‘Legal minefield:’ Biometrics reforms needed to keep IL tech biz growing

By Jonathan Bilyk | Legal Newsline
The Center Square

For the past year, business leaders, attorneys and others in Illinois and beyond have watched to see how the courts and the state’s influential collective of trial lawyers would respond to the decision by the state’s Democratic legislative supermajority to at least appear to restrain the ability of those trial lawyers to use Illinois’ controversial biometrics privacy law to sock job-creating businesses with relatively easy, potentially business-destroying big-money lawsuits.

But even as they monitor new developments, the state’s business community – and particularly advocates speaking for big tech companies – are calling on state lawmakers to again reform the law, this time specifically to ensure Illinois doesn’t miss out on the new wave of artificial intelligence and tech infrastructure development that is redefining life and the economy in the 21st Century.

“We’re saying to Illinois legislators: Biometric and data infrastructure is going to be needed for AI,” said Kouri Marshall, a regional director of state and local government relations for the Chamber of Progress, a Virginia-based trade group that advocates for many of the country’s biggest tech companies.

“But the companies that are bringing that kind of essential development view Illinois as a legal minefield. And it deters companies from rolling out useful technology in Illinois.”

In the summer of 2024, Illinois state lawmakers took action to reform, for the first time, the controversial Biometric Information Privacy Act (BIPA), a state law that claims to protect Illinoisans’ rights to privacy over their so-called biometric identifiers.

Such biometrics are generally defined as unique physical or other innate traits that can be used to identify and verify individuals online or in the real world. These can include fingerprints, retinal scans, facial geometry, or even recordings of their voices.

The Illinois BIPA law wasn’t controversial when it was first enacted in 2008. However, it became so, beginning in about 2015, when a growing cadre of trial lawyers specializing in tech and privacy litigation began to use the law to demand potentially catastrophic damages from companies over seemingly technical violations of the law, without any real harm.

In the decade since, those lawsuits have flooded into courts in Chicago and elsewhere in the U.S., hitting thousands of companies with claims that collectively would be worth billions of dollars.

Through that time, the bulk of the BIPA lawsuits have targeted Illinois employers, typically accusing them of violating the law by scanning workers’ fingerprints and other biometrics when punching the clock or accessing secured or sensitive places in their workplaces, for instance. These lawsuits have faulted employers for failing to first obtain workers’ written consent before requiring the scans or for failing to provide notices concerning how the information might be stored, used, shared and ultimately destroyed.

Other BIPA class actions have also targeted big tech companies, such as Google or Meta, the parent of Facebook and Instagram. Those class actions secured massive settlements worth hundreds of millions of dollars.

The law’s bite primarily arose from two sources. First, the unique Illinois law gave plaintiffs the so-called right of private action, allowing them to sue businesses accused of violating the BIPA law and to demand steep payments of $1,000 or $5,000 per violation, depending on how malicious plaintiffs can prove defendants may have been in compelling the scans and collecting their biometric data.

Second, the Illinois Supreme Court delivered big wins to trial lawyers on how to interpret BIPA, reading the law broadly to both allow plaintiffs to sue without needing to show they were ever actually harmed, and to allow plaintiffs to multiply their damage claims, by demanding payment for each and every alleged illegal biometric scan.

When multiplied across entire workforces, for instance, with each worker scanning a fingerprint multiple times per day, damages could have quickly climbed up to the many millions or even billions of dollars, amounts that even the Illinois Supreme Court agreed could be “annihilative damages” for many businesses.

After years of turning a deaf ear to businesses’ calls for BIPA reform, Illinois Democrats moved to rein in those potential payouts, revising BIPA to explicitly limit plaintiffs to demanding $1,000 or $5,000 per alleged victim, rather than multiple claims per plaintiff or class member.

Trial lawyers in Illinois have long served as some of the most loyal and consistent campaign donors to Democratic state lawmakers, contributing millions of dollars per year. Those donations have also come from firms that have been specifically engaged in BIPA class actions.

To date, the reforms appear to have edged BIPA litigation down compared to the previous years, according to lawsuit tracking data supplied by the defense law firm of Duane Morris, which represents businesses targeted by BIPA class actions and similar litigation.

