A recent decision indicates that failure to comply with the
Illinois biometric privacy law may expose businesses to significant
liability, even where there has been no actual harm to the
plaintiffs.
Can a user of a cloud-based photo-sharing and storage service
sue the provider of that service for extracting and retaining,
without consent, the user’s facial scans from uploaded
photos—even without any subsequent breach or sale of that
data? How about an individual who is required to scan a fingerprint
in order to use a season pass at an amusement park, also without
any subsequent disclosure? In recent weeks, courts have given
conflicting answers to these and similar questions under the
Illinois Biometric Information Privacy Act (BIPA)1—the United
States’ toughest biometric privacy law. Specifically, the
courts have disagreed about whether or not plaintiffs need to
demonstrate actual harm, as opposed to a mere violation of the
statute, in order to seek relief.
