Biometric Privacy: It’s Not Just an Illinois Issue

How BIPA Litigation May Impact Companies Outside of Illinois

Blue fingerprint that's reflective with black background

Molly K. McGinley and Kenn Brotman

October 1, 2020 08:00 AM

Is it true that what happens in Illinois, stays in Illinois? Not so, at least when it comes to litigation under the Biometric Information Privacy Act (“BIPA”). In 2008, the Illinois General Assembly enacted “BIPA”, which provides a private right of action to individuals whose biometric data is collected by private entities that don’t comply with the informed consent, retention policies, and security mandates imposed under the law. Under BIPA, plaintiffs may seek statutory damages of $1,000 or $5,000 per violation, depending on whether the conduct is negligent or intentional or reckless, respectively. Fast forward a little more than a decade, and the number of putative class action lawsuits asserting BIPA claims approaches one thousand and cases are settling for millions of dollars (and even hundreds of millions of dollars). Businesses both inside and outside of Illinois should be paying attention. Why? Because there is litigation risk, not only for Illinois companies but also those beyond the borders of the Prairie State. As of the publication date, at least 29 BIPA lawsuits have proceeded in jurisdictions outside of Illinois.

Under Illinois law, a statute is without extraterritorial effect unless a clear intent appears from its express provisions. Nothing in the legislative history of BIPA suggests it was intended to apply outside the state. Despite the lack of intent by the Illinois General Assembly, plaintiffs throughout the country have filed class actions seeking certification of broad classes of individuals, regardless of where alleged BIPA violations have occurred, where the named defendants are located or where the alleged information has allegedly been collected or otherwise obtained.

In Monroy v. Shutterfly, a case filed in the Northern District of Illinois, the plaintiff claimed that someone in Chicago uploaded his photograph onto Shutterfly’s website. He alleged Shutterfly then used facial recognition software to scan the photo and create a detailed template of his face. Shutterfly moved to dismiss the case, asserting that the plaintiff’s lawsuit was an improper attempt to apply BIPA extraterritorially. Although the photo was uploaded from a device in Illinois, Monroy was a citizen and resident of Florida, and Shutterfly is a Delaware corporation headquartered in California. Nevertheless, the court held that these factors alone were insufficient to determine whether BIPA applies extraterritorially. It denied the motion to dismiss but allowed Shutterfly to raise the issue again if and when the facts revealed where the scan was collected and stored, and whether the claim can be said to have occurred primarily and substantially within Illinois. Thus, the case proceeded through fact discovery. Another judge in the Northern District of Illinois very recently reached the same conclusion in Vance, et al. v. Int’l Bus. Machines Corp.

In Neals v. PAR Technology Corp., another Northern District of Illinois case, the defendant filed a motion to dismiss arguing that the extraterritoriality doctrine barred the plaintiff’s claims because the relevant circumstances occurred outside of Illinois due to the fact that the defendant is located outside of Illinois. While granting the motion to dismiss, the court noted that the defendant’s physical location and the location of its servers were not determinative of BIPA’s application. However, because the plaintiff did not allege that she scanned her finger while in Illinois, the court could not determine that her fingerprint was collected in Illinois. Had she done so, then she would have alleged sufficient facts indicating that the circumstances relating to the purported transaction occurred primarily and substantially in Illinois; the transaction would involve an Illinois resident having her biometric information collected in Illinois by a private entity without the entity providing the requisite disclosure and obtaining the required consent in Illinois. Id. at 1091.

The Ninth Circuit Court of Appeals applied a similar analysis in Facebookv. Patel, stating:

[T]he parties’ dispute regarding extraterritoriality requires a decision as to where the essential elements of a BIPA violation take place . . . . Given the General Assembly’s finding that ‘[m]ajor national corporations have selected the City of Chicago and other locations in this State as pilot testing sites for new applications of biometric-facilitated financial transactions,’ . . . it is reasonable to infer that the General Assembly contemplated BIPA’s application to individuals who are located in Illinois, even if some relevant activities occur outside the state. . . If the violation of BIPA occurred when the plaintiffs used Facebook in Illinois, then the relevant events occurred ‘primarily and substantially’ in Illinois. . . . If the violation of BIPA occurred when Facebook’s servers created a face template, the district court can determine whether Illinois’s extraterritoriality doctrine precludes the application of BIPA.

