CYBER RISK CLIENT ALERT: The Constitutional Argument Against BIPA

by

There has been no shortage of litigation since the passage of the Illinois Biometric Information Policy Act, commonly known as BIPA, especially since the Illinois Supreme Court’s recent decision in Rosenbach v Six Flags Entm’t Corp., 2019 WL 323902 (Ill 2019) that an individual does not need to allege actual damages to have standing.  We have already circulated two articles discussing the [Southwest] and [Hotel Management] lawsuits.  In response, defendants have been swift and creative in their defense.  Most recently, a major grocery chain argued before an Illinois state court judge the unconstitutionality of BIPA. 

A pharmacist at an Illinois Jewel-Osco store, filed suit on behalf of all Illinois Jewel Osco employees in 2018, claiming the stores’ parent company, New Albertsons Inc., did not obtain informed consent before requiring its workers to scan their fingerprints to access its computer system.  Under BIPA, companies must provide notice and obtain consent before collecting, storing, or using an individuals’ biometric data.  

In response, Albertsons moved to dismiss Plaintiff’s Complaint arguing the Statute unconstitutionally affects some companies harder than others. Specifically, it argued that BIPA excludes entities like financial institutions subject to the Gramm-Leach-Bliley Act and agents or contractors of local governments “without rational basis.”  Illinois’ Constitution specifically prohibits the legislature from passing laws giving special benefits to certain groups while excluding similarly situated groups. Albertsons argued that under BIPA, a cleaning company would be exempt from the statute if it were providing services to the Daley Center, but a similar company would be subject to the statute if it were providing services to a private building next door. Albertsons argued this kind of “special treatment” is unconstitutional under Illinois law. 

In its response, Plaintiff argued Albertsons’ motion did not overcome its burden of proving Illinois’ legislature acted arbitrarily when it carved out the financial institution and government exceptions.  Plaintiff argued that on the face of the Statute, BIPA specifically states that it governs biometrics “in the private sector.”  Plaintiff requested that if the judge dismisses the action pursuant to Albertsons’ motion to dismiss, she also certify questions for appeal so the Illinois Appellate Court would be forced to answer the question of BIPA’s constitutionality. Circuit Court Judge Loftus is scheduled to rule on Albertson’s motion to dismiss in January 2020. We will continue to monitor this case.

The litigious response to the Illinois Supreme Court’s interpretation of the damage’s requirement leaves many wondering if BIPA is here to stay, at least in its present form.  In addition to the constitutional challenges presented in Albertsons, the Illinois legislature has considered amending BIPA in various ways, and we anticipate that it will continue to consider amendments during the next legislative session. And, BIPA faces a potential standing challenge through a lawsuit filed against Facebook in a federal court in California in which Facebook recently petitioned the United State Supreme Court to review the Ninth Circuit’s finding that Article III standing exists even in the absence of an actual harm to the plaintiff. 

For now, though, while BIPA is still in effect companies must determine whether their policies comply with the current law, and if not, how quickly they can come into compliance before they must respond to a significant lawsuit of their own.

Photo: iStock.com/ktsimage

Get Updates By Email

Blog Contributors