Law firms are forming new practice groups and hiring attorneys to handle a sharp rise in Illinois biometric privacy litigation, amid companies’ growing use of fingerprint, facial recognition, and palm print technology.
The trend highlights the growing demand for services related to biometric privacy—and what potentially is at stake for companies facing class action lawsuits for alleged violations.
The Illinois Supreme Court ruled in January that consumers don’t have to show specific harm in order to sue companies under the state’s Biometric Information Privacy Act (BIPA)—opening the door for more plaintiffs to seek damages for alleged misuse of personal data.
“We are literally seeing everywhere from three to five BIPA cases getting filed every single day” since the state high court ruling, Alfred J. Saikali, chair of Kansas City, Mo.-based Shook, Hardy & Bacon LLP’s privacy and data security practice, told Bloomberg Law.
Shook is among the firms that started expanding their BIPA practices almost immediately after the ruling in Rosenbach v. Six Flags Entertainment Corp., adding two new attorneys in February to its business litigation team. The firm is representing companies in almost 30 BIPA class actions.
“We need the people to support that and handle those matters,” Saikali said.
Illinois is one of only three states with a biometric privacy law and the only state that allows consumers to sue for alleged violations.
Firms also are building out their biometric technology teams to help companies avoid lawsuits in the first place, as employers and other companies collect data such as retina scans when employees clock in and out of work each day.
“This technology is not going away,” Saikali said. “If companies are going to continue to use it, they have to understand what the law requires them to do as part of that process.”
Defense and plaintiffs’ attorneys alike are tracking lower Illinois court rulings in pending biometric cases in the wake of Rosenbach, because those decisions could help clarify and further refine questions about damages, covered technology, and the statute of limitations.
Law Firm Moves
Detroit-based Dykema Gossett PLLC recently formed a BIPA team composed of attorneys in its privacy and information security, business and commercial litigation, and employment groups. Lewis Brisbois Bisgaard & Smith LLP, based in Los Angeles, announced a new subgroup under its labor and employment practice, to be led by Chicago-based attorneys.
Commercial and employment litigators in Dykema’s dedicated BIPA group are readying for what is “already a significant increase in BIPA class action lawsuits” filed in Illinois, Rosa M. Tumialan, a litigator in the firm’s Chicago office, told Bloomberg Law. Dykema’s BIPA practice is part of the firm’s broader privacy practice because it will “bleed into” discussions about other privacy laws, such as the European Union’s General Data Protection Regulation and the upcoming California Consumer Privacy Act, she said.
Under the Illinois law, enacted in 2008, companies are required to notify individuals and obtain consent before collecting and storing their biometric data. The privacy law allows plaintiffs to recover as much as $1,000 per unintentional violation or $5,000 per intentional violation.
Texas and Washington also have biometric privacy laws. These laws, enforced by the states’ attorneys general, also regulate commercial use of biometric identifiers and require companies to secure biometric data.
Pending Cases, Open Questions
Some of the coming lawsuits may help answer outstanding questions on the parameters of the Illinois law, attorneys told Bloomberg Law. Pending cases, which were stayed pending the high court’s ruling, also may address some of the questions.
“Now that there’s a little more clarity from the Supreme Court, I think there are some open issues that some firms are going to try and raise,” said Brandon Wise, of counsel at Peiffer Wolf Carr & Kane APLC, which represents plaintiffs in multiple BIPA class action lawsuits.
Other unresolved issues include the statute of limitations for suing under the law, the extent of available damages and how they will be calculated, and whether certain biometric technology is covered by the statute, Evan M. Meyers, a trial and appellate litigator at class action litigation firm McGuire Law P.C., said.
Existing cases will likely move forward once stays are lifted and complaints are amended, Meyers said. In the long term, he said his firm expects to file more cases, “not necessarily because of the Rosenbach ruling but, as people become aware of their rights, there are additional lawsuits that will likely be filed.”
As pending lawsuits wind through the courts, a body of case law will develop based on defendants’ arguments and court decisions, Meyers said. That, in turn, will inform not only future litigation “but also the practices of businesses with respect to the capture and use of biometrics,” he said.
To read more from Privacy & Data Security Law News pleaseOR Request Trial