MIAMI -- Florida state lawmakers could soon decide the fate of a proposed new law, similar to a law on the books in Illinois, which has created substantial headaches for employers and other business owners, and a potential new revenue stream for trial lawyers.
Called the Biometric Information Privacy Act, the bill, now in the Florida State Senate, would ostensibly seek to safeguard fingerprints, retinal scans, facial geometry and other so-called biometric identifying information for Florida residents.
However, a virtually identical BIPA law in Illinois has largely proven to be a a good revenue producer for attorneys that have filed suits against companies that did not comply with the technical requirements of the statute, according to attorney Alfred J. Saikali, of the firm of Shook, Hardy & Bacon LLP, of Miami.
Alfred J. Saikali
| snb.com
The Florida bill was introduced by state Sen. Gary Farmer (D-Fort Lauderdale) and state Rep. Bobby DuBose (D-Fort Lauderdale.)
The Illinois bill was passed in 2008 and required customers and employees to give written authorization before companies can collect biometric markers from their customers, including fingerprints and facial recognition models.
Privacy groups have praised the law as the most stringest such law in the U.S., while business groups say the law raises red flags.
Companies that have been sued under the Illinois BIPA law include social media giants like Facebook, Google and Shutterfly; amusement park operator Six Flags; tanning salons and others with member loyalty programs; and swaths of employers who require employees to scan fingerprints when punching in and out of work shifts, to reduce employee "punch fraud."
In Illinois, the state's Supreme Court recently found a mother has the right to sue Six Flags because the theme park operator made her teenage son scan his fingerprint to use his season pass at a theme park in Chicago's suburbs, even though the fingerprint scan led to no concrete legal injury, such as identity theft. The decision has led a number of legal analysts to conclude the court has thrown open the doors to any number of similar lawsuits any time a business requires a customer or employee to scan a fingerprint or other biometric identifier to verify their identity.
Florida is home to numerous businesses which do so, including Disney, which processes millions of fingerprint scans at its theme parks each year.
In Illinois, businesses which run afoul of the technical requirements of the law could face fines of $1,000-$5,000 per violation. In the case of biometric time clocks, an individual "violation" could include each time an employee scans their finger to punch in or out of a shift. So, one employee could conceivably produce four violations per day, or more than 1,000 violations per year. A workplace with 100 employees could produce more than 100,000 violations per year - or statutory damages totaling more than $500 million for just one year of fingerprint scans.
Saikali said, besides the potential for crushing damages, there are two things wrong with the Illinois law.
‘’First, the bill isn’t based on a true understanding of the technology, which is actually very secure," he said. "The bill is based on a misunderstanding that these biometric devices store libraries of fingerprints that can be accessed, stolen, and misused. In fact, fingerprints are not stored long term in these devices and they are encrypted.
‘’Second, the private right of action is being abused by plaintiff’s lawyers to file class action lawsuits against hundreds of companies that are using biometric technology to check employees in and out of work."
Saikali said that Texas and Washington have laws with similar requirements, but they don’t allow individuals to sue. Rather, the action must be initiated by state regulators. New York is also considering a similar law, which would include the right to sue.
With what has already transpired in Illinois, Saikali said businesses or at least their counsel and advisors should be aware of the potential for similar problems in Florida from such a law, "because companies could be subject to millions of dollars in class action lawsuits, as we’re seeing in Illinois, for their use of biometrics in their timekeeping systems and other employee/customer authentication systems."
While Saikali is trying to raise awareness about the bill, he also says it is unlikely the bill will pass in Florida.
‘’I don’t think there’s a high likelihood of passage, at least not with a private right of action,’’ Sakali said. ‘’The Florida legislature is Republican, as is the governor. They’re not going to enact a law that creates a private right to sue and lines the pockets of their enemies in the plaintiffs' bar.’’