NEWSFLASH! No Harm, Major Foul: Violators of BIPA Won’t Get Off on a Technicality
Authors: Audrey E. Gamble, Esquire & Robert D. Tepper, Esquire
Illinois’ Biometric Information Privacy Act (“BIPA”) has garnered significant attention nationwide for its unique grant of a private right of action for any person “aggrieved” by a violation of the Act. Now, in light of the Illinois Supreme Court’s ruling in Rosenbach v. Six Flags Entertainment Corp., litigants have even more incentive to bring lawsuits in Illinois for alleged BIPA violations as they do not need to prove actual damages to bring a claim. A mere violation of the Act is sufficient to file suit.
The Rosenbach case centers around Six Flags Great America amusement park’s use of biometric data in the form of thumbprints to register and identify season pass holders. The plaintiff, who brought the suit on behalf of her minor son after his thumbprint was collected by the park on a school trip, alleged that the park violated BIPA by collecting and storing biometric information without meeting the written notice requirements or obtaining the required release. The defendants argued that a plaintiff is not “aggrieved” unless she can allege that she suffered harm and that the defendant’s conduct amounted to more than just a “technical violation” of the Act. The Illinois Supreme Court disagreed, and found that a person is “aggrieved” when a legal right is invaded, infringed upon, or adversely affected. Under BIPA, a violation of the statutory procedures is not a mere technicality, but a real and significant injury to the right to privacy. Actual damages are not required.
When BIPA was enacted, the Illinois General Assembly observed that “[t]he full ramifications of biometric technology are not fully known.” The Illinois Supreme Court’s approach to the statute is grounded in this same wariness. Rosenbach is the first interpretation of a biometric information privacy statute by a state supreme court, and the court’s caution regarding the regulation of biometric technology is bound to have a ripple effect across the landscape of the pending litigation.
It is anticipated that plaintiff attorneys will now start to file multiple class actions against employers and organizations that violate the Act in Illinois. Insurers and policy holders can also expect insurance coverage litigation as policy holders seek coverage for these claims.
As the private right of action under BIPA picks up speed, businesses who utilize biometric data should enforce their privacy procedures with matching vigor. To learn more about the requirements and penalties of BIPA, please refer to our October NEWSFLASH, Employers Beware: You Can’t Touch This.
For more information, please contact Robert D. Tepper, Esquire at rtepper@satcltd.com.
