“No Harm, Still Foul”: Actual Harm Not Required for Plaintiffs Under Illinois Biometric Privacy Act

In a highly anticipated decision under the Illinois Biometric Information Privacy Act (“BIPA”),[1] the Illinois Supreme Court reversed the Illinois Second District Appellate Court, holding that plaintiffs need not “plead and prove that they sustained some actual injury or damage beyond infringement of the rights afforded them under [BIPA]” in order to pursue a claim. The case, Rosenbach v. Six Flags Entertainment Corp., et al.,[2] which we previously discussed in client alerts (available here), centered on whether or not an individual bringing a claim under the BIPA can be considered an “aggrieved person” based solely on a technical violation of the statute and without alleging some other harm, such as monetary damages or injury caused by misuse of the data.

Plaintiff Stacy Rosenbach claimed that Six Flags collected the fingerprints of her 14-year-old son when he accessed a season pass at Six Flags amusement park. She alleged she never consented to the collection and storage of her son’s fingerprints contrary to the requirements of BIPA. Six Flags contended that for Rosenbach to qualify as a “person aggrieved” under the statute, she was required to show that some injury resulted from the collection of her son’s biometric information. After the trial court rejected the argument advanced by Six Flags, it certified a question as to the definition of an “aggrieved person” to the appellate court. Upon review, the appellate court held that “a plaintiff who alleges only a technical violation of the statute without alleging some injury or adverse effect is not an aggrieved person under ... the act."

In reversing the appellate court, the Illinois Supreme Court noted that Six Flags’ “contention that redress under the act should be limited to those who can plead and prove that they sustained some actual injury or damage beyond infringement of the rights afforded them under the law would require that we disregard the commonly understood and accepted meaning of the term ‘aggrieved’; depart from the plain and, we believe, unambiguous language of the law; read into the statute conditions or limitations the Legislature did not express; and interpret the law in a way that is inconsistent with the objectives and purposes the Legislature sought to achieve.” It opined further that a violation of BIPA on its own is sufficient to support a cause of action under the statute.[3]

While the Supreme Court’s decision addressed the threshold issue of standing to assert claims under BIPA, there have been relatively few decisions interpreting other elements of the statute. There can be no doubt that the decision will result in an increase in filing of new BIPA lawsuits. Accordingly, it is more important now than ever for companies that may be collecting, storing, or using biometric information to confirm they are in compliance with the law.

Notes:

[1] 740 ILCS 14/5.

[2] Case No. 2019 IL 123186 (Ill. Jan. 25, 2019).

[3] In contrast, some federal courts have concluded that a purely technical violation of BIPA does not establish standing under Article III of the Constitution and have dismissed BIPA claims for lack of subject matter jurisdiction where there are no allegations of actual harm. Rivera v. Google, Inc., Case No. 1:16-cv-02714 (N.D. Ill. Dec. 29, 2018).