IL biometrics privacy reforms apply to past cases, too: Appeals court

By Jonathan Bilyk | Legal Newsline
The Center Square

Pending class action lawsuits under Illinois’ stringent biometrics privacy law may have become significantly less lucrative, after a federal appeals court declared reforms enacted to limit financial payouts under the law don’t just apply to the lawsuits filed since the reforms took effect a little less than two years ago.

On April 1, a three-judge panel of the U.S. Seventh Circuit Court of Appeals sided with railroad Union Pacific and other businesses on the hotly debated question, with potentially hundreds of millions or even billions of dollars collectively at stake.

In the ruling, the Seventh Circuit judges said they believed the reforms were “procedural” in nature, and not “substantive.” Therefore, under prior, consistent rulings from the Illinois Supreme Court, the appeals court said, the reforms must also be considered “remedial” in nature, and therefore, retroactive, even if lawmakers didn’t include language specifically saying so.

Essentially, the judges said, the reforms did not alter how lawsuits can be filed under the law, or for which causes. Rather, lawmakers intended the reforms to only apply to limit the potential financial damages the plaintiffs can demand and prevent the law from being misused to demand payouts that could destroy businesses.

The decision was authored by Seventh Circuit Judge Michael Brennan. Judges David Hamilton and Candace Jackson-Akiwumi concurrred.

“… The amendment did not alter when ‘a cause of action … has arisen,’ nor did it change ‘the rights, duties, and obligations of persons to one another’ —the hallmarks of substantive changes,” Brennan wrote in the opinion. “It simply cabined the recovery available against defendants who violate the Act.”

The decision comes as potentially a final answer on one of the hottest questions surrounding Illinois’ unique and controversial Biometric Information Privacy Act (BIPA).

Since 2015, the BIPA law has spawned thousands of class action lawsuits against employers and businesses operating in Illinois or serving customers in Illinois over alleged violations of Illinoisans’ biometric privacy rights.

Some of the lawsuits famously targeted tech giants, including Meta, the parent company of Facebook and Instagram, and Google, among others, resulting in headline-grabbing settlements worth hundreds of millions of dollars.

The overwhelming bulk of BIPA litigation, though, has landed on employers in Illinois, who have been routinely accused of wrongly scanning workers’ fingerprints, faces, voices and other biometric characteristics, without first obtaining written consent or providing notices about how that information might be stored, used, shared and destroyed, among other technical provisions in the law.

The law, to this point, however, has largely allowed trial lawyers to rake in hundreds of millions of dollars in fees paid by businesses targeted by the lawsuits, without ever having to prove any of their clients were actually harmed.

To coerce compliance, the law gave plaintiffs the so-called right of private action – meaning they can file suit without permission from the state. And those sued under the law can face steep potentially payment demands of $1,000-$5,000 per violation.

However, under a series of decisions offering a broad interpretation of the law, the Illinois Supreme Court empowered trial lawyers to use the BIPA statute as a club against targeted defendants, to secure relatively quick and easy big-money settlements, often worth millions of dollars.

Most recently, the Illinois Supreme Court ruled the BIPA law should be interpreted to allow plaintiffs to claim the $1,000-$5,000 damage award for each and every scan of their biometrics, not just the first one. They further ruled those claims should have a five-year statute of limitations.

Justices on the state high court warned these rulings put Illinois businesses at risk of financial ruin and placed the economy of the state at risk. Those justices joined with business advocates calling on Illinois lawmakers to bring balance to the law and rein in the potentially ruinous burdens of the law, as interpreted by the state high court.

In 2024, after years of ignoring pleas for relief from the business community, Illinois Democratic lawmakers enacted BIPA reforms, which made clear that the law should be read to count “individual violations” as once per person, not per biometric scan. Thus, BIPA plaintiffs should be limited to demand $1,000-$5,000 each, not multiplied across potentially hundreds or even thousands of potential biometric scans per person over five years.

However, those reforms included no specific guidance on which lawsuits should be governed by the changes limiting potential payouts.

All parties agreed the law should apply to lawsuits filed after the law was changed. However, trial lawyers and the businesses they targeted differed on whether the change should be interpreted to also apply retroactively, to lawsuits still pending in court at the time the law was changed.

The potential reward disparity was great enough to produce a surge in BIPA filings during the months between the Illinois General Assembly’s approval of the reform bill and Gov. JB Pritzker’s signing of the legislation, making the reforms law.

In the months since, that argument has played out in court. Three federal judges have ruled on the question, siding with trial lawyers in determining the reforms should not be considered retroactive.

On appeal, however, the Seventh Circuit said those judges were wrong.

Some observers had expected the Seventh Circuit to punt the question to the Illinois Supreme Court, to let that court answer definitively.

Brennan and his colleagues on the panel, however, said they believed the state high court has been consistent enough in its rulings on retroactivity for the federal appeals court to answer the question themselves, now.

In the ruling, the Seventh Circuit judges noted the reforms applied only to the damages provisions in the BIPA law, in a section known as Section 20. The reforms did not apply to a separate provision, Section 15, which trial lawyers use to bring their class actions.

So, Brennan and the panel said, the reforms serve only to “cabin” how much plaintiffs can demand, but doesn’t limit their ability to sue, meaning it doesn’t affect the viability of their lawsuits, only how much plaintiffs might be able to secure in a settlement or judgment.

They further noted the Illinois Supreme Court has made clear judges are not obligated to award the damages allowed under the statute, and could even choose to award nothing at all.

“If courts have discretion to decide whether to award damages at all, then plaintiffs were not guaranteed any specific recovery in the first place. So this amendment, which limits them to ‘at most, one recovery,’ did not alter any substantive rights or the number of injuries they sustained. It simply changed the statutory award of damages available to plaintiffs, cabining the discretion of trial court judges when they fashion the remedy,” Brennan wrote.

“The best reading of BIPA Section 20 is that it covers only remedies.”

“… We hold that this amendment applies retroactively because it impacts only the statutory damages available to plaintiffs — it does not change BIPA’s substantive standards of liability,” Brennan wrote.

Brennan and his colleagues remanded the cases to the lower courts with instructions to “ensure they (judges) follow the latest guidance of the legislature when calculating damages under BIPA Section 20.”

The ruling was welcomed by Illinois business advocates, including Mark Denzler, president and CEO of the Illinois Manufacturers Association.

Denzler is among the leaders of an Illinois coalition that has pushed for years for reforms of the BIPA law.

But Denzler said he business leaders believe there are still more changes needed for the BIPA law, particularly those aimed at ensuring the law does not hinder Illinois’ growth as a tech business hub. Tech sector business advocates have urged reforms specifically to ensure trial lawyers can’t use the BIPA law to aim potentially massive class actions at the operators of data centers, which industry sources say don’t actually have any control over the collection of biometric data.

“Illinois’ punitive BIPA law has taken hundreds of millions of dollars out of the economy despite the fact that no harm has been alleged or no loss of biometric information,” Denzler said. “We appreciate the Court’s ruling that makes the 2024 reform retroactive, but there is more work to do including fixing the issues that are hampering the development of data centers in Illinois, which are key to a future tech economy.”

Editor’s note: This story has been revised from an earlier version to now include comments from Mark Denzler, of the Illinois Manufacturers’ Association.