On May 27, 2019, the Illinois General Assembly voted to approve Senate Bill 1624, which proposes to amend the state’s Personal Information Protection Act. This blog entry provides an overview of the bill’s provisions.
Continue Reading
Illinois
Illinois Supreme Court Says Biometric-Data Protection Law Does Not Require Allegation of Actual Injury
Posted on
Posted in Information Security, U.S. State Law
The Illinois Supreme Court ruled today that an allegation of “actual injury or adverse effect” is not required to establish standing to sue under the Illinois Biometric Information Privacy Act.…
Continue Reading
Illinois BIPA Suit Dismissed for Lack of Article III Standing
Posted on
Posted in Information Security, U.S. State Law
On December 29, 2018, the Northern District of Illinois dismissed consolidated cases brought under the Illinois Biometric Information Privacy Act on standing grounds, finding that despite the existence of statutory standing under BIPA, neither plaintiff had claimed any injury that would support Article III standing.…
Continue Reading
Illinois Supreme Court Hears Standing Arguments
Posted on
Posted in Information Security, U.S. State Law
On November 20, 2018, the Illinois Supreme Court heard arguments in a case that could shape future litigation under the Illinois Biometric Information Privacy Act (“BIPA”). BIPA requires companies to (i) provide prior written notice to individuals that their biometric data will be collected and the purpose for such collection, (ii) obtain a written release from individuals before collecting their biometric data and (iii) develop a publicly available policy that sets forth a retention schedule and guidelines for deletion once the biometric data is no longer used for the purpose for which it was collected (but for no more than three years after collection). BIPA also prohibits companies from selling, leasing or trading biometric data.
…
Continue Reading
Chicago Introduces Data Protection Ordinance
Posted on
Posted in Information Security, Online Privacy
Recently, the Personal Data Collection and Protection Ordinance was introduced to the Chicago City Council. The Ordinance would place requirements on businesses related to personal information, data breach notification and consent. …
Continue Reading
Putative Data Breach Class Action Dismissed for the Third Time
Posted on
Posted in Security Breach, U.S. State Law
On June 13, 2017, Judge Andrea R. Wood of the Northern District of Illinois dismissed with prejudice a putative consumer class action filed against Barnes and Noble. The case was first filed after Barnes and Noble’s September 2012 announcement that skimmers had tampered with PIN pad terminals in 63 of its stores and exposed payment card information.…
Continue Reading
Washington Becomes Third State to Enact Biometric Privacy Law
Posted on
Posted in Information Security, U.S. State Law
On May 16, 2017, the Governor of the State of Washington, Jay Inslee, signed into law House Bill 1493, which sets forth requirements for businesses who collect and use biometric identifiers for commercial purposes. The law will become effective on July 23, 2017. Washington becomes the third state to pass legislation regulating the commercial use of biometric identifiers.…
Continue Reading
Neiman Marcus Agrees to Settlement in Data Breach Class Action
Posted on
On March 17, 2017, retailer Neiman Marcus agreed to pay 1.6 million dollars as part of a proposed settlement to a consumer class action lawsuit stemming from a 2013 data breach that allegedly compromised the credit card data of approximately 350,000 customers.…
Continue Reading
OCR Settles First Enforcement Action for Untimely Reporting of a Breach
Posted on
On January 7, 2017, the U.S. Department of Health and Human Services’ Office for Civil Rights entered into a resolution agreement with Presence Health stemming from the entity’s failure to notify affected individuals, the media and OCR within 60 days of discovering a breach. This marks the first OCR settlement of 2017 and the first enforcement action relating to untimely breach reporting by a HIPAA covered entity.…
Continue Reading
OCR Settles Largest HIPAA Violation Against a Single Covered Entity
Posted on
On August 4, 2016, the U.S. Department of Health and Human Services’ Office for Civil Rights entered into a resolution agreement with Advocate Health Care Network over alleged HIPAA violations. The multimillion dollar settlement with Advocate is the largest settlement to date against a single covered entity.…
Continue Reading