By Illinois Radio Network

SPRINGFIELD – Other states are looking to copy Illinois’ Biometric Information Privacy Act, but an innovation expert warned about a potential pitfall of the state law.

Illinois’ law protecting biometric privacy – such as fingerprints and face shape – allows citizens to file a lawsuit, something unique to the state. Since Illinois’ Biometric Information Privacy Act was enacted in 2008, hundreds of lawsuits have been filed against companies large and small.

Illinois’ Biometric Information Privacy Act requires an entity to get express consent from a person before obtaining, storing, or using any of that person’s physical characteristics.

One prominent case was a class-action suit against Facebook. Facebook’s use of Illinois-based accounts’ facial data to suggest whether a person could be in other photos could cost the company at least $550 million.

A lawsuit against Amazon Web Services could cost the company billions of dollars for allegedly storing biometric data without their contracted companies getting permission to store that data. The risk for these companies is not only a $1,000 or $5,000 fine, but also court costs and damages.

“What makes the Illinois law unique is that one of its primary methods of enforcement is called private right of action,” said Jennifer Huddleston, director of technology and innovation policy at the American Action Forum.

Huddleston said other states should consider the potential downsides of empowering residents of their state the ability to sue for damages involving their biometric data.

One issue, she said, is that companies often work to avoid the potential liability by not offering certain services to customers in the state – something she referred to as innovation arbitrage.

“You have the possibility that these lawsuits and this threat of liability could deter innovation as a result of concern that anything that doesn’t clearly check all of those boxes is going to be subject to very expensive litigation,” she said.

Google-owned Nest, for instance, doesn’t offer Illinois residents a service where its cameras recognize a face, ask the owner if the face is familiar, and then tailor notifications as such in the future.

The American Tort Reform Association and the U.S. Chamber of Commerce’s legal arm have both criticized Illinois’ Biometric Information Privacy Act for creating a cottage industry of law firms that specialize in filing class-action suits alleging breaches of the law.

Others have praised the law as the “gold-standard” of biometric privacy protections, noting civil action should be included in any other similar law.

“Our biometrics are easy to capture. Once captured, we generally cannot change our biometrics, unlike our credit card numbers, or even our names,” Adam Schwartz with the Electronic Frontier Foundation said in 2019. “Databases of biometric information are ripe targets for data thieves. That’s why EFF strongly supports Illinois BIPA as a necessary means to protect our biometric privacy from intrusion by private entities.”

Some Illinois lawmakers have filed legislation that would have walked back some of Illinois’ Biometric Information Privacy Act protections, but it died in a committee in 2019.

Illinois Radio Network can be reached at [email protected].