Later in 2019, the US Court of Appeals for the Ninth Circuit held that a plaintiff who had alleged a BIPA violation had satisfied the Article III standing requirement because BIPA was designed to protect an individual's common law right to privacy, which the court found was a concrete (and not merely procedural) injury. These decisions were largely at odds with the majority of decisions from district courts in Illinois, which had held that plaintiffs who only alleged violation of BIPA's statutory requirements, without some additional harm, did not have standing and could not pursue their claims.