SAVOY, Ill. (WCIA) – For years, Jim Higgins’ employees scanned their fingerprints to clock in and out.

“What really gets you is when you don’t know what you don’t know,” Higgins said.

What Higgins didn’t know was he could be sued for his biometric time clock system. State law says he needed his employees’ written consent to scan.

Now, under an Illinois Supreme Court ruling from last week in Cothron v. White Castle Systems, employers who violate the Biometric Information Privacy Act (BIPA) could have to pay up for each time workers clocked in and out – not just per employee.

Some business owners are worried they could be hit even harder by legal action. BIPA regulates the way data on your fingerprint, retinas and facial features can be stored and shared. It means if companies want to collect your biometric information, they are responsible for telling you why and how it’s being stored, and getting your written consent first.

“It’s ridiculous. The whole thing is ridiculous,” Higgins said.

Higgins has been in business for five decades. But he says when a disgruntled employee sued him two years ago, Higgins’ lawyer said: “there’s no way you’ll win this.”

“It cost us a lot of money to settle it,” Higgins said.

The lawsuit claimed Higgins violated BIPA by using an attendance and time tracking software scanning employees’ fingerprints.

“That way, you don’t clock in and out for somebody else. It’s just the perfect system,” he said.

But it wasn’t perfect. Higgins included information about the system in his employee handbook. He later learned under BIPA, that worker should have signed a consent form.

“Unlike your social security number or a bank account number or a password, you can’t change your fingerprint,” State Representative Ann Williams said.

Williams says that’s the crux of the law. When it was passed in 2008, the technology was spreading, along with security concerns.

“It doesn’t just apply to employers. I think the big, real focus of BIPA, the more significant concern for regular people is the application to big tech companies,” Williams said.

Like Google, Apple and Microsoft. Williams says we have the right to know when and how our biometric data is being used. But small business owners like Higgins – who says his system stored fingerprints in an algorithm that made them impossible to reproduce – face tough odds if they’re brought to court.

“You just hope somebody doesn’t do it,” he said.

Higgins sold Awesome Machines in September, but he still has a message for other employers.

“Get the form and get the employees to sign it. Immediately,” he said.

Another ruling from a few weeks ago in the case of Tims v. Blackhorse Carriers, Inc. would give plaintiffs five years to sue. While business owners like Higgins are worried the financial implications could be “devastating,” Representative Williams says trial courts will use discretion to create damage awards that are fair to both parties.