Why BIPA Litigation Could Be A Death Knell To Cannabis Cos.
By Amy Rubenstein and Sarah Trevino (November 23, 2022)
Since 2021, Illinois courts have approved al most $1 billion in settlements
for Biometric Information Privacy Act cl aims.
In 2008, the Illinois General Assembly ad opted BIPA in response to
increased commercial use of biometric d ata.[1] Biometric identifiers are
biologically unique and include fingerprints, voiceprints, retina or iris
scans, and face geometry.[2]
Between 2008 and 2017, about 40 cases wer e filed for alleged BIPA
violations. But in the last five years, ov er 250 cases were filed for alleged
BIPA violations — approximately a 525% in crease.
This exponential spike in cases includ e consumer and employee class
actions alleging that businesses ran afoul of BIPA while engaging in their
lawful daily operations.
Many businesses must protect consum ers and employees by using
personal identifiers to enter or exit facilities , access computer systems,
operate registers, or open cases.
For the relatively nascent legal cannabis indu stry in Illinois, risky and
expensive BIPA litigation could be a fatal blow.
The Clash Between BIPA and the Cannab is Industry
The cannabis industry has placed a strong emphasis on security for grow facilities and
dispensaries.
These enhanced security measures ar e a must to protect employees handli ng largely cash
transactions and customers purchasing a h eavily regulated product.
But, in taking these reasonable security m easures, the cannabis industry has opened itself
up to litigation surrounding BIPA's string ent requirements.
BIPA regulates how private entities may c ollect and handle biometric data and pro vides a
private cause of action for any person agg rieved by a violation of the statute.[3]
Section 15(b) of BIPA prohibits a private entity from collecting, capturing, pu rchasing,
receiving through trade, or otherwise obtai ning a person's biometric data without first
providing notice to and receiving consent f rom the person.[4] Section 15(d ) prohibits a
private entity from disclosing, redisclosin g or otherwise disseminating biometric data
without consent.[5]
A plaintiff can recover the greater of actu al damages or statutory damages of $1,000 for
each negligent violation and $5,000 for each reckless or willful violation, as well a s attorney
fees.[6]
But BIPA does not evaluate or balance th e benefits created by enhanced secu rity or that
Amy Rubenstein
Sarah Trevino
