BIPA Compliance: A Guide for Vehicle Dealerships to Mitigate Litigation Risks

In this era of technological innovation, the adoption of biometric data for various applications in the workplace has surged. From fingerprint scans for timekeeping to facial recognition for access control, biometric technology has become a key aspect of modern business operations. However, this integration has also raised privacy and security concerns, leading to legislative responses aimed at protecting individuals' biometric information. At the forefront of this is the Illinois Biometric Information Privacy Act (“BIPA”). 

Vehicle dealerships particularly have recently found themselves needing to navigate the complex terrain of adhering to the BIPA’s stringent requirements to avoid being targeted through lawsuits. There has been a recent noticeable uptick in class action lawsuits under the BIPA, serving as a critical wake-up call for the automotive retail industry, highlighting the need for dealerships to review and enhance their practices if they are using biometric technology. 

Class Action Suits Under the BIPA

BIPA class action lawsuits have targeted employers who use biometric systems to track workers’ paid hours or to control access to secured or sensitive areas in a workplace. An example of this can be seen in this class action lawsuit filed in September of 2023, in which a Chicago area car dealership was accused of violating the BIPA by requiring workers to access a secure vehicle key box at the dealership. Along with granting the employee access to a key, the system created audit trails to identify the employees, and the employees’ biometric information was enrolled and retained in the dealership’s database and cloud system. 

The suit noted that this could expose employees to serious and irreversible privacy risks due to the potential danger of the database being breached, and the employees having no means by which to prevent identity theft and unauthorized tracking. The Plaintiffs also allege that the Defendants violated the BIPA by not properly informing employees of the collection and storage, not providing a publicly available retention schedule and guidelines for the destruction of the fingerprint information, and not obtaining a written release from the employees authorizing the collection and storage of their biometric information. Another example of biometric system usage that could result in such a lawsuit is collecting and storing employee fingerprints for timekeeping purposes. 

How Dealers Can Protect Themselves 

The most effective way for a vehicle dealership to protect themselves is to ensure compliance by being aware of the following issues: 

What disclosures are being made? The BIPA requires a written notice explaining that biometric information will be collected, the purpose for doing so, and the length of time the information will be retained. Creating a clear company policy concerning the collection, use, retention, and security of biometric information will, if done properly and provided to employees, satisfy notice requirements and may also help ease some concerns from employees.

Is a written release being obtained? In addition to providing notice, a “written release” must be obtained prior to collecting and storing an individual’s biometric information to serve as written consent. 

Is there a written policy for retention and deletion? If a company collects or stores biometric data, then it must have a written policy for handling such data. This written policy must include a retention schedule and guidelines for permanently destroying the data when required. 

Enforcement 

The BIPA carries a private right of action for harmed individuals and includes statutory damages of $1,000 per negligent violation and $5,000 per intentional violation, or actual damages, whichever is greater. Additionally, successful plaintiffs may receive reasonable attorney’s fees and costs, and courts can issue an injunction to order the offending party to change their practices to comply with the Act’s requirements. 

Given these harsh penalties and the risk of non-compliance, dealers should contact legal counsel for advice on how to best navigate the BIPA. For further inquiries or questions, please contact attorney Sarah Reusche at sreusche@lavellelaw.com or (847) 705-7555.