Protecting your purchasers from the attain of Illinois’ BIPA laws

This article was produced in partnership with Tokio Marine HCC – Cyber & Professional Lines Group.

Desmond Devoy, of Insurance Business America, sat down with Neha Gupta, Director, Cyber & Tech E&O underwriter, to debate Illinois’ Biometric Information Privacy Act (BIPA) and its influence on insurance coverage.

An organization doesn’t must be headquartered in Illinois to be impacted by the state’s Biometric Information Privacy Act (BIPA).

Similar laws exists in different states, however Illinois was the primary state to enact laws defending privateness rights to biometric info in 2008.

In quick, BIPA seeks to “protect an individual’s privacy rights to their biometric information,” mentioned Neha Gupta, director, cyber & know-how E&O underwriter for the southeast area at Tokio Marine HCC – Cyber & Professional Lines Group (CPLG), a member of the Tokio Marine HCC group of firms based mostly in Houston, Texas.

But what’s biometric info? It could possibly be a fingerprint, a voiceprint, a facial scan, an iris or retinal scan, DNA, or a palm print. Basically it’s “any biological information or characteristic that can uniquely identify a person, but does not include personally identifiable information,” Gupta mentioned.

Identifiable info can embody your drivers’ licence or social safety quantity, as an illustration.

The letter of the regulation, and what’s anticipated

This regulation defines parameters for personal firms that accumulate and retailer biometric info. The regulation states that an organization has to tell the particular person in writing of what knowledge is being collected or saved. The particular person should additionally be told, in writing, of the particular objective and size of time for which the information will probably be collected, saved and used. Without consent, biometric info might not be launched to 3rd events.

The attain of Illinois’ BIPA extends past firms headquartered within the state.  It is designed to guard residents of the state, and the regulation applies to any firm doing enterprise in Illinois or transacting enterprise with a buyer who could also be a resident of Illinois.

“They are all subject to the same statute,” Gupta mentioned. “As an underwriter, we consider all of these scenarios when reviewing how the statute may apply to an applicant seeking cyber insurance.”  

She gave the instance of a vendor to an Illinois-based firm who provides machines that collects biometric info. “Even though the vendor does not transact with an Illinois resident directly, they may be subject to the statute since they operate in the state of Illinois, so it can have a trickle effect,” Gupta mentioned.

Common cases of accumulating biometric info from workers embody time administration knowledge, particularly, punching out and in of labor. It also can come from safety entry, resembling fingerprints, facial recognition, and hand scanners used on the workplace or on the manufacturing unit flooring to safe laptops, or keyboards, or to achieve bodily entry to buildings. Additionally, some well being plans “measure your biometric data…to assess your health risk and provide incentives for changing behaviors that could lower risks,” mentioned Gupta.

A latest ruling by the Illinois Supreme Court modified the way in which damages are calculated in BIPA claims and prolonged the statute of limitations for such claims from one to 5 years. Instead of damages accruing the primary time biometric knowledge is collected from a person they now accrue every time knowledge is collected from that particular person. “So, you could be entering an office, say, 10 times, or accessing a cash register 50 times each day. Each of those will now count individually as damages” says Gupta.

Each BIPA violation may end up in damages from $1,000 per negligent violation to as a lot as $5,000 for intentional or reckless violations. Attorney’s charges and different prices of defending a BIPA lawsuit are along with these harm quantities.

The impacts of lawsuits on BIPA compliance

Already, buyer lawsuits have resulted in some excessive greenback verdicts and settlements.

According to the National Law Review, a $228 million judgment in opposition to BNSF Railway was recorded this previous October within the first ever BIPA trial. The jury in that case discovered that BNSF violated Illinois’ BIPA by scanning truck drivers’ fingerprints for determine verification when visiting BNSF rail yards to choose up and drop off hundreds.

“The jury found that BNSF recklessly or intentionally violated the law 45,600 times when it collected such fingerprint scans without written, informed permission or notice,” reported the Review.

“With the increase in BIPA lawsuits and settlements, insurers are adding BIPA exclusions onto their policies. Exclusions, sub-limits, or other restrictions have already been underway for some time in other lines of insurance such as general liability and employment practices liability. The cyber market is now reacting to the BIPA changes with its own restrictions.”

According to Gupta “the possibilities for facial recognition are only going to grow and biometric privacy is going to be a hot issue for years to come as the technology becomes more reliable and widespread”. “Companies are going to find new ways to monetize this type of data,” Gupta mentioned. But as they do, they will even have to hold a detailed eye on rising developments in biometric privateness legal guidelines. Tokio Marine HCC – Cyber & Professional Lines Group is repeatedly monitoring the regulatory and legislative panorama to make sure protection and phrases stay related.