Handle biometric data under BIPA with clear, evidenced controls

BIPA is the Illinois Biometric Information Privacy Act, 740 ILCS 14, enacted in 2008. It controls how private entities collect, use, store, share and destroy biometric identifiers such as fingerprints, iris scans, voiceprints and hand or face geometry. It requires a public retention policy, informed written consent, limits on disclosure and reasonable security, and it lets individuals sue for violations.

Any private entity that collects, captures, possesses or discloses biometric identifiers or biometric information of people in Illinois must comply. That includes businesses based outside Illinois. Employers using fingerprint or facial recognition time clocks are the most common defendants, along with technology vendors. State and local government agencies are excluded from the definition of private entity.

Before collecting biometric data, Section 15(b) requires you to tell the person in writing that their biometric data is being collected or stored, tell them in writing the specific purpose and how long it will be collected, stored and used, and obtain a written release. Since the 2024 amendment, a written release can be given by electronic signature.

BIPA is enforced through private lawsuits rather than a regulator. Under Section 20, a person aggrieved by a violation can recover the greater of actual damages or liquidated damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation, plus reasonable attorneys' fees, costs and injunctive relief. The Illinois Supreme Court held in Rosenbach v. Six Flags that no actual harm needs to be shown.

Public Act 103-0769, effective 2 August 2024, made two main changes. Repeated collection or disclosure of the same biometric data from the same person using the same method now counts as a single violation, allowing at most one recovery, responding to Cothron v. White Castle. It also confirmed that an electronic signature satisfies the written release requirement.

Under Section 15(a), biometric data must be permanently destroyed when the initial purpose for collecting it has been satisfied or within 3 years of the individual's last interaction with the entity, whichever comes first. The entity must publish a written policy setting out its retention schedule and destruction guidelines, and follow it.

BIPA overlaps with GDPR, which treats biometric data used for identification as special category data, but BIPA is stricter on written consent and adds a private right of action. ISO 27001 does not satisfy BIPA on its own, but its security controls help meet the Section 15(e) duty to protect biometric data with a reasonable standard of care.

Yes. BIPA is supported in OneClickComply today. Its retention, consent, disclosure and security duties are mapped to controls you may already run for other frameworks, with policy generation, vendor tracking and continuous evidence collection. OneClickComply supports your programme but does not give legal advice, so consent wording should be reviewed by counsel.