If your company uses employee fingerprint or other biometric recognition technology in any portion of its business operations, then your company is subject to the requirements of the Illinois Biometric Information Privacy Act (“BIPA”). “Biometric information” means any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual. 740 ILCS 14/10. The main purpose of BIPA is to protect employees’ biometric information for improper retention and use.
Under BIPA, there are several, specific duties placed on company’s that collect, use and maintain their employees’ biometric identifiers and/or biometric information, such as, the duty to develop a written policy that is made available to the public regarding its retention and destruction of these biometric identifiers and biometric information; the duty to inform every individual, in writing before collecting any biometric identifier or information; the specific purpose and length of time for which the individual’s biometric identifier and/or biometric information is collected and/or stored; and the duty to receive a written release executed by each such individual consenting to the collection, use, storage, retention schedule of the individual’s biometric identifier and/or biometric information. See 740 ILCS 14/15.
The Illinois Appellate Court recently found in Mora v. J&M Plating, Inc., 2022 IL App (2 nd ) 210692, that companies must have a retention schedule and guidelines for permanent destruction of biometric information in place and publicly available at the time biometric information is first collected. Id., ¶39. The Mora decisions make it clear that any company that does not have a retention schedule and permanent destruction guidelines in place at the time they first collect any biometric information are in violation of BIPA. Id. As BIPA provides individuals with a private right of action against companies that violate BIPA, establishes statutory penalties, and provides for individuals to recover their attorneys fees from the companies found to have violated their BIPA obligations (740 ILCS 14/20), it more important than ever that companies doing business in Illinois plan to collect biometric information as part of their business operations first establish the policies, schedules, and guidelines required under BIPA.
Chitkowski Law Offices can work with you in drafting and publishing the policies, schedules, and guidelines necessary to ensure your company in compliance with all its BIPA obligations.
