Showing 25 posts in Cyber Risk & Liability.

CUBI: Everything You Need to Know About Texas' Biometric Law and Beyond...

As companies continue to take advantage of developing technologies involving the use of biometric information, it is crucial that businesses and legal practitioners alike stay informed of the legal and compliance concerns associated with the use of such information. For instance, companies conducting business in Texas should be aware of Capture of Use of Biometric Identifiers Act (“CUBI”) (Tex. Bus. & Com. Code §503.001). Passed in 2009, CUBI regulates biometric identifiers that are used for a “commercial purpose.” While “commercial purpose” is not itself defined by CUBI and Texas courts have yet to meaningfully interpret that phrase, Texas courts have construed the term “commercial purpose” broadly, in other contexts when no definition is available (see e.g., Texas’ Product Liability Act, Tex. Bus. & Com. Code §503.001, et al.).  CUBI related concerns have created a buzz around employers’ use of kiosks and other devices for contact-tracing and other reasons, as practitioners believe that any collection of biometric identifiers for this purpose will likely fall within CUBI’s restrictions.  Importantly, while CUBI does not itself authorize a private cause of action, the Texas Attorney General is empowered to pursue violators who are subject to a penalty of up to $25,000 per violation. More »

A National Approach to Biometric Privacy

In August, Senators Bernie Sanders (I-VT.) and Jeff Merkley (D-OR.) introduced the National Biometric Information Privacy Act of 2020 (NBIPA), which serves to regulate the collection, retention, disclosure and destruction of biometric information. While NBIPA is awaiting Congressional consideration, its potential effects and nationwide extension make it noteworthy.

As currently drafted, NBIPA limits the collection of personal information to valid business purposes, prohibits the inclusion of written releases in employment contracts, and builds on the Illinois Biometric Information Privacy Act in two major ways. First, NBIPA requires all businesses, regardless of size, to obtain consumers’ opt-in consent before collecting, sharing or using their biometric data, inform consumers of the use and length of term of biometric data, develop and publish a data retention schedule and guidelines for destroying biometric data, and obligates businesses to store, transmit, and protect biometric data in the same or in a more stringent manner as is done for other confidential and sensitive information. Second, NBIPA not only creates enforcement by state attorneys but also creates a private right of action for individuals even if the injury is only a technical violation that does not result in actual damages.[1] More »

Illinois Appellate Court Eliminates Key Defense to BIPA Claims

by

On September 18, 2020, the Fifth District Appellate Court in Illinois unanimously held that the exclusivity provision of Illinois’ Workers Compensation Act does not bar employees’ statutory damages claims for violation of Illinois’ biometric privacy law.[1]  The Fifth District’s ruling has eliminated a key defense advanced by employers defending against alleged violations of the Illinois Biometric Information Privacy Act (“BIPA”).[2]

In 2017, plaintiff Marquita McDonald filed a class action lawsuit against her employer Symphony Bronzeville, Park, LLC.  Plaintiff alleged that the defendant-employer required its employees to provide biometric information by scanning fingerprints into a fingerprint-based time clock system.  The lawsuit alleged that the employer violated BIPA by: (1) failing to inform employees in advance and in writing of the specific purpose and length of time for which their fingerprints were being collected, stored, and used; (2) failing to provide a publicly available retention schedule and guidelines for permanently destroying the scanned fingerprints; and (3) failing to obtain a written release from employers prior to collecting their fingerprints.  More »

Seventh Circuit Recently Clarifies Article III Standing in BIPA Cases

by

One longstanding debate among U.S. District Courts lies at the very heart of the judicial process—what, precisely, is sufficient to confer Article III standing in lawsuits alleging violations of Illinois’ Biometric Information Privacy Act (“BIPA”)? The Seventh Circuit has now provided clarity for certain BIPA claims. More »

