Expanding Biometric Class Actions Beyond Illinois

Regulation of the collection and use of biometric information continues to tighten. Following the lead of several states (i.e., Illinois, Texas, and Washington), the city of Portland, Oregon recently went a step further in passing an ordinance to ban the use of “facial recognition technology” in any place of “public accommodation.” The ordinance broadly defines these terms to effectively ban the use of any technology that compares a person’s image against a library of reference images (i.e., a “one to many” search) to assist in “identifying, verifying, detecting, or characterizing facial features.” Similarly, public accommodation is broadly defined to include any place or service offering goods and services that is not “distinctly private” in its nature.

Unlike state biometric laws, which allow for the collection of biometric data with the appropriate notice and consent, Portland’s ordinance bans any use of facial recognition technology unless use of the technology: 1) is necessary for compliance with law; 2) is used to access a personal or employer-owned device; or 3) is in relation to an automatic face detection service in a mobile app. In addition, unlike other municipalities that have banned the use of facial recognition technology by government agencies (e.g., Oakland, California, and Cambridge, Massachusetts), Portland’s ban explicitly applies to private entities.

The Portland ordinance shares one key similarity with Illinois’ Biometric Information Privacy Act (BIPA). Like BIPA, the Portland ordinance contains a private right of action. However, Portland’s private right of action goes above and beyond the $1,000 per negligent violation statutory damages offered by BIPA. Rather, the ordinance states that “[a]ny person injured by a material violation…has a cause of action…for damages sustained as a result of the violation or $1,000 per day for each day of the violation, whichever is greater.”

Over the past two years, there have been hundreds of class action BIPA suits filed, many of which have been settled in the seven-to-nine figure range. While narrower than BIPA in terms of the scope of the biometrics it regulates, given the broader statutory damages allowed under the new Portland ordinance, it is reasonable to expect similar class action attention. This is especially true given that, unlike BIPA, the ordinance’s statutory damages accrue on a daily basis rather than on a per violation basis.