As the overall use of biometric data increases, many states have begun to regulate the collection, storage, and disclosure of biometric data. The Illinois Biometric Information Privacy Act (BIPA) is one state law that successfully addresses these practices.

In 2008, the Illinois BIPA was signed into law, and it was designed to address the growing use of biometric identification technology: fingerprint or hand-print identification, retina scans, facial recognition technology, voice analysis or voice-prints, and various medical measurements.

Under BIPA in Illinois, businesses and employers must comply with specific notice and consent requirements before they collect, store, and use biometric data. Moreover, these businesses and employers must create public data retention policies and take proactive steps to protect and restrict the disclosure of biometric data.

BIPA provides individuals and employees a private right of action to file a lawsuit for the failure to provide notice of biometric data collection, failure to acquire employee consent of biometric data collection, improper collection of biometric data, improper storage of biometric data, and improper use of biometric data.  Additionally, it provides for statutory damages against an alleged BIPA violator.

“The BIPA requires private entities to inform persons in writing about the specific purposes and length of time for which their biometric information will be collected, used or stored. And no private entity may collect, use or store biometric information without first receiving a written release by the person whose biometric information is sought. The statute further requires a written schedule and guidelines for the retention and destruction of the biometric information to be made public. And the BIPA mandates consent and notice procedures that private entities must follow before disclosing someone’s biometric information to a third party.”

“Under the BIPA, Illinoisans have the right to sue private parties for violations of the act and to collect the greater of $1,000 or actual damages for each violation negligently committed, and the greater of $5,000 or actual damages for each violation recklessly or intentionally committed. Plaintiffs can also collect attorneys’ fees and costs under the BIPA.”

Biometric technologies are used to verify identity quickly and accurately by examining an individual’s physical characteristics, such as eyes, retinas, hand-prints, fingerprints, voice analysis, etc. Most people interact with biometric technologies several times a day: logging into your mobile phone, performing online banking, entering the workplace, or clocking in and out of work.

As biometric technologies have become more prevalent, private industries are utilizing biometrics to provide increased security, replace the need for traditional passwords, and enhance consumer experience. As biometric technologies become more common, they are being used in consumer banking, healthcare, hospitality, transportation, and a multitude of additional private employers. Typically, employers are integrating biometrics into the workplace to monitor employee activity, track employee activities, monitor work hours, and to collect employment information.

The most common types of biometric technologies used by employers: