Illinois Supreme Court: Biometric Information Privacy Act Protects Rights Even If No Injury

A year ago, the Illinois Supreme Court issued a decision, Rosenbach v. Six Flags Entm't Corp., 129 N.E.3d 1197 (Ill. 2019), reversing a lower court decision on an interlocutory appeal, and held that a plaintiff can bring an action under the Illinois Biometric Information Privacy Act even if he or she has not suffered an injury other than a violation of his or her rights under the Act. The Act restricts private parties from collecting, storing, or disclosing biometric information (fingerprints; retinal scans; voice recordings; etc.).

Six Flags uses fingerprint scanners to control who can enter their theme parks. The Plaintiff's teenage son got a season pass card to a Six Flags park which allowed him to enter the park when used in conjunction with a scan of his thumbprint. Neither the boy nor his parents signed a document agreeing to a release of his biometric information and Six Flags did not give them any documentation. The fact that Six Flags would retain the fingerprint was not disclosed.

The Illinois Supreme Court found that the violation of a legal right is sufficient to qualify an individual as an aggrieved party. ". . . when a private entity fails to comply with one of [the Act's] requirements, that violation constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose biometric identifier or biometric information is subject to the breach . . . No additional consequences need be pleaded or proved. The violation, in itself, is sufficient to support the individual's or customer's statutory cause of action." Id. at *1206. The Act requires notice and must give people the ability to withhold consent. Its purpose is to protect the public welfare and safety by safeguarding biometric information, not just redress actual damage.

"When a private entity fails to adhere to the statutory procedures, as defendants are alleged to have done here, 'the right of the individual to maintain [his or] her biometric privacy vanishes into thin air. The precise harm the Illinois legislature sought to prevent is then realized.' This is no mere 'technicality.' The injury is real and significant." Id., (quoting Patel v. Facebook, Inc., 290 F. Supp. 3d 948, 954 (N.D. Cal. 2018)).