Keep up with today’s trending topics: VISIT THE INSIGHT CENTER

Risk Insight: Illinois Biometric Privacy Act

Property & Casualty

In 2008, the State of Illinois passed the Biometric Information Privacy Act (“BIPA”). Since passage in 2008, the BIPA has become one of the most litigated statutes through class action lawsuits.

Biometric Privacy Act Overview

BIPA sets standards surrounding the collection and dissemination of biometric information for private entities in the State of Illinois. This information is often collected by organizations to verify employee identities, save time or reduce fraud. Illinois private-sector companies that collect or use biometric information are required to comply with the standards set by BIPA and have internal policies and guidelines for handling and safeguarding sensitive information. Organizational policies and guidelines regarding data collection and storage must be made publicly available.

Biometric Information under the BIPA

Biometric Information under BIPA encompasses any personal biometric identifiers, including but not limited to:

  • Retina scans
  • Fingerprints
  • Facial scans
  • Voice recognition
  • Hand prints

BIPA & Insurance

As litigation under BIPA increases, some insurance carriers have begun to apply more strict underwriting practices and some exclusions have been added to Employment Practices policies. Most recently, the Illinois Supreme Court ruled that “Coverage B – Personal & Advertising Injury” within the General Liability policy may apply to claims.

West Bend Mut. Ins. Co. v. Krishna Schaumberg Tan, Inc. (2021 IL 125978, 183 N.E.3d 47)
A class action lawsuit was filed against Krishna, alleging that biometric information was disseminated without written consent. Krishna made a claim under a General Liability policy written by West Bend. While there was no Bodily Injury or Property Damage to trigger Coverage A, it was determined that Coverage B – Personal & Advertising Injury was triggered. The policy definition of Personal & Advertising Injury includes “Oral or written publication, in any manner, of material that violates a person’s right of privacy”.

What Illinois Businesses Can Do

While the Illinois Supreme Court has determined insurance coverage currently applies to BIPA situations, future changes in insurance policies or different jurisdictions could change coverage positions.

With BIPA statues becoming more common in states beyond Illinois, companies should contemplate these requirements regardless of the states they currently operate within. Like other risks, making sure that your organization is proactively identifying potential risks is a best defense. It is important to comply with state guidelines and requirements, while identifying risks and ensuring proper documentation of your processes and procedures.

Reach out to your M3 Account Executive if you have any additional questions.

Back to Insight Center