On January 25, 2019, the Illinois Supreme Court found that an individual need not allege some actual injury or adverse effect, beyond his or her rights under the Illinois Biometric Information Privacy Act, to qualify as an "aggrieved" person and be entitled to seek liquidated damages and injunctive relief under the Act.
Stacy Rosenbach sued Six Flags Entertainment Corporation and its subsidiary, Great America LLC, which own and operate Six Flags Great America amusement park in Illinois, on behalf of her minor son for violating the BIPA. Rosenbach purchased a season pass to Six Flags for her son. When her son went to Six Flags, his fingerprint was used in conjunction with a card to enable him to gain access to Six Flags. Rosenbach alleged that Six Flags violated the BIPA because neither Rosenbach nor her son signed any written release regarding the taking of his fingerprint, and neither of them consented in writing to the collection, storage, use, sale, lease, dissemination, disclosure, or trade of this personal information or for Six Flags to otherwise profit from his fingerprint or associated biometric identifiers or biometric information.
The BIPA imposes on private entities, such as Six Flags, various obligations regarding the collection, retention, disclosure, and destruction of biometric identifiers and biometric information (which includes fingerprint scans). The BIPA provides for a private right of action for any violation of the Act and permits an individual to recover the greater of the liquidated damages or actual damages, reasonable attorney fees and costs, and any other relief, including an injunction, that the court deems appropriate. There have been over 30 class action lawsuits brought under the BIPA since its adoption.
Six Flags moved to dismiss Rosenbach's complaint contending that she suffered no actual or threatened injury and, therefore, lacked standing to sue. The trial court denied Six Flags' motion and Six Flags sought interlocutory review by the appellate court. The appellate court concluded that a plaintiff who alleges only a technical violation of the BIPA without some injury or adverse effect is not an "aggrieved" person within the meaning of the law. Rosenbach appealed.
The Illinois Supreme Court reversed the intermediate appellate court's decision. The state supreme court noted that, in adopting the BIPA, the Illinois General Assembly codified an individual's right to privacy in and control over biometric identifiers and biometric information. As a result, the duties imposed on private entities under the BIPA regarding the collection, retention, disclosure, and destruction of a person's biometric identifiers or biometric information define the contours of a statutory right under the Act.
The state supreme court pointed to the General Assembly's assessment of risk posed by the growing use of biometrics by businesses, which noted that biometrics are unlike other unique identifiers used to access sensitive information because they are biologically unique to the individual and, once compromised, the individual has no recourse, is at a heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions. In enacting the BIPA, the General Assembly adopted a strategy to try to head off such problems before they occur. This included imposing safeguards insuring individuals' privacy rights in their biometric identifiers and biometric information are properly honored and protected before they are compromised, and subjecting private entities that fail to follow the BIPA's requirements to substantial potential liability. The only enforcement mechanism available under the BIPA is a private right of action.
Six Flags attempted to limit who can seek redress under the BIPA to those who suffered some actual injury or damage beyond infringement of the rights afforded to them under the Act. Finding such a limitation would require that the supreme court disregard the commonly understood and accepted meaning of the term "aggrieved" and depart from what it found to be the plain and unambiguous language of the BIPA to interpret the law in a way inconsistent with the objective and purpose the General Assembly sought to achieve. The supreme court held that when a private entity fails to comply with its duties under BIPA, that violation of the BIPA constitutes an invasion, impairment, or denial of the statutory rights of any person whose biometric identifier or biometric information is subject to the breach. Accordingly, such person is an "aggrieved" person within the meaning of the BIPA and entitled to seek recovery.
This opinion may have a significant impact on other litigation under the BIPA where the issue of who is an "aggrieved" person has been raised and could encourage additional litigation.