Illinois has failed its residents in almost everything. But, one area where it gets an A+ is protecting its citizens’ biometric information by enacting the Biometric Information Privacy Act (or “BIPA”). Abe Lincoln would be proud.
BIPA is of importance to employees. Workers are sometimes asked for fingerprint/hand/retina scan (or other biometric) scans for things like punching in and punching out. Some employers are so concerned about wage theft (people punching others in and out) they have resorted to capturing biometric information. In our experience, the most common form of biometric utilization in the workforce is with fingerprint or hand scans.
An American Bar Association article reported in Employment Privacy: Is There Anything Left? that “Biometrics can also create the risk of identity theft on an unprecedented scale. It is easy to change a password or issue a new ID card, but we cannot give people new fingerprints. If a hacker gained access to the biometric database of a large employer that uses fingerprints, the identity theft harm is almost beyond imagination. Linking the records of biometric systems can create a record of a person’s location similar to GPS.”
Illinois’ BIPA law requires that employers get permission and have policies in place to protect biometric information such as fingerprinting. It requires informed consent and written policies. These are useful safeguards to at least minimize the risk of biometric abuses. Employees who work (or have worked) for an employer who violated BIPA can file a claim in court and recover between $1,000 and $5,000 per violation. Notably: nothing prevents employers in Illinois from capturing biometric information, they just must protect that information and make sure there is informed consent, etc.
There has been a push/lobbying by social media companies to limit the scope of BIPA because they have been sued for allegedly violating biometric laws. So far, they have been unsuccessful in changing the law.
It is critical that within the employment venue, the biometric laws remain strong. Employees need to work and should not be subjected to making a decision of having their biometric information placed at risk or not being able to feed their families.