The Illinois’ Biometric Information Privacy Act (740 ILCS 14/1 et seq.) (BIPA) requires that companies obtain written consent and disclose how they collect, retain, disclose and destroy biometric identifiers such as retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, or other biometric information from the public. BIPA provides “aggrieved” individuals a private right of action to sue, which if successful, could result in liability up to $1,000 per negligent violation and $5,000 per reckless violations, as well as attorneys’ fees and costs and injunctive relief – making it a favorite of the plaintiffs’ class action bar.

In the wake of conflicting opinions from Illinois state and federal district court opinions over the standing requirements to sue under the law, the Illinois Supreme Court has weighed in on the issue. The ruling arose in a putative class action alleging that defendant theme park collected  plaintiff’s teenage son’s thumbprint as part of his purchase of a season pass to the theme park. Plaintiff contended that neither she nor her son gave informed consent to the collection or retention of that biometric data. Plaintiff sought monetary damages and injunctive relief under the Act, but did not allege that her son suffered any actual harm as a result of the collection. Defendant thus argued that the putative class claims failed for lack of standing.

On appeal, the Illinois Supreme Court held that an individual need not allege an actual injury or adverse effect, beyond violation of his or her rights under the Act, in order to qualify as an “aggrieved” person and be entitled to seek liquidated damages and injunctive relief pursuant to the Act. In so holding, the Court reasoned that “[i]t is clear that the legislature intended for this provision to have substantial force” and that “[w]hatever expenses a business might incur to meet the law’s requirements are likely to be insignificant compared to the substantial and irreversible harm that could result if biometric identifiers and information are not properly safeguarded.” Moreover, the Court concluded that it would be “completely antithetical to the Act’s preventative and deterrent purposes” to require a showing of some compensable injury beyond violation of statutory rights. As a result, even technical violations of the Act resulting in no actual harm to any individual may lead to significant legal exposure for companies.

Illinois has been a leader in legislation protecting biometric privacy, and has the first statute providing a private right of action. Will other states considering biometric privacy protections follow suit? Will biometric privacy be the next big wave of class action litigation? We’ll be watching developments on this front.

Rosenbach v Six Flags, No. 2019 IL 123186 (Ill. Jan. 25, 2019).