A recent Illinois court case (Mora v. J&M Plating, Inc., No. 2-21-0692, 2022 IL App (2d) 210692 (Ill. App. Ct. 2d Dist. Nov. 30, 2022), establishes a timeline for when entities must publish written data retention and destruction policies and affirmed that retroactive adoption of retention and destruction schedules violates Illinois’ Biometric Information Privacy Act (BIPA) as retroactive policy creation prevents individuals from learning what will happen to their data before deciding whether to consent to biometric data collection, which is opposing to BIPA’s legislative intent.
The decision of the Court is that BIPA requires private entities to publish written data retention and destruction policies simultaneously or prior to collecting biometric data.
What is BIPA?
BIPA was enacted in 2008 to address the collection of biometric data by businesses. Under BIPA, “biometric information” is any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual, such as a fingerprint.
BIPA’s comprehensive set of rules for companies collecting biometric data of state residents has the following key features:
- Requires informed consent prior to collection (these policies must be made publicly available and can be added directly to an entity’s webpage or existing privacy policy);
- Permits a limited right to disclosure;
- Mandates protection obligations and retention guidelines;
- Prohibits profiting from biometric data;
- Creates a private right of action for individuals harmed by BIPA violations; and
- Provides statutory damages up to $1,000 for each negligent violation, and up to $5,000 for each intentional or reckless violation.
Next Steps for Employers
Employers should confirm whether they are capturing biometric data as defined under Illinois law, and, if so, will need to make certain that written policies are provided within the applicable timeframes before capturing or receiving biometric data belonging to Illinois residents.
Employers who find that they may have violated this case law should contact their legal counsel for additional guidance.
