Seventh Circuit limits BIPA damages to one recovery per employee

BIPA requires private entities to obtain informed written consent before collecting biometric data such as fingerprints or hand geometry. When employers skip that step – often through biometric time clocks or facility access scanners – they expose themselves to statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless one. The Cothron decision made things worse for employers by holding that a new claim accrues every single time an employee scans a fingerprint. That turned routine workplace timekeeping into a potential financial catastrophe. One of the plaintiffs in this case, a commercial truck driver named Reginald Clay, alleged that Union Pacific Railroad collected his fingerprints roughly 1,500 times. If found liable for intentional violations, that could have netted him $7.5 million alone. Another plaintiff filed a putative class action that carried a risk running into the billions.

The Illinois Supreme Court saw this coming. In Cothron, the court acknowledged the risk of what it described as potentially annihilative liability and invited the legislature to step in and clarify how damages should be assessed. The General Assembly responded in August 2024 with an amendment to BIPA Section 20 providing that repeated collection of the same biometric data from the same person using the same method counts as a single violation, entitling the aggrieved person to at most one recovery.

The catch was that the amendment said nothing about whether it applied to lawsuits already in progress. Three federal district courts said it did not. The Seventh Circuit disagreed.

Chief Judge Brennan, writing for a unanimous panel that included Judges Hamilton and Jackson-Akiwumi, applied Illinois’s established retroactivity framework. Under that framework, the key question is whether a statutory change is substantive or procedural. Illinois law treats remedial changes – those affecting the damages available rather than the underlying rights and obligations – as procedural. Procedural changes apply to pending cases.

The court found the BIPA amendment fits neatly into the remedial category. The legislature placed it in Section 20, the damages provision, and left Section 15, where the substantive consent requirements live, completely untouched. The amendment’s own language reinforces this reading: it speaks of recovery, not rights or duties. The court also pointed to the Illinois Supreme Court’s observation in Cothron that BIPA damages appear to be discretionary rather than mandatory, noting that the statute uses the word “may” when describing what a prevailing party can recover.