The Illinois’ Biometric Information Protection Act (the Act) requires companies that collect biometric data, defined in the law to include physical identifiers such as DNA and fingerprints, to obtain written consent from the individuals and disclose how the collector will use and store the information.
The statute has spawned a number of class action lawsuits in the state. The most recent settlement, involving L.A. Tan Enterprise, Inc., required the company to put in place policies to bring its biometric data collection and storage practices into compliance with the Act, or destroy all non-compliant biometric data that it still held. The company will also pay out US$1.5 million. According to the complaint, the company used fingerprint scans to identify its members without getting proper consent or providing disclosures detailing how the company uses, stores and shares biometric data.