Best Practices for Cyber-Resilience in Uncertain Times

by

Cyber resilience is an essential component of modern-day life in corporate America.  It is critical that companies of all sizes take reasonable steps to prepare for an adverse cyber event that is, in all likelihood, inevitable in today’s business climate.  The COVID-19 pandemic has brought with it a heightened cyber threat to companies that have increasingly embraced remote employment, as well as to critical industries including medical manufacturers and suppliers, financial services, healthcare, and others.  Industry data indicates that cyber criminals have recently increased phishing campaigns and malware attacks.  In times such as these, it is prudent for a company to evaluate its cyber-risk management and resilience practices – its ability to execute and deliver its business function following an adverse cyber event. More »

CYBER RISK CLIENT ALERT: Facebook Settles Its BIPA Suit for $550 Million While Damage and Jurisdiction Issues Remain

by

All eyes are on the recent settlement in Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019), where a group of class-action plaintiffs (“Class”) alleged that Facebook violated Illinois’ Biometric Information Privacy Act (“BIPA”). Patel had already received a lot of attention primarily because the Ninth Circuit found Article III standing in the absence of actual harm.

Patel settled for a massive $550 million. This is the largest cash settlement seen in a privacy-related suit according to the parties, which is creating a lot of new-found interest in BIPA with speculation on how the settlement amount will impact future claims. More »

CYBER RISK CLIENT ALERT: The Constitutional Argument Against BIPA

by

There has been no shortage of litigation since the passage of the Illinois Biometric Information Policy Act, commonly known as BIPA, especially since the Illinois Supreme Court’s recent decision in Rosenbach v Six Flags Entm’t Corp., 2019 WL 323902 (Ill 2019) that an individual does not need to allege actual damages to have standing.  We have already circulated two articles discussing the [Southwest] and [Hotel Management] lawsuits.  In response, defendants have been swift and creative in their defense.  Most recently, a major grocery chain argued before an Illinois state court judge the unconstitutionality of BIPA.  More »

CYBER RISK CLIENT ALERT: The SHIELD Act Requires Corporations to Implement Cyber-Security Measures

by

Introduction

New York will soon take another step forward towards protecting residents’ confidential data. As of March 21, 2020, any company that owns or licenses computer data that contains the private information of a New York resident must implement and maintain reasonable measures to protect that information.  This new legislation impacts any business that obtains or preserves New York residents’ confidential information regardless of where that business is located.  New York’s expanding protection serves as yet another reminder of the importance of corporate cyber-resilience.

In 2005, New York enacted the “Information Security Breach and Notification Act.”[1] (“Notification Act”).  As with other states throughout the country, the New York State legislature recognized the significant adverse impact of data security breaches as well as identity theft, and further recognized that New York residents were “hindered by a lack of information regarding breaches. . . .”  Accordingly, the state legislature enacted the Notification Act to ensure that New York residents are properly informed in the event of a data breach, as such information would empower residents to implement measures designed to repair damage and, if possible, prevent future damage from a data breach. More »

Ninth Circuit Holds BIPA Class-Action Plaintiffs Have Article III Standing

by

Recently, the Ninth Circuit Court of Appeals issued an opinion in the case of Patel v. Facebook, Inc., 2019 WL 3727424 (9th Circ. 2019), allowing a class-action lawsuit filed in the Northern District of California to proceed.  The Court held that the plaintiffs have Article III standing to bring the suit because Facebook’s alleged violations of Illinois’s Biometric Information Privacy Act (“BIPA”) constitute a sufficiently concrete injury-in-fact.  The Court also upheld the district court’s grant of the plaintiffs’ motion for class certification, finding that the Federal Rules of Civil Procedure’s predominance and superiority requirements were met.  Patel represents a continued expansion of the law in favor of plaintiffs bringing suits under BIPA. More »

CYBER RISK CLIENT ALERT: BIPA Cutbacks Stalled in Springfield - For Now.

by

In response to the Illinois Supreme Court’s ruling in Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186 (actual harm is not required for standing under the Illinois Biometric Information Privacy Act), the Illinois legislature is now considering amending the statute, in part, by removing its private right of action.  

Illinois was the leader in enacting privacy protections for biometric data. Illinois is still one of only a few states to have such protections in place (along with Texas and Washington).  Arizona, Florida, and Massachusetts have proposed regulations to protect biometric identification, and California will have its biometric protections take effect on January 1, 2020.  More »

Get Updates By Email

Blog Contributors