The contents of any recording must be protected from inadvertent disclosure or even hacking and should not be retained longer than necessary. In a vehicle transaction, a recording might contain “non-public personal information” as defined under privacy laws such as the federal Gramm Leach Bliley Act. If so, dealerships are required under the FTC Safeguards Rule to safeguard the recording, and other federal privacy laws would require the dealership to make required disclosures to the customer. Additionally, video recording without audio may also have legal implications. There has been a spike in claims under the federal Video Privacy Protection Act (VPPA) (18 U.S.C. 2710), a statute enacted several years ago to address the privacy of consumers in video rental and sales transactions. The VPPA has been effectively repurposed to enforce privacy and prohibit the disclosure of “personally identifiable information” from video records without the customer’s informed, prior written consent. Moreover, there has also been an increase of litigation against businesses in Illinois under the Biometric Information Privacy Act (BIPA) (740 ILCS 14/1 et seq.). This Illinois law addresses the collection by a private entity of “biometric identifiers” and “biometric information” from any person, which includes both dealership customers and employees. “Biometric information” includes any information based on a person’s biometric identifier used to identify that person, regardless of how it’s collected. And a “biometric identifier” includes a person’s retina or iris scan, fingerprint, voiceprint, and scans of hand or face geometry. BIPA prohibits an entity from collecting or obtaining a person’s biometric identifier or biometric information unless the entity: (a) informs the person in writing (i) that a biometric identifier/ information is being collected or stored, and (ii) of the purpose and term length for which the biometric identifier/information is being used, collected, or stored; and (b) receives a written release from the person of that person’s biometric identifier or biometric information. Any business that collects biometric information or biometric identifiers must formulate written policies that set forth a retention schedule, as well as guidelines for the permanent destruction of records of biometric identifiers after the initial purpose for collecting the information has been satisfied or 3 years after collection, whichever is earlier. Illinois dealerships considering recording vehicle transactions must navigate the complex legal landscape with their counsel to ensure compliance with both state and federal laws, including the potential privacy concerns which come into play when capturing and handling customer information and data. This includes establishment and implementation of clear policies and compliant disclosures, consent, collection and record maintenance practices to avoid legal pitfalls. Julie A. Cardosi is Principal of the private firm, Law Office of Julie A. Cardosi, P.C., of Springfield, Illinois. She has practiced law for over 37 years and represents the business interests of franchised motor vehicle dealers throughout Illinois. Formerly in-house legal counsel for the Illinois Automobile Dealers Association, she concentrates her private practice in the areas of dealership operations and compliance matters, transfers of ownership, mergers and acquisitions, franchise law, commercial real estate transfers, dealership employment and other areas impacting day-to-day dealership operations. She has also served as former Illinois Assistant Attorney General and Deputy Chief of the Consumer Fraud Bureau of the Attorney General’s Office. The material discussed in this article is for general information only and is not intended as legal advice and should not be acted upon as such. Dealers should consult their own private legal counsel for application to their specific circumstances. For more information, Julie can be reached at jcardosi@autocounsel.com, or at 217-787-9782, ext. 1. 9 Illinois Automobile Dealer News
RkJQdWJsaXNoZXIy MTg3NDExNQ==