$228M Judgment in BIPA Class Action a ‘Wakeup Call’: Ogletree Deakins

One significant issue “unanswered” in the recent $228 million judgment in the first jury verdict issued in an Illinois Biometric Privacy Act class action (see 2210190003) was “what constitutes biometric data” under BIPA, Ogletree Deakins said in an analysis Monday. The case involved a defendant that collected, used and stored actual fingerprint images to identify drivers, the law firm said. BIPA explicitly includes fingerprints “in the definition of protected biometric identifiers,” so the case did not address systems that encrypt or convert stored fingerprints “into a mathematical representation or string of numbers,” it said. “This technology question remains an important, viable defense” in pending and future BIPA cases, it said. The verdict nevertheless was “a wakeup call” for private entities that collect, use or store biometric data “as it demonstrates the potential exposure for failing to follow the statute’s consent requirements,” it said. The jury’s finding that the company’s conduct was intentional or reckless “may be subject to review depending on the evidence elicited at trial,” said the law firm. “A reversal of that finding to reduce the company’s conduct to negligent may reduce the penalty assessed to $1,000 per incident or $45.6 million,” it said. That’s still “an incredibly hefty, but less jaw-dropping sum,” it said.