Blog

The Biometric Information Privacy Act (BIPA) establishes safeguards and procedures relating to the retention, collection, disclosure, and destruction of biometric data. 740 ILCS 14/15. Passed in October 2008, BIPA is intended to protect a person’s unique biological traits – the data encompassed in a person’s fingerprint, voice print, retinal scan, or facial geometry. Id. But in the last few years, BIPA – with its statutory penalties of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation – has quickly become the bane of corporate defendants. The situation became even worse after the Illinois Supreme Court’s Rosenbach decision. Rosenbach v. Six Flags Entm't Corp., 2019 IL 123186. In Rosenbach, the Court held that a “violation [of the statute], in itself, is sufficient to support the individual’s or customer’s statutory cause of action.” Id. at ¶33 (emphasis added). In other words, a bare statutory violation confers standing on a BIPA plaintiff. See id.

The Supreme Court’s ruling has, predictably, spurred additional litigation asserting bare violations of the statute. By last count, more than 100 lawsuits had been filed in the few months following the January 2019 decision, with almost all of the lawsuits brought as class actions. The lack of standing had been a key argument for defendants facing BIPA lawsuits. With that argument now foreclosed, a constitutional challenge could be the next best avenue for defeating a BIPA class action.

A constitutional challenge is not for the faint of heart. All statutes are presumed to be constitutional, which means that a party challenging the constitutionality of a statute has the burden of rebutting the presumption of validity and clearly establishing a constitutional violation. Big Sky Excavating, Inc. v. Illinois Bell Tel. Co., 217 Ill. 2d 221, 234 (2005). This burden is naturally a heavy one. S. 51 Dev. Corp. v. Vega, 335 Ill. App. 3d 542, 550 (1st Dist. 2002). If it is reasonably possible to do so, Illinois courts have “a duty to uphold the constitutionality of a statute . . . .” Big Sky Excavating, 217 Ill. 2d at 234.

The constitutional challenge to BIPA rests on its damages provision. BIPA establishes a $1,000 statutory penalty for each negligent “violation.” 740 ILCS 14/20. Plaintiffs argue that each time an employee scans his or her fingerprint into a biometric punch-clock that scan represents a violation of BIPA. An employer with 50 employees who are fingerprinted four times a day (one to clock in, one for lunch-out, one for lunch-in, and one to clock out) counts 200 violations a day and 1,000 violations in a five-day work week. That employer’s potential statutory liability could be $50 million over a fifty-week period. This seems so severe and oppressive that it could violate substantive due process.

Damages under a state statute violate due process if they are “so severe and oppressive as to be wholly disproportioned to the offense and obviously unreasonable.” St. Louis, I. M. & S. Ry. Co. v. Williams, 251 U.S. 63, 67 (1919). Unfortunately, this argument has not been successful at the Illinois Supreme Court. See In re Marriage of Miller, 879 N.E.2d 292 (Ill. 2007) (interpreting the Income Withholding for Support Act). In Miller, the plaintiff sued her ex-husband’s employer for failing to withhold his wages after he failed to pay child support. The statutory penalty was up to $100 per day for an employer’s violation, and in Miller, the employer racked up more than $1.1 million in statutory penalties. The Illinois Court of Appeals found that the Act violated the Due Process Clause based on the severe penalty, but the Illinois Supreme Court reversed, holding that the Act did not violate substantive due process as applied. There is federal case law on the other side of Miller. See Stillmock v. Weis Markets, Inc., 385 F. App'x 267, 278 (4th Cir. 2010) (Wilkinson, C.J., concurring) (“[C]ourts have noted that the potential for a devastatingly large damages award, out of all reasonable proportion to the actual harm suffered by members of the plaintiff class, may raise due process issues.”).

This federal law may come to the attention of World Wide Technology, which recently filed a Notice of its intent to challenge the constitutionality of BIPA “because the liquidated statutory damages potentially available under the BIPA are grossly excessive and disproportionate in light of” the actual harm to plaintiffs. Young v. World Wide Technology, LLC, No. 3:19-CV-496 SMY-GCS (S.D. Ill. June 21, 2019) (Doc. 11). Any constitutional challenge will certainly find its way back to the Illinois Supreme Court. But after Rosenbach v. Six Flags, corporate defendants will be hoping for a smoother ride.