As more countries, U.S. states and municipalities ponder their current consumer privacy and security laws, biometric technologies remain at the fore of ongoing conversations among legislators and corporations. Recent increases in class-action filings, arbitration suits and extensive criticism of biometric tech such as facial- and voice-recognition software indicate that this debate has only just begun. Although “biometric data” is a recognizable term to a legal professional, consumers aren’t as familiar with it—or with how such technology could be pivotal in shaping their daily lives and digital identities.
What Are Biometrics?
Biometrics are automated measurements dependent on an individual’s unique physical features and characteristics—fingerprints, palm prints, “voice prints” and facial, retinal or even iris scans. These measurements, which are in turn collected by various governments, agencies and corporations in an array of industries, act as personal authentication identifiers.
As both workers and consumers of technology, just about everyone has had biometric data collected on some level—whether they know it or not. From facial recognition unlocking features on a smartphone to fingerprint-activated punch-in systems, biometrics are quickly replacing corporate identification methods of old, expediting the process in the name of convenience.
Despite these advances, though, biometric data aren’t completely reliant on an individual’s features and physical characteristics. Although they’re a less obvious example, a person’s behavioral attributes are a kind of biometric data. Using AI machine learning tools, tech companies and financial institutions can track consumers through their mannerisms. This can encompass anything driven by human manipulation: keystroke dynamics, swipe-and-touch analysis and interactions with a computer mouse. Analyzing behavioral trends enables companies to find discernible differences when authenticating someone online, easily distinguishing human actions from automated attacks.
In recent years, behavioral biometrics’ capabilities have come as far as to study and track how individuals walk, the pressure they exert when signing an e-document and various other unique patterns. This information is then collected and stored in databases, with or without the individual’s knowledge.
Existing Biometric Laws and Statutes
As biometric data and AI machine learning continue to advance, several states have begun to consider and even introduce laws to prevent collection of such information by corporate or other private entities. This echoes legislative precursors such as Illinois’ first-of-its-kind Biometric Information Privacy Act (BIPA). Enacted in 2008, well before these tech practices became mainstream, BIPA requires all corporate entities that collect, store and use biometric data to inform users and consumers in writing and secure their consent before doing anything.
According to the American Civil Liberties Union’s webpage about biometric data, BIPA specifies that “biometrics are unlike other unique identifiers that are used to access finances or other sensitive information. For example, Social Security numbers, when compromised, can be changed. Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft and is likely to withdraw from biometric-facilitated transactions.”
Now, nearly 20 years after this landmark law’s passage, BIPA suits regularly make news. In 2019, Rosenbach v. Six Flags Entertainment Corp.1 came before the Illinois Supreme Court when Stacy Rosenbach filed claims against the amusement park for collecting her son’s fingerprint when he purchased a season pass. The case established that a plaintiff could qualify as an “aggrieved person,” making him or her eligible for both monetary damages and injunctive relief even if no physical injury was sustained. In May 2020, the U.S. Court of Appeals for the 7th Circuit ironed out that minor detail. In Bryant v. Compass Group USA, Inc.2, the court confirmed that collecting an individual’s biometric data itself qualifies as an injury, thereby violating BIPA.
In January 2020, on the precipice of the pandemic, Nimesh Patel, an Illinois resident, filed class-action BIPA-related claims against Facebook (now Meta) alleging the social media giant’s tag suggestion feature used facial recognition to collect users’ biometric data. The suit was resolved when Meta agreed to settle for $650 million, one of the largest consumer privacy settlements in U.S. legal history.
More recently, in February 2023, Cothron v. White Castle System, Inc.3 came before the Illinois Supreme Court. Latrina Cothron, manager of a White Castle restaurant since 2004, said that for employees to access their paychecks, they were required to scan their fingerprint, alleging that the burger chain was illegally collecting workers’ biometrics and actively disclosing them to third-party vendors. White Castle, which argued that Cothron’s claims were untimely, ended up forfeiting its counterclaims, with the court ruling that each time a private entity unlawfully collects biometric data, a new claim is established. It also confirmed that regardless of when a claim is filed, BIPA damages fall under the discretion of the courts.
Carrying the Biometric Torch
Despite such litigation being limited to Illinois, BIPA’s influence doesn’t stop at the state line. Both Texas and Washington state are currently in the process of putting comprehensive biometric privacy regulations in place. California, Colorado, Connecticut, Utah and Virginia have also enacted biometric safeguards focused on protecting consumer data. In addition, municipalities including New York City and Portland have passed legislation regarding data-breach notifications specific to corporate and commercial entities, factoring in provisions that explicitly incorporate biometric data.
As more companies in the private sector begin to use this wide-ranging technology, a raft of legislation is likely to significantly hinder corporate practices. Although biometric data offers great potential, it also comes freighted with an inherent set of challenges and privacy pitfalls.
1 Kathleen M. O’Sullivan, for appellees, 2024 Best Lawyers “Lawyer of the Year” Honoree for Appellate Practice in Seattle | Michael A. Scodro, for amicus curiae Internet Association, 2024 Best Lawyers
Honoree for Appellate Practice in Chicago | Noah A. Finkel, for amicus curiae Illinois Chamber of Commerce, 2024 Best Lawyers Honoree for Employment Law – Management and Litigation – Labor and Employment in Chicago
2 Douglas M. Werman, for Plaintiff, 2024 Best Lawyers Honoree for Employment Law – Individuals in Chicago | Paul W. Sweeney, Jr., for Defendant 2024 Best Lawyers Honoree for Commercial Litigation in Los Angeles
3 Michael A. Scodro, 2024 Best Lawyers Honoree for Appellate Practice in Chicago, and Jed W. Glickstein, 2024 Best Lawyers: Ones to Watch® in America Honoree for Appellate Practice in Chicago, for the U.S. Chamber
