In 2008, the State of Illinois enacted the Biometric Information Privacy Act, 740 ILCS 14 et seq. (“BIPA”). Illinois was one of the first states to enact a law to address and regulate business’s collection of biometric data (Biometrics are unique physical characteristics, such as fingerprints, that can be used for automated recognition.) The use of biometric data in business is now widespread and common, which includes such uses as time management, security access, safety, and wellness programs.

Once upon a time, it was reasonably simple to figure out the potential penalties for a criminal offense. In South Carolina, for example, if you were convicted of kidnapping, you would be looking at up to 30 years in prison. S.C. Code § 16-3-910. Possession with intent to distribute crack cocaine? Up to 15 years for a first offense. S.C. Code § 44-53-375(b)(1). Stealing a car? Up to 10 years depending on the value of the car. S.C. Code §§ 16-13-30, -420.

It is increasingly common for companies to collect biometric information from their employees and customers. Employers are replacing keycards and physical timesheets, with fingerprint and retina scans. Social media companies harvest facial data through photo-labeling to enhance the user experience and generate more revenue. While companies’ use of biometric identifiers can enhance security and revenue, its use requires companies to at least temporarily collect and store biometric information.