Biometric Privacy Jurisprudence: BIPA Statutory Damages, Accrual Rules, and Standing Post-TransUnion

1. The Rise of Biometric Privacy Liability

Biometric identifiers—such as retinal scans, facial geometry fingerprints, voiceprints, and palm scans—possess an immutable biological link to human identity. Unlike passwords, credit card numbers, or Social Security numbers, a compromised biometric identifier cannot be reissued, changed, or reset. Recognizing the existential risks of biometric surveillance and identity theft, the Illinois General Assembly enacted the Biometric Information Privacy Act (BIPA) (740 ILCS 14/1 et seq.) in 2008.

For more than a decade, BIPA remained relatively dormant. Today, however, BIPA has transformed into one of the most litigated and plaintiff-friendly privacy statutes in the United States, generating billions of dollars in aggregate corporate liability and reshaping enterprise biometric data collection nationwide.

2. Statutory Architecture of BIPA (740 ILCS 14/15)

BIPA imposes five affirmative statutory duties upon private entities operating in Illinois:

1. Section 15(a) Retention Schedules: Private entities in possession of biometric identifiers or information must develop a publicly available, written biometric retention schedule and guidelines for permanently destroying records when the initial purpose is satisfied or within three years of the individual's last interaction.
2. Section 15(b) Informed Written Consent: No entity may collect, capture, purchase, or obtain a person’s biometric identifier unless it first informs the subject in writing of the collection, states the specific purpose and duration, and receives a signed, written release.
3. Section 15(c) Prohibition on Commercial Profiteering: Strictly prohibits selling, leasing, trading, or otherwise profiting from biometric data under any circumstances.
4. Section 15(d) Disclosure Restrictions: Forbids disclosing biometric data without consent, except under valid judicial warrants or subpoenas.
5. Section 15(e) Standard of Care: Mandates storing biometric data using reasonable administrative and technical security standards that match or exceed the entity's general data protection practices.

3. Statutory Liquidated Damages & Landmark Accrual Precedents

BIPA’s explosive litigation impact stems from its robust private right of action under Section 20, which authorizes prevailing plaintiffs to recover statutory liquidated damages without proving actual economic injury:

• $1,000 for each negligent violation; or
• $5,000 for each reckless or intentional violation, plus reasonable attorney fees and costs.

In a series of watershed rulings, the Illinois Supreme Court eliminated virtually all procedural corporate defenses:

• Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186: Held that an individual is an “aggrieved person” entitled to sue under Section 20 based purely on a statutory procedural violation (e.g., failure to provide written consent), without demonstrating any independent tangible harm or identity theft.
• Tims v. Black Horse Carriers, Inc., 2023 IL 127801: Clarified that a five-year statute of limitations (under 735 ILCS 5/13-205) applies to all claims brought under Sections 15(a) through 15(e), rejecting the one-year defamation limitation.
• Cothron v. White Castle System, Inc., 2023 IL 128004: In its most economically devastating holding, the Illinois Supreme Court ruled that a separate BIPA claim accrues each and every time a biometric identifier is scanned or transmitted without statutory consent. For hourly employees scanning fingerprint timeclocks multiple times daily over years of employment, potential statutory exposure reached hundreds of millions of dollars per employer. In response, the Illinois legislature passed statutory amendments limiting recovery to a single violation per affected employee, though significant retroactive litigation remains pending.

4. Federal Article III Standing Post-TransUnion

While state courts in Illinois welcome procedural BIPA claims under Rosenbach, removing BIPA class actions to federal court introduces complex jurisdictional standing dynamics under Article III. In TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (2021), the United States Supreme Court held that statutory violations alone do not confer federal standing absent a concrete, real-world injury.

Federal Circuit courts have since bifurcated BIPA claims: claims alleging unlawful disclosure under Section 15(d) constitute a concrete invasion of privacy sufficient for Article III standing, whereas bare retention schedule claims under Section 15(a) frequently lack federal standing and are remanded to Illinois state courts, where they proceed unimpeded.

5. Institutional Biometric Compliance Architecture

Corporate counsel advising employers and technology platforms must immediately implement strict biometric compliance protocols:

• Deploy Pre-Capture Written Consents: Ensure physical and electronic biometric readers (e.g., warehouse fingerprint clocks, facial access turnstiles) are completely disabled until the worker or user executes an unambiguous, written biometric release.
• Publish Retention and Destruction Policies: Host formal, publicly accessible biometric policies on enterprise portals detailing exact destruction timelines.
• Audit Vendor Software Modules: Contractually require third-party SaaS vendors and security providers to indemnify the enterprise and certify compliance with BIPA and emerging state biometric statutes (e.g., Texas CBOI, Washington H.B. 1493).

Editorial & Jurisprudential Disclaimer: This publication is prepared strictly for educational, academic, and legal research purposes and does not constitute formal legal counsel. For specific legal representation or jurisdiction-specific advice, consult a licensed attorney admitted to practice before the competent bar.