Thus, while there seems to be little doubt that the location of the user is a major factor in determining whether BIPA would apply, the Ninth Circuit held it is not the only factor.

Going a step further, plaintiffs have been filing putative class action suits asserting BIPA claims outside of Illinois, while also asserting nationwide class claims for unjust enrichment and other non-Illinois state law theories, relying on BIPA violations to establish unlawful conduct by the defendant. For example, numerous lawsuits have been brought against Clearview AI in other states, including California, Illinois, New York, and Vermont. Clearview AI is a Delaware corporation with headquarters in New York. The company collects images on the internet and organizes them into a searchable database, which licensed users can comb through. Clearview AI hosts its data on servers located in New York and New Jersey. In one case filed in the Southern District of New York on May 4, 2020, residents of New York, California, and Illinois filed a putative class action complaint against Clearview AI on behalf of a nationwide class and separate sub-classes of residents of Illinois, California, and New York. In addition to a BIPA claim, the plaintiffs also brought claims under California Business and Professional Code Section 17200, California Common Law Right of Publicity, and California Constitutional Right to Privacy. The plaintiffs also alleged common law claims for intentional interference with contractual relations and unjust enrichment, using claimed BIPA violations as one of the predicates to assert that the defendant engaged in unlawful conduct.

Finally, other states, and even cities, have enacted legislation and ordinances similar to BIPA. Specifically, there are laws in Texas, Washington, California, New York, and Oregon that include informed consent and destruction requirements for biometric data. The city of Portland, Oregon, recently passed an ordinance prohibiting both city and private use of facial recognition technology. In addition, on August 4, 2020, Senators Jeff Merkley and Bernie Sanders proposed a federal bill—the National Biometric Information Privacy Act—which is modeled upon BIPA, including both a written consent requirement and a private right of action. With these significant developments, biometric privacy is no longer an Illinois-specific issue. Any businesses collecting, storing, or using biometric data should review relevant laws to avoid the substantial risks associated with biometric litigation.

Molly K. McGinley concentrates her practice at K&L Gates LLP in commercial litigation with a focus on complex litigation, including investment company litigation, securities litigation, and class action defense. Ms. McGinley is a leader of the firm’s biometric data compliance and defense affinity group and has advised several clients with respect to putative class action litigation and compliance under the Illinois Biometric Information Privacy Act.

Kenn Brotman focuses his practice at K&L Gates LLP on complex commercial litigation, including breach of warranty, breach of contract, and breach of fiduciary duty matters, as well as product liability, premises liability, general tort liability, and toxic tort. He is a member of the firm’s biometric data compliance and defense affinity group and has advised clients with respect to litigation and compliance under the Illinois Biometric Information Privacy Act.

Headline Image: ISTOCK.COM / DEM10

Related Articles

Evolving Marijuana Laws and the Workplace

by Tess P. Anglin

How can employers enforce statutes that differ from state to state?

Red image of a marijuana leaf

What Do Your Clients Want, Anyway?

by Emilia Levisay

Law Firm Strategies to Best Serve Clients.

Sticky notes on black chalk board that says quality, cost, and efficiency

Supreme Court Decision Will Play Important Role in Shaping Defendant Privacy Rights

by Gus Kostopoulos

The primary question will likely come down to whether or not cell phone data and location records are protected interests under the Fourth Amendment.

Defendant Privacy Rights

Recent Developments on Privacy and Data Protection in Brazil

by Ricardo Barretto Ferreira da Silva and Camila Taliberti Ribeiro da Silva

A change of paradigm is urgent and requires a robust legislation on personal data protection.

