A recent Seventh Circuit decision is a reminder of BIPA’s financial institution GLBA exceptions. In that case, the court held that a vendor to GLBA-regulated entities was exempt from Illinois’ biometric law.
The company, Nuance Communications, provides identity-check services for GLBA entities, including one that uses voice identification tools for customer identification. Nuance was hired to run that voice ID system. A customer brought a BIPA suit, arguing that Nuance failed to obtain BIPA-required written consent before collecting her voice-identification data.
The plaintiff did not sue the company itself, recognizing it was exempt under GLBA. She argued, instead, that the exemption should not extend to the financial institution’s vendor. The court disagreed. It found that Nuance was confirming identity as part of a proper banking activity, and as such was engaging in a GLBA activity. As such, its activities were subject to the GLBA exemption. The court pointed to a similar conclusion reached by the Third Circuit.
Putting it into Practice: This case is a reminder that BIPA does have exemptions, and those exemptions could apply to vendors providing services on behalf of an exempt entity.