Biometric Privacy Trends In The United States

• Published date: 21 November 2022
• Subject Matter: Litigation, Mediation & Arbitration, Privacy, Privacy Protection, Class Actions, Trials & Appeals & Compensation
• Law Firm: Hughes Hubbard & Reed LLP
• Author: Mr Seth Rothman and Paul Marston

The United States is seeing a surge in litigation over biometric privacy rights. Most of this litigation is happening under state law, and state attorneys general and private litigants have been bringing lawsuits in record numbers. In particular, there has been an uptick in class action litigation filed under the Illinois Biometric Privacy Act (BIPA) (740 ILCS 14/1 et seq.).

In October 2022, the first BIPA case to go to trial concluded in a jury verdict awarding $228 million to a group of truck drivers who had sued BNSF Railway Co. (BNSF). When the truck drivers made deliveries or pickups at BNSF's facilities, their fingerprints were scanned for identification purposes. They successfully argued that this practice violated BIPA because BNSF failed to provide them with prior written notice or obtain their prior written consent.

BIPA authorizes private litigation to enforce its provisions. The Illinois Supreme Court has held that plaintiffs only need to show a violation of the statutory terms, and not that they suffered any actual harm. Rosenbach v. Six Flags Ent. Corp., 2019 IL 123186, ' 28 (129 N.E.3d 1197, 1205, 432 Ill. Dec. 654, 662). In the absence of actual harm, BIPA provides for liquidated damages of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation, as well as attorneys' fees and costs. 740 ILCS 14/20.

In practice, defendants typically settle class actions like the BNSF case rather than face a jury trial. BNSF's decision to go to trial was apparently influenced by the fact that a third-party service provider, and not BNSF itself, scanned the truck drivers' fingerprints. At trial, BNSF argued that it had not been negligent or reckless in retaining the service provider and that it could not be held vicariously liable for the service provider's actions because the service provider was an independent contractor.

The jury was not persuaded by BNSF's arguments. It found BNSF vicariously liable for 45,600 intentional or reckless violations of BIPA, equal to the estimated number of drivers whose fingerprints had been registered by an automatic gate system. The judge entered judgment for damages in the amount of $228 million (45,600 x $5,000).

Notably, the jury did not find that BNSF had violated BIPA each time a driver's fingerprints were scanned without written notice or consent, but only upon the initial scan and registration. There is another case currently sub judice before the Illinois Supreme Court that will...