Katrina Carroll was featured and recognized as authority in Law360’s article, “Breaking Down Illinois’ Biometric Privacy Litigation.” The text of the article is reprinted below.
Biometric privacy litigation was already steady in Illinois when the state high court established a low threshold for plaintiffs to bring suit, creating a boom of cases that puts both small businesses and deep-pocketed tech giants on the defensive without a clear out.
A steady drumbeat of cases hit the Illinois courts in recent years alleging violations of the Illinois Biometric Information Privacy Act, many targeting employers that required workers to scan fingerprints to clock in and out. But the BIPA landscape changed when the Illinois Supreme Court in 2019 addressed the threshold issue of who can be considered an “aggrieved person” able to sue under BIPA, concluding a violation of the statute’s requirements is enough without an allegation of a separate real-world harm.
That took the wind out of the sails of defense attorneys who hoped a lack of harm could be the key to winnowing BIPA cases. But it’s an argument that has gotten traction in federal court, where some judges have thrown out BIPA cases when plaintiffs don’t meet federal standing requirements despite the Rosenbach v. Six Flags decision.
BIPA cases continue to roll in, some advancing novel theories of liability, like one alleging IBM Corp. performed facial scanning on images uploaded to Flickr without notifying or getting consent from the subjects of those photos. Most litigation is in the early stages, and the defense bar says it hasn’t yet gotten to test major defenses like whether a company was negligent or whether the technology at issue actually captures biometric information.
Here, Law360 breaks down the landscape of BIPA litigation in Illinois today.
BIPA Targets Go Beyond Employers
Lawsuits alleging biometric privacy violations have largely arisen in the employment context, with companies facing claims over the fingerprint scanners they typically use in their businesses for time-keeping and security purposes, said Mary Smigielski, a partner and co-chair of Lewis Brisbois Bisgaard & Smith LLP’s BIPA practice group.
What Smigielski expects to see going forward is additional lawsuits against manufacturers of those devices, she said.
Amazon and Google were also hit with BIPA suits in Illinois state court last year over voice recordings made by their devices equipped with virtual assistants, Alexa and Google Assistant.
Facial recognition will be the “new frontier” in BIPA litigation, Lynch Carpenter LLP partner Katrina Carroll told Law360. Carroll said millions of people are uploading pictures to social media without expecting those images to be harvested by third parties and scanned for biometric data without their permission.
Carroll is one of the attorneys representing Chicago-area photographer Tim Janecyk, who alleges photographs he posted to Flickr appear in IBM’s “diversity in faces” dataset, which it made available to researchers in 2019. He claims the resulting unique face template was used by IBM to recognize his gender, age and race, and was disseminated to third parties, even though he never gave the company permission — written or otherwise – to use his biometric information.
Another lawsuit filed in February accuses a controversial facial recognition technology company of using of billions of facial data points “scraped” from images posted to platforms such as Facebook, Instagram and Twitter. Uploading a photograph to the database allows users to identify private citizens and gives them access to all the personal details Clearview AI has obtained, according to the lawsuit.
“The technology is more prevalent. We’re learning that so many more companies are using facial recognition,” Carroll said. “It’s scary. People’s privacy is being threatened on a daily basis. The potential for misuse is so great.”
Early BIPA Rulings Make Ending Cases Hard
So far, decisions in BIPA cases have not been particularly favorable to the defense, Smigielski said. Courts have largely rejected arguments for a shorter statute of limitations, constitutional arguments, and defenses raising the question of an exemption under Illinois’ workers’ compensation law, she said.
But in McDonald v. Symphony Bronzeville Park LLC, an Illinois state court judge in December granted the defendant’s bid to immediately appeal a ruling that the Illinois Workers Compensation Act doesn’t preempt a BIPA claim. That will be a case worth watching, because many of the workers filing these suits are complaining of some emotional distress and injuries, Nixon Peabody LLP partner John Ruskusky said.
Also unanswered is the question of whether a bare procedural violation is enough to keep a BIPA lawsuit in federal court. Judges have been split on the issue, which is teed up before the Seventh Circuit, with some finding plaintiffs don’t have federal standing without an allegation that private data could be disseminated.
In August, the Ninth Circuit rejected argument from Facebook that users who claim the company’s face scanning practices violate BIPA had failed to assert the type of concrete injury necessary to establish Article III standing. Facebook paid $550 million to compensate millions of Illinois users who claimed the company breached the law by using facial recognition without their consent to fuel its feature that suggests tags for photos.
The Ninth Circuit ruling dealt a blow to defendants that argue that BIPA’s requirements are merely procedural and don’t protect any substantive rights that would produce the concrete harm necessary for standing.
But the issue hasn’t been resolved, and there remains a disconnect between how state courts and federal courts are looking at these cases, Carroll said. She fears cases could be tied up in the wrong forum for years.
“We need to reconcile this standing issue so we can all move on with our lives,” Carroll said. “If we can only sue in state court, we need to know that.”
Meanwhile, Ruskusky said two of the major defenses have yet to be tested at all. One of those defenses is what it means under BIPA for a defendant to be negligent or reckless for damages purposes. The other involves getting into the specifics of what the technology at issue in these cases actually does — a lot of these devices don’t actually capture a fingerprint, but some other assortment of data, Ruskusky said.
“Does something less than a fingerprint count, and if so, what is biometric information?” Ruskusky said.
Smigielski agreed, saying discovery disputes will likely result in plaintiffs having to do more than use the words “biometric identifier” and set a more defined basis for why the technology falls under BIPA.
“Say you have the technology to protect the nuclear codes, versus something you buy off Amazon. One very well may not fall under the law, but they’re treated exactly the same,” she said. “Some machines the plaintiffs are alleging are face scanners, they take a picture. That is something excluded under BIPA. A photograph is excluded, a facial scan is included.”
No Signs of BIPA Fights Slowing Down
Right now, attorneys should be watching closely to see how the law continues to develop as defendants advance more arguments and courts move through motions to dismiss these cases, said Tom Ahlering, co-chair of Seyfarth Shaw LLP’s biometric compliance and litigation group.
“It’s kind of been a little bit of a slow start waiting for Rosenbach,” Ahlering said. “I think the tide will turn a little bit as defendants assert some more of these arguments.”
The litigation will evolve as technology does, so attorneys should keep up with the landscape and come up with creative solutions as these cases advance to discovery, Smigielski said.
Carroll, meanwhile, maintains that in the employment space, more companies are trying to comply with the law. She thinks claims over facial recognition software will be the more unfamiliar territory going forward.
Ahlering predicts BIPA might follow a similar track as the Telephone Consumer Protection Act as the case law becomes more voluminous.
“When the TCPA was first enacted, it was a straightforward law that seemed really simple and basic,” he said. “Years later, we know every little word and definition of the statute.”
And after Rosenbach, defendants “haven’t thrown in the towel,” Ahlering said.
“They’ll keep advancing new arguments and strategies,” he said.