Illinois Supreme Court Reverses Second District in Biometric Privacy Case: Plaintiffs No Longer Need to Allege a Concrete Injury

On the heels of two defendant-friendly decisions challenging standing in federal cases involving the Illinois Biometric Privacy Act (“BIPA”),[1] the Illinois Supreme Court has complicated the BIPA landscape by holding that an “aggrieved person” who has a claim under the statute need not state a separate, real-world harm beyond a statutory violation. 740 ILCS 14/1 et seq.; Rosenbach v. Six Flags Entm't Corp., 2019 IL 123186. This decision has ramifications for any company that does business in Illinois and makes it easier for plaintiffs to sue under the statute.

Enacted in 2008, BIPA is the first state law concerning the growing number of businesses collecting biometric data. The statute was enacted in response to the bankruptcy sale of a company called Pay By Touch, which used biometric technology to allow consumers to pay for items using their fingerprint. In 2008, Pay By Touch attempted to sell its biometric data, spurring the ACLU of Illinois into action. As a result, the Illinois legislature passed BIPA. BIPA protects biometric data such as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/1 et seq. Private entities that collect this data must adhere to requirements for collection, destruction, and disclosure of this data. Id. The statute requires entities that collect and retain this data to obtain informed consent and to make certain disclosures upon collection. Id. Further, the statute provides for a private right of action for violations of the statute, with damages of up to $1,000 per negligent violation and $5,000 per intentional or reckless violation. Id.

In Rosenbach, the plaintiff filed a putative class action lawsuit against Six Flags Great America, alleging her 14-year-old son’s fingerprint was collected without notice and consent when he purchased a season pass to the Great America theme park. 2017 IL App (2d) 170317. Plaintiff asserted Six Flags had violated BIPA by (1) collecting, capturing, storing, or obtaining biometric identifiers and biometric information from class members without written notification; (2) not informing them in writing of the specific purposes for which defendants were collecting the information or for how long they would keep and use it; and (3) not obtaining a written release before collecting the information. Id. Six Flags filed a motion to dismiss on the grounds that plaintiff’s son was not an “aggrieved” person, because his fingerprint data had never been stolen or sold. Id. The lower court denied the motion to dismiss, and Six Flags filed an interlocutory appeal. Id.

The Second District Appellate Court addressed whether a plaintiff is “aggrieved” under BIPA “when the only injury he or she alleges is a … private entity collected his or her biometric identifiers and/or biometric information without providing him or her the disclosures and obtaining written consent.” Id. at *3. On December 21, 2017, the appellate court reversed, saying BIPA is not a strict liability statute, and a plaintiff cannot collect for mere violation, but must prove actual harm. Id. at *5. “[I]f the Illinois legislature intended to allow for a private cause of action for every technical violation of the Act, it could have omitted the word ‘aggrieved’ and stated that every violation was actionable … Therefore, a plaintiff who alleges only a technical violation of the statute without alleging some injury or adverse effect is not an aggrieved person under section 20 of the Act.” Id. at *4. Plaintiff then appealed, and the Illinois Supreme Court agreed to hear the case.

The Illinois Supreme Court took a sharp turn and reversed the appellate court, remanding the case to the circuit court for further proceedings. Rosenbach v. Six Flags Entm't Corp., 2019 IL 123186, at ¶ 1. The court held that the Illinois legislature could not possibly have intended to limit a plaintiff's right to bring a cause of action to circumstances where he or she has sustained some actual damage. Id. at ¶ 25. “To require individuals to wait until they have sustained some compensable injury beyond violation of their statutory rights before they may seek recourse, as defendants urge, would be completely antithetical to [BIPA’s] preventative and deterrent purposes.” Id. at ¶ 37. The court rejected the appellate court’s characterization of the statutory violation as “technical,” finding instead that it was “real and significant.” Id. at ¶ 40. “When a private entity fails to adhere to the statutory procedures, as defendants are alleged to have done here, the right of the individual to maintain [his or] her biometric privacy vanishes into thin air.” Id. at ¶ 34. 

This decision is a weighty one for defendants that appears to make it easier for plaintiffs to state a cause of action in state court. Plaintiffs’ attorneys have taken note. Already these cases are flooding the Illinois dockets. While Article III standing challenges are expected to continue to have teeth in federal court, defendants will need to turn to battlegrounds other than lack of standing in state court. Expect more argument—and, hopefully, clarity—regarding the definition of “biometric identifiers” and the viability of a theory of implied consent to collect biometric information. Further, we can expect fights over defendants’ attempts to remove state cases to the friendlier federal court. Taking these challenges into account, one thing that is certain is there are more to come.

For more information, contact Reena Bajowala or another member of our Data Security and Privacy Group.

This publication is intended for general information purposes only and does not and is not intended to constitute legal advice. The reader should consult with legal counsel to determine how laws or decisions discussed herein apply to the reader’s specific circumstances.