For years, Illinois courts have been flooded with countless class action lawsuits concerning the Illinois Biometric Information Privacy Act (BIPA). Though the law was passed more than 15 years ago, the cases continue to swell judge’s dockets, especially because of employers’ continued requirement for employees to use fingerprint scans and facial recognition for purposes of signing in and out of work. In this article, Brian Ledebuhr—a litigation shareholder at Vedder Price’s headquarters in Chicago—provides guidance as to the nuances of BIPA and concerns with respect to insurance coverage for class action BIPA cases.
Understanding BIPA with Brian Ledebuhr
While BIPA currently applies in Illinois, the law sets a precedent for other states to follow in connection with biometric data. Brian Ledebuhr, a seasoned litigation attorney based in Chicago, delineates the key provisions of BIPA, which has reshaped the landscape for businesses dealing with personal identifiers:
- Mandatory Disclosure Practices: BIPA mandates companies to publicly disclose the objective, type and duration of the collection, maintenance, and destruction of biometric data.
- Consent Imperatives: BIPA requires companies to obtain an individual’s informed written consent before collecting or processing biometric information.
- Rigorous Data Security Standards: Unlike privacy laws in other states, BIPA enforces these strict protocols for the collection, safekeeping, and eventual destruction of biometric data by allowing a private right of action. In other words, while other states may allow the state’s attorney general to bring a lawsuit or otherwise impose fines, BIPA allows individual citizens to file suit on behalf of a class of similarly situated individuals.
The Escalation of BIPA Litigation
With his extensive litigation experience at Vedder Price, Brian Ledebuhr has observed a continued flow of BIPA litigation. This is attributable to several key factors:
- Potency of Class Action Lawsuits: As noted above, BIPA uniquely allows individuals to initiate class action lawsuits against companies allegedly in violation of the statute. This provision has led to a surge in litigation, with companies facing substantial financial liabilities for non-compliance.
- Structured Statutory Damages: BIPA specifies damages of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation. These statutory damages serve as a substantial liability for businesses in the event of a breach.
- Proliferation of Biometric Technology: The increasing incorporation of biometric technology across various sectors has expanded the potential scope for BIPA. As businesses increasingly turn to biometric solutions for efficiency and security, the BIPA-related risks also escalate.
Proactive Compliance with BIPA
Brian Ledebuhr has a comprehensive understanding of BIPA and regularly advises businesses as to the nuances in the statute and developments in related class action cases. Additionally, Brian Ledebuhr can help corporate clients conduct thorough audits of their biometric data handling practices. These audits can help identify potential areas of non-compliance and enable businesses to proactively take corrective measures and efficiently mitigate risk. In other words, with knowledgeable legal counsel, companies can quickly develop effective compliance strategies.
Insurance Coverage for BIPA Claims
As BIPA lawsuits show no sign of slowing down, Vedder Price shareholder Brian Ledebuhr explains the complex terrain of insurance coverage for BIPA-related claims:
Commercial General Liability (CGL) Insurance
- CGL insurance policies regularly include coverage for “personal and advertising injury,” but with exclusions to coverage for statutory violations. Illinois state and federal courts have frequently held that, so long as there are no express exclusions to coverage, BIPA claims are covered under a CGL policy because “a violation of BIPA is a violation of privacy” within the “personal and advertising injury coverage.” However, considering these court decisions finding in favor of CGL coverage, insurance carriers have since revised their policies to specifically state that BIPA claims are excluded from coverage.
Cyber Liability (Cyber) Insurance
- While other types of insurance policies are often form-based, cyber insurance policies can be customer-specific. As such, cyber insurance may also be an avenue for coverage of BIPA claims, depending on the policy's terms. For example, the use of an individual’s biometric information may fall within a policy's definition of "confidential information." However, the degree of coverage is contingent on the specifics of each policy. Therefore, because cyber policies are not standardized, policyholders should consult with legal counsel—particularly during the renewal period—and consider whether the policy language includes coverage for claims involving BIPA litigation.
Employment Practices Liability (EPL) Insurance
- EPL insurance policies may offer coverage for BIPA claims involving allegations regarding biometric data belonging to employees, but these policies often exclude claims related to customer or client data. As for all insurance policies, it is critical to understand these distinctions and identify potential gaps in coverage. Attorneys like Brian Ledebuhr at Vedder Price can assist companies with this analysis.
Insurance Policy Optimization
For businesses to carefully assess their potential exposure to BIPA claims, they must work closely with their legal counsel, insurance brokers and insurance carriers to customize policies that specifically address BIPA-related exposures. This customization ensures that businesses are adequately protected against the substantial financial implications of BIPA litigation.
Leveraging Legal Experience
It is critical for business to engage with legal professionals—especially those like attorney Brian Ledebuhr—who have significant experience in privacy law, BIPA compliance and insurance coverage. These attorneys can provide invaluable guidance on compliance strategies and legal defense in the event of litigation.
In an era where biometric technology is rapidly advancing to become an integral component to business operations, it is essential for companies to work collaboratively with their attorneys, to stay appropriately informed of legal developments and prepared for potential litigation. The insights from Brian Ledebuhr, a shareholder at Vedder Price in Chicago, highlight the complex interplay between BIPA litigation and insurance coverage. For businesses who may be collecting or processing biometric data, it is imperative to seek specialized legal counsel who can help clients develop proactive compliance measures and conduct comprehensive insurance policy reviews.