Privacy and Data Protection Brazil

Trending Articles

The Best Lawyers in Spain™ 2023

by Best Lawyers

Announcing Spain's recognized lawyers for 2023.

Flag of Spain

Announcing the 2023 The Best Lawyers in America Honorees

by Best Lawyers

Only the top 5.3% of all practicing lawyers in the U.S. were selected by their peers for inclusion in the 29th edition of The Best Lawyers in America®.

Gold strings and dots connecting to form US map

The Best Lawyers in Chile™ 2023

by Best Lawyers

The results include an elite field of top lawyers and firms in Chile.

White star in blue box beside white box with red box on bottom

The Best Lawyers in South Africa™ 2023

by Best Lawyers

Best Lawyers proudly announces lawyers recognized in South Africa for 2023.

South African flag

The 2023 Best Lawyers in Portugal™

by Best Lawyers

Announcing the elite group of lawyers recognized in Portugal for 2023.

Green and red Portuguese flag

Announcing The Best Lawyers in Peru™ 2023

by Best Lawyers

Honoring our awarded lawyers for 2023 in Peru.

Red and white stripes with green leaf symbol

The Best Lawyers in Spain™ 2022

by Best Lawyers

The results include an elite field of top lawyers and firms.

The Best Lawyers in Spain™ 2022

Best Lawyers: Ones to Watch in America for 2023

by Best Lawyers

The third edition of Best Lawyers: Ones to Watch in America™ highlights the legal talent of lawyers who have been in practice less than 10 years.

Three arrows made of lines and dots on blue background

Thirteen Years of Excellence

by Best Lawyers

For the 13th consecutive year, “Best Law Firms” has awarded the most elite and talented law firms across the country through a thorough and trusted data review process.

Red, white and blue pipes and writing on black background

Famous Songs Unprotected by Copyright Could Mean Royalties for Some

by Michael B. Fein

A guide to navigating copyright claims on famous songs.

Can I Sing "Happy Birthday" in Public?


Rewriting 𝙃𝙀𝙍𝙨𝙩𝙤𝙧𝙮 One Verdict at a Time

by Justin Smulison

Athea Trial Lawyers was formed only a year ago by several prestigious lawyers seeking justice for their clients, and together they are making history.

Six female lawyers sitting in office

Announcing the 2022 Best Lawyers® in the United States

by Best Lawyers

The results include an elite field of top lawyers listed in the 28th Edition of The Best Lawyers in America® and in the 2nd Edition of Best Lawyers: Ones to Watch in America for 2022.

2022 Best Lawyers Listings for United States

Announcing the 2023 The Best Lawyers in Canada Honorees

by Best Lawyers

The Best Lawyers in Canada™ is entering its 17th edition for 2023. We highlight the elite lawyers awarded this year.

Red map of Canada with white lines and dots

What the Courts Say About Recording in the Classroom

by Christina Henagen Peer and Peter Zawadski

Students and parents are increasingly asking to use audio devices to record what's being said in the classroom. But is it legal? A recent ruling offer gives the answer to a question confusing parents and administrators alike.

Is It Legal for Students to Record Teachers?

Strength in Numbers: When Partnering Up May Be Best in Whistleblower Litigation

by Justin Smulison

Whistleblower claims make headlines when they result in multimillion-dollar settlements. But the journey to the courtroom is characterized by complexity and requires time and resources. Bienert Katzman Littrell Williams partner and The Best Lawyers in America awardee Michael R. Williams discusses when and why partnerships between counsel will strengthen whistleblower litigation.

A Blue Person in the Middle of White People

Announcing the 2022 "Best Law Firms" Rankings

by Best Lawyers

The 2022 “Best Law Firms” publication includes all “Law Firm of the Year” recipients, national and metro Tier 1 ranked firms and editorial from thought leaders in the legal industry.

The 2022 Best Law Firms Awards