Back in 2008, Illinois became the first state to pass legislation specifically protecting individuals’ biometric data. Following years of legal challenges, some of the major questions about the law are about to be resolved (hopefully). Two major legal challenges, one now at the Illinois Supreme Court and another with the Court of Appeals for the Ninth Circuit, seek to clarify the foundational issues that have been a battleground for privacy litigation — standing and injury. To understand the stakes, Illinois’ Biometric Information Privacy Act requires companies who obtain a person’s biometric information to: (1) obtain a written release prior to their information being stored and collected; (2) provide notice that their information is being stored and collected; (3) state how long the information will be stored and used; and (4) disclose the specific purpose for its storage and use. The law further provides individuals with a private right of action. However, in order to trigger that private right, an individual must be “aggrieved.” The precise meaning of “aggrieved” is in dispute and the outcome will have broad ramifications for the compliance response to Illinois’ law. Would an individual be “aggrieved” if a company failed to follow the notice requirements or would the individual have to suffer an actual harm? This is the crux of the issue presented to the Illinois Supreme Court. On the other end, the Ninth Circuit Court of Appeals is about to determine whether the collection of facial recognition (biometric) data is sufficient to provide standing for persons bringing suits based on the private causes of action found in the Illinois Biometric Information Privacy Act. If these decisions go a certain way, it will substantially increase the legal risk of many companies that currently hold and collect biometric information.
With the new year approaching, 2019 will be a transformative year for privacy in the United States. Between California’s pending privacy law, the push for a Federal Privacy Law, and the resolution of the above cases determining the scope of Illinois’ Biometrics law, we expect a major change in the amount of legal risk associated with the collection of personal information in the coming year.