As Illinois lawmakers prepare to revisit data center policy during the November veto session, potential changes to the state’s Biometric Information Privacy Act (BIPA) are emerging as a significant, and potentially contentious, part of the discussion.
BIPA was enacted in 2008 to regulate how private entities collect, use, store and disclose biometric information such as fingerprints, facial scans and other unique biological identifiers. The law generally requires companies to inform individuals in writing about the collection and use of their biometric information, obtain written consent and follow requirements for protecting and eventually destroying the data. BIPA also allows individuals to bring lawsuits against companies for violations, making Illinois’ law one of the strongest biometric privacy laws in the country.
Organized labor has released its own framework for regulating data centers as lawmakers consider Governor JB Pritzker’s proposed POWER Act. Labor’s proposal shares several elements with the POWER Act, including reducing water consumption, requiring data centers to provide or secure their own electricity and protecting existing utility customers from higher costs associated with data center development. However, labor is also calling for changes to BIPA, the state law that generally requires private companies to obtain consent before collecting or using an individual’s biometric information.
Operating Engineers Local 150 has argued that Illinois’ BIPA requirements have discouraged data center investment and contributed to projects being located in states with weaker labor and environmental standards. Labor's proposal calls for BIPA enforcement to focus more heavily on cases involving actual misuse or disclosure of biometric information, such as a data breach, rather than violations based solely on the collection of biometric information without proper consent.
That position is expected to face opposition from privacy advocates and the Illinois Trial Lawyers Association (ITLA). ITLA disputes the contention that BIPA is preventing data center development, noting that Illinois already ranks among the states with the largest number of data centers. The organization also points to growing community concerns about the industry's use of electricity, water and land as potentially greater obstacles to new development.
The ACLU of Illinois likewise maintains that unauthorized collection of biometric information is itself a harm that BIPA was specifically designed to prevent. The organization has expressed concern that using data center legislation to create exemptions or limitations could become a vehicle for broader changes to the state's biometric privacy protections.
Labor representatives have suggested that any BIPA changes could be more narrowly tailored. One possibility would involve an exception or modified standard for biometric information used in AI-related modeling while retaining existing consent requirements governing employers and their employees. Privacy advocates have indicated a willingness to review specific language but have raised questions about how an AI exemption could expand as the technology evolves.
Another issue involves data centers that merely store or transmit biometric information collected by their customers. The data center industry has sought protections from liability in these circumstances, arguing that operators may have no knowledge of the information passing through their infrastructure and therefore have no practical ability to obtain consent from the individuals whose biometric information is involved.
House Executive Committee Chair Rep. Ann Williams (D-Chicago) has expressed skepticism that lawmakers would support sweeping reductions in BIPA's privacy protections. She has indicated, however, that clarifying the law as it applies to the passive storage or transmission of biometric information by data centers may be more workable. Williams has also left open the possibility of negotiations over a narrower AI-related provision.
The debate adds another layer to an already complicated discussion over data center policy in Illinois. Lawmakers will need to balance the economic development and construction interests associated with the rapidly growing industry against concerns about electricity demand, water consumption, ratepayer costs and personal privacy. Whether a narrowly tailored BIPA compromise can become part of a broader data center agreement is likely to be an important issue heading into the November veto session.