The Illinois Supreme Court’s recent decision in Rosenbach v. Six Flags Entertainment Corp. is a blow to businesses that collect biometric information and identifiers (biometric data), and will likely lead to a flood of litigation under Illinois’ Biometric Information Privacy Act (BIPA). The decision, which was handed down on January 25, 2019, held that plaintiffs are not required to demonstrate actual injury to pursue a claim for violation of the BIPA.
The BIPA addresses the collection and storage of biometric data by private entities. The Act requires that these entities:
a) Develop a written policy concerning the storage and destruction of biometricdata;
b) Provide notice and obtain consent from an individual to collect biometric data;
c) May not sell, lease, trade, or otherwise profit from the biometric data;
d) May not disclose biometric data without consent, or under certain specified circumstances; and
e) Must safely store, transmit and protect biometric data.
Read our previous blog on this topic to learn more details about the Illinois BIPA requirements on businesses.
BIPA Provides a Private Right of Action for Violations of the Act
In Rosenbach, Stacy Rosenbach, on behalf of her son (Plaintiff), sued Six Flags Entertainment Corp. for various violations of BIPA that occurred at its Six Flags Great America amusement park in Gurnee, Illinois. Rosenbach alleged that Six Flags violated BIPA during the process of selling her son a season pass to its amusement park by collecting biometric information from him without notifying him that this information was being collected or stored, without notifying him of the purpose for which the information was collected or how it would be stored, and without obtaining written authorization to collect the information. Six Flags sought dismissal of the suit on numerous grounds, including that Plaintiff had suffered no actual injury and therefore lacked standing to sue.
Whether an individual must suffer some actual harm, apart from the statutory violation of BIPA itself, to sue under the Act, is the issue that was addressed by the Illinois Supreme Court. The Court analyzed the plain meaning of the statute, along with the intent of the legislature, and held that a statutory violation alone was sufficient to sue under BIPA.
How Does this Decision Impact Illinois Businesses and Lead to an Increase in BIPA Litigation?
This decision is important for businesses operating in Illinois in a couple of ways.
- First, the decision will likely lead to an increase in BIPA litigation now that it is settled that plaintiffs do not need to demonstrate actual injury to pursue their claims.
- Second, it should lead to an increased focus on BIPA compliance for private entities that are subject to BIPA. Violations of BIPA can result in liquidated damages, attorneys’ fees and costs, as well as injunctive relief, all of which are avoidable by diligently complying with the Act.
If you have additional questions regarding BIPA litigation and/or BIPA compliance contact Tim Hayes at McKenna Storer. Tim Hayes devotes his practice to helping businesses anticipate or address data security and privacy matters.