Illinois' Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (BIPA) is unique among state biometrics statutes nationwide in that it includes a broad private right of action for those "aggrieved" by a violation of BIPA. Recently, the Illinois Supreme Court ruled in Rosenbach v. Six Flags Entertainment Corporation that a plaintiff need only allege a violation of BIPA to satisfy the statutory requirement that a plaintiff be an "aggrieved" person. The Court's decision will likely increase the volume of class action litigation under BIPA, and it should lead organizations to reexamine their compliance practices in light of the heightened risk of costly litigation.
On January 25, 2019, the Illinois Supreme Court ruled in Rosenbach v. Six Flags Entertainment Corporation that a plaintiff need only allege a violation of BIPA to satisfy the statutory requirements that a plaintiff be an "aggrieved" person. The decision clears a major obstacle for class action plaintiffs alleging violations of BIPA and may increase calls by private industry for the Illinois General Assembly to rein in the Act's private right of action provision, and possibly, reform its compliance requirements.
BIPA background – A private right of action permitting statutory damages
BIPA was enacted in 2008 and imposes various obligations on private entities that collect, purchase, or otherwise use certain biometric identifiers – specifically, retina scans, iris scans, fingerprints, or voiceprints – or related biometric information (collectively, biometric data) from or about Illinois residents. BIPA prohibits the collection of biometric data without prior written notice to and written consent from the individual, prohibits profiting from the sale of biometric data, and imposes restrictions on the transfer, retention, and storage of biometric data. BIPA also requires the public posting of biometric data retention and destruction policies and mandates the destruction of biometric data records after three years. These requirements may pose substantial compliance hurdles for organizations that collect biometric identifiers and use biometric information.
In addition to the potentially considerable compliance costs, BIPA poses a unique feature among nationwide biometrics privacy laws in that it includes a private right of action for "[a]ny person aggrieved by a violation of this Act." In private actions brought under BIPA, statutory damages range from $1,000 per violation for negligent violations to $5,000 per violation for intentional or reckless violations. Aggrieved persons may also recover actual damages (if they total more than statutory damages) and attorneys' fees under BIPA. Unsurprisingly, these high per-violation statutory damages and attorneys' fees provisions have generated a wave of BIPA class action litigation in the decade since BIPA's passage – and the Illinois Supreme Court's recent decision in Rosenbach may encourage further, increasingly expensive litigation against organizations that handle biometric data.
The Rosenbach decision clarifies that plaintiffs need not allege "actual harm" to plead they have been "aggrieved" as required to state a claim under BIPA
In Rosenbach, a lawsuit was brought in the Circuit Court of Lake County on behalf of a minor whose thumbprint was recorded during a 2014 trip to the Six Flags Great America amusement park in Illinois ("Six Flags"). Six Flags collected the minor's thumbprint to facilitate its season-pass program to reduce fraud and improve the visitor experience. According to the complaint, Six Flags violated BIPA by collecting the minor's thumbprint without providing prior written notice and without obtaining prior written consent.
The Illinois Supreme Court held that satisfying the statutory elements to state a claim under BIPA does not require the pleading of any actual injury beyond the violation of the plaintiff's statutory rights. Focusing on the plain language of Section 20 of the Act, 740 ILCS 14/20, which contains the private right of action language, the Court explained that to be "aggrieved," is to have either suffered a pecuniary injury or to have suffered the denial or infringement of a legal right. Thus, concluded the Court, a person who asserts a violation of his or her rights under BIPA, even without any other allegation of personal or pecuniary injury, has suffered the denial of a legal right and is a person "aggrieved" by a violation of BIPA.
The Rosenbach Court framed its decision around a narrow question of statutory interpretation – the meaning of the term "aggrieved" as used in BIPA. It reached the conclusion that the General Assembly intended to grant a private right of action to all persons whose legal rights under the statute were violated – all persons "aggrieved" – rather than all persons suffering cognizable monetary or other damages as a result of a violation.
Implications for the future of BIPA litigation and compliance
As a near-term practical consideration, the Rosenbach decision may lead to even more BIPA class action litigation.
Beyond the question of standing to sue, many interpretative issues regarding BIPA remain unresolved: what the standard of care might be in claims predicated on an organization's alleged "negligence," or "willfulness," what level of disclosure to individuals is sufficient, whether organization practices actually violate the requirements of BIPA, whether implied consent is a valid defense (especially in the employment context), what constitutes "possession" of biometric data, and what is considered "biometric information."
It will be interesting to follow how courts decide these issues in the years to come, and how organizations and their counsel will adapt their litigation and compliance strategies to account for the increasing costs of doing business in Illinois.
Client Alert 2019-050
This article is presented for informational purposes only and is not intended to constitute legal advice.
