Duane Morris Class Action Review - 2023 - Report - Page 244
CHAPTER 15
Privacy Class Actions
I.
Executive Summary
As biometric technology has become more advanced and more affordable over the past
two decades, businesses increasingly have utilized such technology for various
innovative and useful purposes, such as to enhance the accuracy of their timekeeping
systems, to facilitate consumer transactions, and to augment their security measures.
To protect the security of biometric data and to protect against the potential harm of
data theft involving sensitive biometric identifiers, states have taken steps to regulate
the collection, use, and storage of such data. In 2008, the Illinois legislature passed the
Biometric Information Privacy Act (BIPA). With this development, Illinois became the
first state to enact a law governing biometric data.
Although passed in 2008, class action lawsuits for alleged violations of BIPA first made
headlines in 2018. The number of such cases has more than quadrupled since that
time. Over the past three years, the plaintiffs’ class action bar has filed a surge of claims
for alleged biometric privacy violations. The plaintiffs’ class action bar has sought to
capitalize on ambiguous statutory provisions, coupled with slow-to-develop compliance
programs, to seize stiff statutory penalties and to leverage sizable settlements.
Adding to this minefield, various states are continuing to consider a series of proposed
copycat statutes that follow the lead of Illinois, and the federal government continues to
consider proposals for a national statute. These factors have transformed biometric
privacy compliance into a top priority for businesses nationwide and have promoted
information privacy class actions to the top of the list of litigation risks facing business
today. Against this backdrop, several key trends have emerged.
First, in terms of numbers, information privacy class actions have outpaced filings in
other areas of law in terms of growth. The Illinois BIPA, in particular, has prompted a
swell of lawsuit filings seeking to take advantage of the statute’s relative newness, lack
of clarity, and stiff statutory penalties. In terms of lawsuit filings, for nearly a decade
following enactment of the BIPA, activity under the statute was largely dormant, as
companies saw an average of approximately two total suits filed per year from 2008
through 2016. Those numbers grew exponentially in 2017 and 2018 and then spiked as
the plaintiffs’ class action bar filed a surge of class action lawsuits. In 2022, companies
saw more than five times as many class action lawsuit filings for alleged violations of
BIPA than they saw in 2018, and more than the number of class action lawsuit filings
that they saw from 2008 through 2018 combined. If other states succeed in enacting
similar statutes, businesses can expect similar surges in other states, as the filing
numbers in Illinois continue their upward trend.
243
© Duane Morris LLP 2023
Duane Morris Class Action Review – 2023
