On January 25 in a unanimous decision, the Illinois Supreme Court ruled that a plaintiff need not allege or demonstrate actual harm to have standing to pursue a claim under the Illinois Biometric Information Privacy Act (“BIPA”); a statutory privacy loss is injury enough. Rosenbach v. Six Flags Ent. Corp., No. 123186 (Jan. 25, 2019).

The Illinois law prohibits companies from gathering, using, or sharing biometric information without informed opt-in consent, and creates a private right of action for individuals “aggrieved” by a company’s statutory violations. Rosenbach focused on whether a season pass holder alleging Six Flags violated BIPA by failing to obtain consent before collecting his thumbprint without alleging a separate, real-world harm was an “aggrieved” person under the statute.

The lower court ruled against the plaintiff, finding that plaintiffs seeking recourse under BIPA must show specific injuries – such as stolen identity or monetary loss – in order to meet the statute’s “aggrieved person” standing requirements. But the Illinois Supreme Court overruled the decision, rejecting arguments that BIPA required an injury beyond a loss of statutory privacy rights, or “technical” violations.

In its decision, the court analyzed the underlying purposes of BIPA and concluded that requiring individuals to wait until they have sustained some compensable injury beyond a technical violation before they may seek recourse would completely negate BIPA’s “preventative and deterrent purposes.” Moreover, expenses a business might incur to fully comply with BIPA’s requirements are likely insignificant compared to the risk of irreversible harm individuals could suffer if their biometric data is compromised. As a result, BIPA’s “aggrieved person” standing requirement encompasses individuals whose biometric information has been taken without proper consent.

Implications Beyond Rosenbach v. Six Flags

This ruling has significant implications beyond Six Flags season pass holders. While there remain other novel statutory interpretation questions and defenses to be litigated, this is a critical defeat for the more than 200 pending cases accusing hotels, supermarkets, and other businesses of breaching BIPA by capturing their customers’ or employees’ biometric data without their consent, as the statute provides for damages of $1,000 per negligence violation or $5,000 per intentional or reckless violation.

In light of the court’s decision, companies collecting biometric information need to be increasingly specific about their collections by obtaining informed consent detailing the purpose, duration, and safeguards for such data. As Rosenbach has made clear, even a slight technical violation may subject a company to liability.

This Client Alert has been prepared by Tucker Ellis LLP for the use of our clients. Although prepared by professionals, it should not be used as a substitute for legal counseling in specific situations. Readers should not act upon the information contained herein without professional guidance.