Hepler Broom, LLC

Is the Illinois Biometric Information Privacy Act (BIPA) Unconstitutional?

July 16, 2019

The Biometric Information Privacy Act (BIPA) establishes safeguards and procedures relating to the retention, collection, disclosure, and destruction of biometric data. 740 ILCS 14/15. Passed in October 2008, BIPA is intended to protect a person’s unique biological traits – the data encompassed in a person’s fingerprint, voice print, retinal scan, or facial geometry. Id. But in the last few years, BIPA – with its statutory penalties of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation – has quickly become the bane of corporate defendants. The situation became even worse after the Illinois Supreme Court’s Rosenbach decision. Rosenbach v. Six Flags Entm’t Corp., 2019 IL 123186. In Rosenbach, the Court held that a “violation [of the statute], in itself, is sufficient to support the individual’s or customer’s statutory cause of action.” Id. at ¶33 (emphasis added). In other words, a bare statutory violation confers standing on a BIPA plaintiff. See id.

The Supreme Court’s ruling has, predictably, spurred additional litigation asserting bare violations of the statute. By last count, more than 100 lawsuits had been filed in the few months following the January 2019 decision, with almost all of the lawsuits brought as class actions. The lack of standing had been a key argument for defendants facing BIPA lawsuits. With that argument now foreclosed, a constitutional challenge could be the next best avenue for defeating a BIPA class action.

A constitutional challenge is not for the faint of heart. All statutes are presumed to be constitutional, which means that a party challenging the constitutionality of a statute has the burden of rebutting the presumption of validity and clearly establishing a constitutional violation. Big Sky Excavating, Inc. v. Illinois Bell Tel. Co., 217 Ill. 2d 221, 234 (2005). This burden is naturally a heavy one. S. 51 Dev. Corp. v. Vega, 335 Ill. App. 3d 542, 550 (1st Dist. 2002). If it is reasonably possible to do so, Illinois courts have “a duty to uphold the constitutionality of a statute . . . .” Big Sky Excavating, 217 Ill. 2d at 234.

The constitutional challenge to BIPA rests on its damages provision. BIPA establishes a $1,000 statutory penalty for each negligent “violation.” 740 ILCS 14/20. Plaintiffs argue that each time an employee scans his or her fingerprint into a biometric punch-clock that scan represents a violation of BIPA. An employer with 50 employees who are fingerprinted four times a day (one to clock in, one for lunch-out, one for lunch-in, and one to clock out) counts 200 violations a day and 1,000 violations in a five-day work week. That employer’s potential statutory liability could be $50 million over a fifty-week period. This seems so severe and oppressive that it could violate substantive due process.

Damages under a state statute violate due process if they are “so severe and oppressive as to be wholly disproportioned to the offense and obviously unreasonable.” St. Louis, I. M. & S. Ry. Co. v. Williams, 251 U.S. 63, 67 (1919). Unfortunately, this argument has not been successful at the Illinois Supreme Court. See In re Marriage of Miller, 879 N.E.2d 292 (Ill. 2007) (interpreting the Income Withholding for Support Act). In Miller, the plaintiff sued her ex-husband’s employer for failing to withhold his wages after he failed to pay child support. The statutory penalty was up to $100 per day for an employer’s violation, and in Miller, the employer racked up more than $1.1 million in statutory penalties. The Illinois Court of Appeals found that the Act violated the Due Process Clause based on the severe penalty, but the Illinois Supreme Court reversed, holding that the Act did not violate substantive due process as applied. There is federal case law on the other side of Miller. See Stillmock v. Weis Markets, Inc., 385 F. App’x 267, 278 (4th Cir. 2010) (Wilkinson, C.J., concurring) (“[C]ourts have noted that the potential for a devastatingly large damages award, out of all reasonable proportion to the actual harm suffered by members of the plaintiff class, may raise due process issues.”).

This federal law may come to the attention of World Wide Technology, which recently filed a Notice of its intent to challenge the constitutionality of BIPA “because the liquidated statutory damages potentially available under the BIPA are grossly excessive and disproportionate in light of” the actual harm to plaintiffs. Young v. World Wide Technology, LLC, No. 3:19-CV-496 SMY-GCS (S.D. Ill. June 21, 2019) (Doc. 11). Any constitutional challenge will certainly find its way back to the Illinois Supreme Court. But after Rosenbach v. Six Flags, corporate defendants will be hoping for a smoother ride.

COVID-19 Updates

HeplerBroom LLC COVID-19 Response

HeplerBroom has been diligently working on its response and continuity plan to the COVID-19 pandemic in order to keep the health and safety of our employees, their families, and our clients as our top priority.

To help ensure everyone’s continued health and well-being, effective Tuesday, March 17, 2020, all attorneys and staff will be working remotely until March 31. This is an unprecedented and dynamic situation, and HeplerBroom is committed to observing governmental suggestions and requirements concerning public health while continuing to provide legal service second to none.

To ensure this, the firm has identified essential personnel in each office who will make certain that critical firm functions that cannot be done remotely continue to be handled. We have put in place protocol for those essential personnel to make sure they are keeping healthy per the CDC cleaning and sanitizing recommendations. All teams have back-up personnel and procedures that we will follow to make sure all deadlines are met and clients receive the same great service and work product that we have always been proud to provide.

HeplerBroom’s IT department has been working hard to make sure all remote employees are set up with equipment and access from home to limit disruption to our clients. Maintaining security and confidentiality has remained, and will continue to remain, at the forefront of all processes and procedures, at all levels throughout the firm.

The firm has created emergency communication measures to communicate any changes to this plan to employees and are communicating on a regular basis with any and all new resources and helpful information during this uncertain time.

During these fluid and unpredictable times, HeplerBroom will continue its commitment to great service and results for our clients, all while keeping safe and healthy.

Wishing you and your families good health.