However, recently filed lawsuits have indicated trial lawyers may be shifting their strategy, moving from smaller targets – such as employers with a few dozen employees scanning their fingerprints when punching in and out of work shifts – to much larger companies with more employees, or which the lawyers may claim process massive amounts of biometric data.

And in Illinois, some of those new targets, business groups worry, may prove to be companies building and operating the “data centers” that are proliferating throughout the U.S. at breakneck speed.

Such data facilities form the backbone of the modern internet, powering the abilities of companies of all kinds and sizes to engage with customers and giving everyone the opportunity to create, view and share content around the globe.

And the demand for new data processing space has only continued to multiply amid the introduction and deployment of powerful new artificial intelligence programs, such as ChatGPT.

Those programs, however, have presented other challenges, including the need for massive amounts of new data processing power and capacity. To meet those needs, big tech companies, including Amazon and Meta, and developers specifically dedicated to building and operating the sites have ramped up their development of data centers throughout the country.

While some of the sites are dedicated to single big users, others operate as so-called “co-location” sites that serve the computing needs of multiple clients.

To this point, Chicago and Illinois have reaped big benefits of the AI revolution, as data development firms have been drawn to the region’s combination of relatively affordable land, electrical power supply, and abundant fresh water, used for cooling the stacks of servers and other power-hungry and heat-generating equipment.

Such data centers have been shown to generate large amounts of property tax revenue for communities in which they are built, as well as tens of thousands of construction jobs, in particular. They also generate a smaller number of permanent, high-tech jobs in those communities, industry advocates have noted.

Gov. JB Pritzker, in particular, has lauded the development of such data centers in Chicago, it suburbs and elsewhere in the state, trumpeting such projects as key to moving Illinois closer to realizing the governor’s goals of surging Illinois’ high tech growth and development.

To further those goals, the state has rolled out a series of tax incentives and other support geared at making locations in the Prairie State even more attractive to data center developers.

However, Marshall at the Chamber of Progress and others say they are warning Illinois lawmakers that such growth in Illinois could be slowed or even endangered – and Illinois could fall behind rival destinations – thanks to a perceived threat of massive lawsuits under BIPA, as it currently stands.

Specifically, the business advocates are calling on lawmakers to revise the law to explicitly exempt data centers from the law’s notice and consent requirements prior to data collection.

The industry argues their data centers don’t actually “collect” any data. Rather, they say the data centers essentially serve as infrastructure to support the data collection and storage activities of other companies.

Such lawsuits, however, are not just a conceptual threat.

AI developers have already been hit with privacy-related lawsuits in Illinois, California and elsewhere, accusing the companies of violating laws by using people’s photos and other data to train their artificial intelligences.

In Illinois, for instance, facial recognition tech company Clearview AI and partner vendors have been at the center of litigation under BIPA for using a database of photos scraped from sites on the internet. The company and its vendors have paid tens of millions of dollars to settle those claims.

However, BIPA lawsuits targeting data centers could dwarf those claims, the industry has claimed. And that would stand out as an example of the unintended consequences of a law that needs further refinement, Marshall said.

While lawmakers may have had good intentions when enacting laws like BIPA, Marshall said those who “aren’t as deeply mired in tech policies” can push through legislation that can do more harm to their economy than it protects residents from the perceived harms.

“Other states have seen how BIPA in Illinois hasn’t gone the way they (lawmakers) probably thought it was going to go,” Marshall said.

Gerald Maatman, a high profile defense lawyer with the firm of Duane Morris, said the threat of such BIPA litigation is mounting against the kinds of companies that build and operate data centers.

“While I do not know if decisions about investment or locating business operations in Ilinois are directly attributable to the BIPA, the fact remains that a majority of BIPA class action litigation is targeting companies operating high-tech websites and AI-fueled software,” Maatman said, in an emailed answer to questions from The Record and Legal Newsline.

“So, at the very least, it is a data point for investors and companies considering whether to locate in (or even do business in) Illinois.”

Marshall said, to this point, Illinois lawmakers have not been dismissive of the concerns raised by the Chamber of Progress and others.

Published reports have noted those calls for reforms have been bolstered by an alliance with politically influential labor unions, as well, whose members could benefit from the job-creating projects.

However, Marshall said all involved recognize the work of further reforming the BIPA law could be an uphill climb in Springfield.

“We know that it’s hard to fix a law once you pass it,” Marshall said. “Even if it’s a bad bill.”