Two bills threatening to weaken the nation’s strongest biometric information privacy law will get a hearing on Tuesday in the Illinois House Judiciary – Civil Committee. The proposals, House Bill 559 and House Bill 560, effectively gut the meaning and enforcement of the Biometric Information Privacy Act (BIPA), adopted unanimously by both legislative chambers a little more than a decade ago. The effort to reverse the law comes after court decisions in recent years that have held large companies like Six Flags and Facebook accountable for collecting and using the biometric information of Illinois residents.
“BIPA has worked to protect the biometric information – like face prints and fingerprints – of Illinois residents,” said Sapna Khatri, advocacy and policy counsel for the ACLU of Illinois. “This information is incredibly sensitive because it can never be changed. At a time when other cities and states are moving to ban dangerous biometric technology like facial recognition, this is not the time to reverse course on these important privacy guidelines we have in place in Illinois. Indeed, these guidelines are seen as a model for other states. The Committee should stop these measures in their tracks.”
BIPA is straightforward. It simply requires a company to inform someone in writing when biometric data is being collected or stored. And BIPA requires written consent in order for the company to collect, store of use the data. Because the law allows an individual to bring a legal claim against any company that violates the provisions of BIPA, it has been used in recent years to win judgments for violations against Six Flags, Facebook and other companies.
Together, the two House measures would undo all of these protections. The bills redefine what is biometric information so that some of our most intimate, private data is no longer covered. The measures also eliminate any protections for employees, allowing companies to collect and store their information without meaningful information or consent. And the bills end the ability to bring cases in court against violators, leaving the enforcement to government agencies that are not positioned to punish violations – including the massive ones we have seen in recent years.
“This is dream legislation for companies that exist to collect and monetize our information,” added the ACLU’s Khatri. “It removes any meaningful requirement to comply with BIPA. The message is clear – if you cannot comply with the law, just use the legislature to remove the requirement.”
“Our privacy in Illinois should not be treated in such a cavalier fashion.”
The two bills are expected to come up for consideration at a Committee Hearing that begins at 3:00 p.m. on Tuesday, March 9. The hearing will be held virtually in Virtual Room 3 of the Illinois House.
