Bill > HB2838

This bill amends the Biometric Information Privacy Act (BIPA) to provide more flexibility for private entities collecting and using biometric data for security purposes. The bill expands the definition of "biometric identifier" to exclude information converted to a mathematical representation and introduces new terms like "biometric lock" and "biometric time clock". It allows private entities to collect biometric information without prior written consent if done for security purposes, such as preventing theft, investigating fraud, protecting property, or assisting law enforcement, with the condition that the data is used only for those purposes and deleted once no longer necessary. The bill also modifies the right of action for aggrieved individuals by requiring them to provide a 30-day written notice to the private entity before filing a lawsuit, during which time the entity can cure the violation. If the entity provides a written statement that the violation has been addressed and will not recur, the individual cannot seek statutory damages. The bill maintains existing provisions for potential damages, including $1,000 for negligent violations and $5,000 for intentional or reckless violations, and creates exemptions for certain types of biometric data collection, such as those used in time clocks or locks that convert biometric data to an unrecreatable mathematical representation. The bill also exempts private entities with collective bargaining agreements that have different biometric information policies.

Justice

https://www.ilga.gov/legislation/BillStatus.asp?DocNum=2838&GAID=18&DocTypeID=HB&SessionID=114&GA=104