Illinois Supreme Court Rules Biometric Information Privacy Act Lawsuits Do Not Require Actual Injury | Practical Law

Illinois Supreme Court Rules Biometric Information Privacy Act Lawsuits Do Not Require Actual Injury | Practical Law

In Rosenbach v. Six Flags Entertainment Corp., the Illinois Supreme Court held that individuals need not demonstrate an actual injury beyond a statutory violation to sue under Illinois's Biometric Information Privacy Act (BIPA).

Illinois Supreme Court Rules Biometric Information Privacy Act Lawsuits Do Not Require Actual Injury

by Practical Law Data Privacy Advisor
Published on 28 Jan 2019 • Illinois
In Rosenbach v. Six Flags Entertainment Corp., the Illinois Supreme Court held that individuals need not demonstrate an actual injury beyond a statutory violation to sue under Illinois's Biometric Information Privacy Act (BIPA).
On January 25, 2019, the Illinois Supreme Court issued an opinion in Rosenbach v. Six Flags Entertainment Corp., holding that Illinois's Biometric Information Privacy Act (BIPA) does not require individuals to suffer actual injury beyond a statutory violation to sustain a private action (740 ILCS 14/1 to 14/99) ( (Ill. January 25, 2019)).
Stacy Rosenbach, on behalf of her minor son Alexander, claimed that she purchased Alexander a season pass to their local Six Flags amusement park. When Alexander arrived at the park to activate his pass, the park scanned his fingerprints into the company's biometric capture system. Alexander received no paperwork regarding the season pass or information about how the company would store or use his biometric information. Stacy Rosenbach filed a class action suit against Six Flags, on behalf of Alexander and others, alleging it violated BIPA by failing to:
  • Inform individuals in writing that it would collect or store biometric information.
  • Inform individuals in writing of:
    • the specific purposes for collecting the information; and
    • how long it would keep and use the information.
  • Obtain a written release from individuals before collecting biometric information.
Six Flags moved to dismiss the complaint for lack of standing, claiming Alexander had not suffered an actual or threatened injury. The trial court denied the motion, and Six Flags sought interlocutory review from the Appellate Court of Illinois, Second Division. The appellate court held that because the statute required an "aggrieved person," plaintiffs may not pursue damages solely based on a defendant's technical violation of BIPA without additional injury.
The Illinois Supreme Court reversed, reasoning that:
  • Damages are not necessary to qualify as an "aggrieved" person under the common law and applicable dictionary meanings of the term.
  • BIPA gives individuals the right to control their biometric information by requiring notice before collection and the right to withhold consent. These rights are important because individuals cannot change their biometric information if it becomes compromised or misused.
  • If a private entity fails to comply with the statutory requirements, individuals' only recourse is the private right to sue.
The court also noted that private entities are incentivized to comply with BIPA precisely because the law does not require affected individuals to show any injury beyond a statutory violation. The court remanded to the trial level for further proceedings.
This opinion is notable because it means plaintiffs may succeed in Illinois state court actions where they otherwise may not meet Spokeo standing requirements in federal court.