Illinois’ Plan to Limit Privacy Violation Damages Opens New Door
Changes to Illinois’ Biometric Information Privacy Act are awaiting Gov. J.B. Pritzker’s (D) signature.
The legislation offers much-needed clarity for businesses but has raised questions about whether courts would apply the changes retroactively to past or ongoing lawsuits.
We believe that the legislative history of the measure provides judges with a powerful basis to limit excessive damages for defendants in both future and pending litigation.
Response to Ruling
The legislation, known as SB 2979, amends BIPA by defining “electronic signature” to expressly allow electronic consent and capping statutory damages on a per-person basis instead of a per-scan basis for violations involving the same individual.
If a company violates Section 15(b) or 15(d) of BIPA multiple times in the same way with respect to the same person, it will face a single instance of $1,000 or $5,000 statutory damages, not multiple penalties for each scan or disclosure.
SB 2979 is a direct response to the Illinois Supreme Court’s concerns in Cothron v. White Castle System. The court decided that each instance of a company collecting biometric data without consent counted as a separate violation and a separate damage award under BIPA.
Cothron opened the door to potentially astronomical damages for many companies, especially those using in biometric timekeeping that requires employees to scan their fingerprints multiple times each day. The court noted that White Castle’s potential damages could exceed $17 billion.
The court acknowledged that its ruling could create ruinous damages awards for some companies, but it declined to hold that such damages aren’t permitted under BIPA. Instead, it noted that courts have discretion to fashion damage awards that fairly compensate plaintiffs, without destroying a defendant’s business. It requested that “the legislature review these policy concerns and make clear its intent regarding the assessment of damages.”
n limiting statutory damages under BIPA to a per-person basis, SB 2979 reflects that it isn’t the legislature’s intent to authorize a damage award that would result in the financial disruption of a business. According to Rep. Ann Williams (D), the legislature sought to make BIPA awards “a little more reasonable, consistent with the request made by the Court in Cothron.”
Legislative Intent
SB 2979 faced pushback from some lawmakers and industry lobbyists because it doesn’t clearly state whether it applies retroactively. But the legislative history includes clear language suggesting judges should consider retroactive application in pending cases and even when deciding whether to reduce past awards under the statute.
Generally, if the Illinois legislature indicates the temporal reach of an amendment in the bill or through legislative history, courts must honor the intent in the absence of specific exceptions, which aren’t relevant here. SB 2979 doesn’t directly address retroactivity, but there are hints of legislative intent.
During a House floor debate on May 16, Rep. Daniel Didech (D) asked if the amendment applied retroactively to past or pending cases. Williams replied that it didn’t but noted that “a reviewing court could take judicial notice of our amendment to the Act in determining an initial award or in reducing an award.”
Other bill sponsors, including Sen. Bill Cunningham (D), stated that one of the reasons the legislature left out a specific retroactivity provision was to avoid pushback for potentially undoing previous judgments. However, Cunningham advised judges in pending lawsuits to note the legislature was answering the Illinois Supreme Court’s invitation for guidance about how liability should be accrued: on a per-person, not per-violation basis.
The lack of an explicit retroactive provision in SB 2979 may disappoint defendants in ongoing BIPA litigation. However, the bill offers multiple ways for judges to use their discretion to limit BIPA.
While defendants may be unable to argue that SB 2979 technically applies retroactively, they can argue that courts should take judicial notice of the bill and its legislative history, which show the legislature’s intent to limit BIPA damages to a single violation and to prevent ruinous damages for defendants.
Finally, if the statements by Williams and Cunningham blur the legislative intent, courts will decide whether the amendment is about procedures or actual rights. Usually, if a law only changes how things are done (a procedural amendment), it can apply retroactively. An amendment affecting a statute’s remedy provision is generally considered to be a procedural change and thus would support retroactive application.
Reproduced with permission. Published June 18, 2024. Copyright 2024 Bloomberg Industry Group 800-372-1033. For further use please visit https://www.bloombergindustry.com/copyright-and-usage-guidelines-copyright/.
Email this postTweet this postLike this postShare this post on LinkedIn
Print and share
Authors
Explore more in
Perkins on Privacy
Perkins on Privacy keeps you informed about the latest developments in privacy and data security law. Our insights are provided by Perkins Coie's Privacy & Security practice, recognized by Chambers as a leading firm in the field.