Illinois Supreme Court Ruling on Biometric Information Privacy Act Has Far Reaching Consequences

On January 25, 2019, the Illinois Supreme Court issued a unanimous opinion resolving a contested interpretation of the state’s Biometric Information Privacy Act, 740 ILCS 14/1 et seq . (“BIPA” or the “Act”). In short, the high Court ruled in Rosenbach v. Six Flags Entm't Corp ., 2019 IL 123186 that to state a claim under the Act, a plaintiff need not allege some actual harm. Rather, an “aggrieved party” under the Act is one who can demonstrate that a BIPA violation has occurred.

A little background on BIPA illustrates the significance of the Court’s decision. BIPA was enacted in 2008 to regulate “the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” Id. § 5(g). “Biometric identifiers” could include retina scans, fingerprints, and facial geometry. Id. § 10. “Biometric information” means “any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual.” Id.

While it is not unlawful to collect, store, and use biometric information, any private entity seeking to do so must obtain informed, written consent from the individual providing the information. Id . § 15. The Act specifies a number of other requirements beyond the scope of this article.

Courts may award liquidated damages to the aggrieved party of, at minimum, $1,000 for negligent violations or $5,000 for intentional or reckless violations. Id . § 20(1) and (2). Under the Act, the prevailing party in a case is also entitled to reasonable attorney’s fees and costs. Id . § 20(3).

In Rosenbach, the plaintiff’s minor child provided his thumbprint to Six Flags to obtain a season pass for the amusement park. In addition to other violations of the Act, the plaintiff alleges that neither she nor her minor son signed a release for the collection, storage, and use of the thumbprint. Id . at ¶ 8. In the absence of signed consent, the plaintiff alleges that the collection, storage, and use of the thumbprint (a “biometric identifier”) by Six Flags (a private entity) constitutes a clear violation of the Act.

In its motion to dismiss the complaint, Six Flags argued that a plaintiff must plead and (eventually) prove some actual injury beyond a mere violation of the Act. The Court called Six Flags’ interpretation of the Act “untenable”, because the Illinois legislature could have easily included language in the Act requiring such actual harm. ¶ 25. The Supreme Court went on to state:

When a private entity fails to adhere to the statutory procedures, as defendants are alleged to have done here, “the right of the individual to maintain [his or] her biometric privacy vanishes into thin air. The precise harm the Illinois legislature sought to prevent is then realized.” This is no mere “technicality.” The injury is real and significant.

Id . ¶ 34 citing Patel v. Facebook, Inc . 290 F. Supp. 3d 948, 953 (N.D. Cal. 2018). In siding with the plaintiff, the Court reversed the decision of the Second District Appellate Court and remanded back to the trial court for further proceedings.

The implications of the Rosenbach decision are far reaching and will likely impact thousands of businesses (1) operating in Illinois. It is reasonable to anticipate an increase in the number of cases filed by parties seeking to assert violation of the Act both individually and on behalf of a class. In fact, a class action case was recently filed in the Circuit Court of Cook County, Illinois against Walmart (2) by a former employee alleging Walmart required cashiers to scan their handprint at the start and end of their shifts. The former employee asserts this requirement violates the BIPA.

If your business collects, stores, or uses biometric information, please contact Lavelle Law for an audit of your policies and procedures. Brian Massimino is an associate at Lavelle Law, and can be reached at (312) 736-1262 or at bmassimino@lavellelaw.com.

(1) It is worth noting that in Rosenbach , the Restaurant Law Center, Illinois Restaurant Association, the Internet Association, and the Illinois Chamber of Commerce all filed “friend of the court” briefs in support of Six Flags. The American Civil Liberties Union, the Center for Democracy and Technology and the Electronic Frontier Foundation filed briefs in support of the Plaintiff’s position. 2019 IL 123186, ¶ 16.

(2)Ethan Roach, et al. v. Walmart, Inc ., Case No. 2019CH01107.