- Recent DOJ ADA Web Accessibility Guidance Creates Compliance Questions, not Answers
- New Presidential Directive for Foreign Investment Reviews of U.S. Technology and Data Companies
- FTC Launches “Commercial Surveillance and Data Security” Rulemaking
- Cybersecurity Disclosures Required by the SEC’s Recently Proposed Rules
- The Future is Now: Data Subject Requests in 2023
- FTC Scrutinizes Children’s Privacy Issues Involving Education Technology
- Utah Becomes the Fourth State to Enact a Comprehensive Privacy Law
- Courts Requiring General and Professional Liabilities Policies to Respond to Cyberattacks
- The US and EU Announce a New Trans-Atlantic Data Privacy Framework
- BIPA Claims Following the McDonald Decision
- September 2022
- August 2022
- June 2022
- May 2022
- April 2022
- March 2022
- January 2022
- December 2021
- November 2021
- October 2021
- September 2021
- August 2021
- July 2021
- June 2021
- May 2021
- April 2021
- March 2021
- February 2021
- January 2021
- November 2020
- October 2020
- September 2020
- August 2020
- July 2020
- June 2020
- April 2020
- March 2020
Legal developments in data, privacy, cybersecurity, and other emerging technology issues
The Illinois Biometric Information Privacy Act (BIPA) is the only biometric privacy statute in the country with a private right of action. In the last two years, litigation under BIPA has dominated privacy law headlines. There are hundreds of BIPA class action lawsuits pending in Illinois state and federal courts, with new filings each week.
Here are some key BIPA trends to follow in 2020.
The removal question will continue to be front and center.
Virtually every BIPA class action lawsuit is filed in state court. While the Class Action Fairness Act (CAFA) allows defendants an easier path to removal, a bedrock jurisdictional principle continues to add a twist to the removal analysis: Article III jurisdiction is a necessary perquisite to federal jurisdiction, and the party seeking to invoke federal jurisdiction bears the burden to establish its existence. This conundrum has left BIPA defendants in the awkward position of advocating that technical violations of BIPA rise to the level of concrete individualized injuries in an effort to avoid remand and, potentially, a bill for the other side’s costs.
In May 2020, a Seventh Circuit Panel led by Chief Judge Wood added yet another wrinkle. According to the Panel, Article III jurisdiction is satisfied for claims brought under Section 15(b) of BIPA—which requires an entity obtain informed written consent before handling a subject’s biometrics—but not for claims brought under Section 15(a)—which requires an entity make publicly available a biometric data retention policy—because that duty belongs to the public and not to the individual.
While the Panel’s decision is currently the subject of a petition for en banc review, expect to continue to see Article III issues popping up, particularly in the context of removal, as most BIPA class action lawsuits include both Section 15(a) and 15(b) claims.
Preemption will likely lead the way as a defense strategy.
Several defendants have escaped the regulatory scope of BIPA by successfully arguing that BIPA is preempted by federal labor statutes. Most notably, the Seventh Circuit held last summer that BIPA claims brought by airline workers covered by the Railway Labor Act (RLA) are preempted because such claims required interpretation of an existing collective bargaining agreement. Similarly, at least one district court has found federal statutory labor preemption of BIPA claims brought under the Labor Management Relations Act (LMRA), which is broader than RLA preemption because it is not limited to a specific industry sector.
While plaintiffs subject to the RLA face an uphill battle in asserting BIPA claims, expect to see plaintiffs continue to test the contours of LMRA preemption, which requires a case-by-case analysis of the facts of a specific collective bargaining agreement before a finding of preemption. Additionally, the question of federal preemption of BIPA claims pursuant to the Airline Deregulation Act (ADA) is currently briefed and pending in at least one district court.
Key legal issues may finally receive (some) clarity in the appellate courts.
There are currently two key BIPA issues on appeal in the Illinois First District Appellate Court: the applicable statute of limitations (SOL) for BIPA claims and whether the Illinois Workers’ Compensation Act (IWCA) preempts BIPA claims.
There are three prevailing theories for the SOL issues. First, the one year SOL for Illinois privacy torts should apply. Second, the two year SOL for statutory penalties should apply. Finally, the five year catchall SOL for civil actions not otherwise provided for should apply. Illinois trial courts have uniformly applied the five year SOL, and most publicly-available BIPA class action settlements include at least a five-year lookback period.
Similarly, Illinois courts have issued plaintiff-friendly rulings on the IWCA preemption issue, finding that the type of injury sustained by a BIPA claimant is not compensable under the Act, among other defects with the IWCA argument.
Expect both the SOL and IWCA issues to be resolved in the near term by the Illinois First District Appellate Court.
There is still no easy out for technology vendors.
Over the past twelve months, BIPA litigation against biometric technology vendors and providers has significantly increased as the plaintiff’s bar continues to seek out well-capitalized targets to satisfy the exorbitant statutory damages available under BIPA.
Rulings to date concerning vendor liability have been mixed, with both plaintiff and defense-friendly rulings issued in recent months. Expect to see lawsuits continue to test the limits of third party and vendor liability as the concepts of attenuation, privity, and agency are litigated in the courts.
The BIPA settlement market will continue to evolve.
While there is a decent body of BIPA class action settlements, the market for valuing BIPA claims is all but settled. There is a wide range of per claimant amounts, with class size being a significant, but not the only, factor. As key legal issues approach ruling, expect to see both plaintiffs and defendants capitalizing on the increasing uncertainty—particularly with dispositive issues such as preemption and SOL—in an effort to settle on favorable terms.
However, given the increased judicial scrutiny on the adequacy of biometric privacy class action settlements, expect to see less deals involving significant reversions and other devices that traditionally mitigate the cost of settlement.