In Illinois, the courts are grappling with an issue akin to the Article 3 standing issues that courts have been analyzing in post-breach cases for years, that is, whether a plaintiff must claim actual harm as a result of a statutory violation or whether the violation is sufficient by itself to support standing to sue.

On November 20, 2018, the Illinois Supreme Court heard oral arguments on the issue of whether the State’s Biometric Information Privacy Act (BIPA) requires a plaintiff to allege “actual harm” and not just a technical violation of the statute in order to pursue a private right of action under BIPA. This case presents an opportunity for the court to resolve an inter-district split on this issue (discussed below) that arose this year in Rosenbach v. Six Flags Entm’t Corp., 2017 IL App (2d) 170317 and Sekura v. Krishna Schaumburg Tan, Inc., 2018 IL App (1st) 180175. In the Rosenbach case, the Second District Appellate Court held that the plaintiff was not “aggrieved” under BIPA when the amusement park fingerprinted her son without properly obtaining consent or providing notice about the use, collection, storage, or destruction of his biometric information, because she failed to allege actual harm.

BIPA provides a private right of action for “aggrieved” persons. State courts are split, however, on what constitutes an “aggrieved” person. Because BIPA does not define the term “aggrieved” the Second District looked to the dictionary to define the word and found that without a claim of actual harm, allowing a private right of action in every instance of procedural noncompliance with BIPA would render the word ‘“aggrieved” superfluous. Therefore, the court held that a plaintiff that alleges only technical violations of the notice and consent provisions of the law, without claiming some adverse effect or harm, is not an aggrieved person and does not have a private right of action.

Recently, the First District Appellate Court held the opposite – that pursuant to the plain language of the statute and its legislative history and purpose, BIPA does not require harm in addition to a violation of the Act in order to file suit. In Sekura, the plaintiff alleged that a tanning salon inappropriately disclosed her fingerprints to an out-of-state third-party vendor, which caused her “emotional upset” and “mental anguish.” The First District found that a technical violation of the law adversely affects an individual’s legal right to privacy in their biometric information and claiming a technical violation is sufficient to maintain a cause of action. The First District further found that even if Rosenbach was correctly decided (that an additional harm is required), the Sekura case is distinguishable because unlike the plaintiff in Rosenbach, the plaintiff in Sekura alleged an injury or adverse effect – disclosure to a third-party vendor and mental anguish.

Oral arguments in Rosenbach on November 20 focused on the meaning of the term “aggrieved” and what constitutes “harm” under BIPA. Both parties invoked legislative intent and statutory interpretation. Rosebach argued that a violation of BIPA itself was sufficient to establish standing to bring a lawsuit. Six Flags on the other hand argued that the term “aggrieved” required an independent question about harm subsequent to establishing a violation of BIPA.

If the Illinois Supreme Court finds that simply alleging a technical violation of the law is sufficient to sustain a cause of action, BIPA lawsuits may drastically increase, potentially exposing businesses to the law’s steep liquidated damages penalties of up to $5,000 per violation. A decision in this case is expected in early 2019.