The BIPA Private Right Of Action
One feature separates the Illinois Biometric Information Privacy Act from every comparable state statute. An individual can sue directly. Section 20 of the Act gives any person aggrieved by a violation a right of action. That action runs in a state circuit court, or as a supplemental claim in federal district court. BIPA is the reason biometric timeclocks became a litigation category.
What the Act requires before anything else
Section 15 carries the duties, and reading it closely is worth more than memorising case names. A private entity holding biometric identifiers must publish a written retention and destruction policy. Destruction follows once the collection purpose is satisfied. It follows in any event within three years of the individual’s last interaction, whichever comes first.
Three steps come before collection. Tell the subject in writing that collection is happening. Tell them in writing the specific purpose and length of term. Obtain a written release. Section 15(c) bars selling or otherwise profiting from the data. Section 15(d) restricts disclosure to four narrow situations, consent among them.
What counts as a biometric identifier
The definition is narrower than candidates expect. A biometric identifier under BIPA means four things. A retina or iris scan, a fingerprint, a voiceprint, or a scan of hand or face geometry. Writing samples, signatures, photographs, demographic data, tattoo descriptions and physical descriptions all fall outside it. Information collected from a patient in a health care setting sits outside too. So does material regulated under the Genetic Information Privacy Act.
Private entity excludes state and local government agencies, and excludes Illinois courts, clerks and judges. That carve-out explains why the defendants tend to be employers and their technology vendors.
Why the BIPA private right of action bites
Section 20 sets liquidated damages of $1,000 for a negligent violation. An intentional or reckless one costs $5,000. Actual damages replace those figures where they run higher. Reasonable attorneys’ fees, costs and injunctive relief come on top.
The word doing the heavy lifting is aggrieved. On 25 January 2019 the Supreme Court of Illinois settled its meaning in Rosenbach, 2019 IL 123186. A teenager had been fingerprinted for a season pass at a theme park. The court held that an individual need not allege actual injury beyond a violation of their rights under the Act. That reversed an appellate ruling requiring some injury beyond a technical violation.
A statutory violation is therefore the injury. That single holding turned BIPA from a compliance obligation into a class action engine.
What changed in August 2024
Public Act 103-769 took effect on 2 August 2024 and amended Section 20 without touching Section 15. Two new subsections cap recovery.
Take Section 20(b). An entity collecting the same biometric identifier from the same person more than once, using the same method, commits a single violation of Section 15(b). The aggrieved person is entitled to at most one recovery. Section 20(c) does the same for repeated disclosures. Two extra conditions apply: the disclosures must reach the same recipient, using the same method.
The change hiding in the definitions
Section 10 also carries the 2024 public act as its source. Written release now expressly includes an electronic signature. BIPA defines that term as an electronic sound, symbol or process attached to a record and adopted by a person intending to sign it.
Read the two changes together and the shape becomes clear. Illinois narrowed the remedy and made compliance easier to document. The duties themselves survived intact, which is why the BIPA private right of action still reaches every unconsented collection.
BIPA in the CIPP/US exam
The Body of Knowledge is the IAPP’s published outline of what each certification exam tests. Biometric regulation sits in Domain V, state privacy laws, which carries the second heaviest weighting on the exam.
Three distinctions earn marks. Separate the duty from the remedy, because the 2024 amendment moved one and left the other. Keep the negligent standard at $1,000 apart from the intentional or reckless standard at $5,000. Then hold BIPA apart from state biometric laws with no private right of action, since the enforcement route is the usual axis of a comparison question. Our piece on the FCRA adverse action sequence reaches the same employment setting from a different direction.
The state-law domain rarely costs marks through ignorance. It costs them through blur between nine statutes. The CIPP/US Exam Question Masterclass at €195 works on the discrimination habit that solves it.
