In August, the Illinois legislature amended the Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (“BIPA”) to clarify that an entity that improperly obtains biometric information from a person more than once through the same method of collection has only committed one violation of the law per individual. One court in the Northern District of Illinois recently interpreted the amendment to apply retroactively: in other words, even if a lawsuit was filed before the amendment, the amendment controls how many violations a defendant (allegedly) committed. But another court in the same district has now said that the amendment does not apply retroactively, which means that claims filed prior to the changes may proceed under the previous, more expansive damages theory. The current split means that BIPA defendants are not yet out of the woods, because damages could be calculated based on the number of times “biometric information” was improperly handled.
Background
Section 15 of BIPA mandates that private entities cannot collect or disclose “a customer’s biometric identifier or biometric information” without informed consent, or sell, lease or trade such information under any circumstances. BIPA includes a private right of action that permits “aggrieved” plaintiffs to seek liquidated damages of $1,000 or actual damages for negligent violations, and liquidated damages of $5,000 or actual damages for intentional or reckless violations—whichever is greater. Before the Legislature’s recent amendment, the Seventh Circuit interpreted BIPA in Cothron v. White Castle to impose liability on a “per-scan” basis: each time an entity improperly obtained or disclosed a single individual’s biometric information would be an independent violation subject to a separate damages calculation.
The Amendments
Post-Cothorn, BIPA defendants faced enormous liability under the “per-scan” theory. Responding to the Seventh Circuit’s invitation to “review the[] policy concerns” related to this theory “and make clear its intent regarding the assessment of damages under the [BIPA],” Illinois’ legislature added a section to the statute that significantly curtailed the amount of damages available to plaintiffs. Under the new language, repeat violations using the same method of collection for the same person qualify as a single violation, and plaintiffs are entitled to “at most, one recovery.” This limits plaintiffs’ standing to bring BIPA cases in federal court or certify classes due to the resulting decreased amount in controversy.
The Split Interpretation
On November 13th, District Judge Elaine Bucklo held that the BIPA amendments “clarified” the legislature’s intent, and as a result, the amendments “must be applied as if [they] were clear from the date of the BIPA’s enactment.” Gregg v. Cent. Transp., No. 24 CV 1925, at *3 (N.D. Ill. Nov. 13, 2024). The Court explained that an invitation for the Legislature to clarify by amendment “would make little sense if… Cothron left no room for clarification by the legislature”—i.e., if the amendment were made only to prevent gigantic settlements in the future, rather than to clarify meaning already present, but obscure, in the original statute. Accordingly, she found plaintiff could recover one liquidated damages award under section 15(b), one under 15(d) and one under 15(a), totaling a maximum recovery of $15,000. She then granted the defendant’s motion to dismiss due to the plaintiff’s inability to recover more than the $75,000 required for diversity jurisdiction.
The following week, District Judge Georgia Alexakis came to the opposite conclusion. She concluded that “[b]ecause the amendment to [BIPA] is substantive, and the Illinois legislature did not expressly make it retroactive, Illinois law compels that the amendment be applied prospectively, not retroactively.” Schwartz v. Supply Network, Inc., No. 23 CV 14319, at *12 (N.D. Ill. Nov. 22, 2024). According to the court, there is a presumption that amendments are “intended to change, not clarify” the law, and that the presumption is overcome when the enacting body “declare[s] that it was clarifying a prior enactment.” Because the legislature could have explicitly stated in the text that the amendment was a clarification, and did not, the amendment qualifies as a change. As a result, the amendment limiting liquidated damages only applies prospectively, post-amendment, giving plaintiffs who filed pre-amendment more leeway.
Conclusion
Until weight of authority emerges—or a reviewing court weighs in on the question—a stalemate remains on applicable damages in BIPA litigation. Accordingly, defendants in any BIPA litigation that commenced before the August 2024 amendments remain in uncertain territory, not only in terms of potential damages, but also as to whether their cases may proceed in federal court at all. And unless or until the Gregg court’s theory of amendment prevails, businesses face extremely high exposure for BIPA violations. Entities that collect and use biometric identifiers or information like face scans, fingerprints, or voice prints should continue to carefully review their notice, collection, and disclosure practices in connection with the law’s requirements.
