Describe your business, leave with a checklist you can assign

A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying the data when the initial purpose for collecting it has been satisfied or within three years of the individual last interaction with the entity, whichever occurs first. Absent a valid warrant or subpoena, the entity must comply with that schedule and those guidelines.

Evidence: Published biometric retention and destruction policy with an archived copy of the page; Biometric data inventory with last-interaction timestamps; Destruction execution logs and technical evidence; Records of handling any warrant or subpoena exception

Before collecting, capturing, purchasing, receiving through trade or otherwise obtaining a biometric identifier or biometric information, a private entity must first inform the subject or the subject legally authorized representative in writing that the data is being collected or stored; inform them in writing of the specific purpose and length of term for which it is being collected, stored and used; and receive a written release executed by the subject or that representative. The definition of written release in section 14/10 was amended by P.A. 103-769 (eff. 2024-08-02) and now reads informed written consent, electronic signature, or, in the context of employment, a release executed by an employee as a condition of employment, so an electronic signature is expressly available.

Evidence: Written notice text including the purpose and term fields; Executed written releases or electronic signature records; Description of the system control that blocks collection before consent; Consent workflows differentiated for employees and third parties such as visitors and contractors

A private entity in possession of a biometric identifier or biometric information may not sell, lease, trade or otherwise profit from it, and may not disclose, redisclose or otherwise disseminate it except in the circumstances the statute allows. This is a hard constraint on product designs that train models on face or voice data or that monetize collected biometric data.

Evidence: Inventory of outbound biometric data flows with the legal basis for each; Compliance review records for training-data provenance; Contract clauses prohibiting profiting and restricting disclosure; Data access audit logs

BIPA provides a private right of action: any person aggrieved by a violation may sue in state circuit court or as a supplemental claim in federal district court. A prevailing party may recover, for each violation, liquidated damages of $1,000 or actual damages, whichever is greater, against a private entity that negligently violates the Act, and $5,000 or actual damages, whichever is greater, against one that intentionally or recklessly violates it, plus reasonable attorney fees and costs including expert witness fees, and the court may grant other relief such as an injunction. The decisive damages limits are in section 14/20(b) and (c), added by P.A. 103-769 (eff. 2024-08-02): collecting the same biometric identifier or information from the same person using the same method of collection in more than one instance is a single violation of section 15(b) with at most one recovery, and disclosing the same data about the same person to the same recipient in more than one instance is a single violation of section 15(d) with at most one recovery. The older per-scan damages theory therefore no longer holds, though the completeness, retrievability and timestamp reliability of notice and consent records still drive class-action exposure directly.

Evidence: Verification report on the completeness and retrievability of consent records; Timestamping and log retention design for biometric processing systems; Allocation-of-liability agreements with vendors such as face recognition SDK and access control suppliers; Insurance and risk reserve assessment records

With respect to recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, or the terms, privileges or conditions of employment, it is a civil rights violation for an employer to use artificial intelligence that has the effect of subjecting employees to discrimination on the basis of protected classes under this Article, or to use ZIP codes as a proxy for protected classes. Note that the test is effect-based, unlike the intent-based test in the Texas TRAIGA.

Evidence: Inventory of AI tools used in personnel processes with stated purposes; Feature inventory and proxy-variable review records expressly excluding ZIP codes; Outcome disparity analysis by protected class; Vendor contract clauses on fairness testing and cooperation with investigations

It is a civil rights violation for an employer to fail to provide notice to an employee that the employer is using artificial intelligence for the purposes described above. The Illinois Department of Human Rights is directed to adopt rules for implementation and enforcement, including the circumstances and conditions requiring notice, the time period for providing it and the means of providing it, so the operative template and timing should follow those rules.

Evidence: Employee notice text and delivery records; Coverage list keyed to each personnel process in which AI is used; Tracking record for the Department of Human Rights rules and the resulting template versions; Workflow description for onboarding notices and periodic reminders to existing staff