A new surge in class-action lawsuits over biometric data collection under the Illinois Biometric Information Privacy Act, also known as BIPA, is leaving CRE operators vulnerable to liabilities totaling millions in damages and legal fees — even if they aren't doing anything wrong. “It's important to pay attention to the legal landscape of what laws are currently being considered, because this may change rapidly in the next few years,” Technology .With BIPA, any individual can file a lawsuit over the improper collection and mishandling of biometric data, Data, Privacy & Cybersecurity partner Omer Tene said. This opens the door for opportunistic class-action plaintiffs to “weaponize” the mechanism against certain businesses, he said. “Even if you have a very good case and ultimately, in some court a few years down the road, you will win, you will bleed dollars for legal defense, and it'll just be a huge pain to deal with,” Tene said.