No actual injury necessary for Illinois biometric privacy act suit; fingerprint scan suit revived

By Gregory Kane, J.D., M.B.A. — Apart from the statutory violation itself, no actual injury or harm is necessary to pursue an action for violation of the Illinois Biometric Information Privacy Act.

In a closely watched non-employment case, the Illinois Supreme Court ruled that a violation of the Illinois Biometric Privacy Act is sufficient grounds, without need of additional injury, to bring a cause of action against a private entity. Accordingly, the mother of a 14-year-old boy who was fingerprinted at an amusement park with the biometric data retained by the park’s operators in violation of the Act was successful in overturning the dismissal of her case for failure to state a claim (Rosenbach v. Six Flags Entertainment Corp., January 25, 2019, Karmeier, L.).

Six Flags fingerprinting. Six Flags Entertainment Corporation and its subsidiary own and operate an amusement park in Gurnee, Illinois. As part of their repeat-entry passes to the park, Six Flags uses a fingerprinting process which collects, records, and stores biometric identifiers and information gleaned from the fingerprints and then stores that data in order to verify customer identities upon subsequent visits.

In 2014, the 14-year-old son of Stacy Rosenbach visited the amusement park on a school field trip, signed her son up for a repeat-entry pass online, and paid for it. When he arrived at the park, the son was fingerprinted. Rosenbach had no prior notice of the collection of biometric data, nor was she provided with information on the specific purpose and length of term for which his fingerprint had been collected. Further, she had not signed a written release for the fingerprint to be taken, the court noted.

Litigation history. She sued in Illinois state circuit court on behalf of her son and all other similarly situated persons on the grounds that they had suffered a violation of the Act, seeking injunctive relief to compel the defendants to make disclosures pursuant to the Act’s requirements and to prohibit violations going forward. They also asserted a claim for common-law unjust enrichment. The defendants moved to dismiss arguing that there was no actual or threatened injury and that Rosenbach lacked standing. The circuit court denied the motion to dismiss; however, it dismissed the unjust enrichment claim with prejudice.

But the Illinois appellate court reversed, effectively granting the motion to dismiss and reasoning that the mere violation of the Act was insufficient to grant standing without additional injury or adverse effect. That ruling was characterized at the time as a “significant victory for employers.”

Biometric Privacy Information Act. Rosenbach’s petition to the Illinois Supreme Court for leave to appeal was granted. The intent of the Act was to help regulate “the collection, use, safeguarding, handling, storage, retention and destruction of biometric identifiers and information,” the state high court noted. The Act imposes various obligations on private entities, such as Six Flags, including a process by which biometric information may be gathered that includes providing detailed information to the individual and obtaining a written release. The Act provides for the enforcement of these provisions through private rights of action.

Statutory intent. Finding the need for additional injury, as the appellate court had, was in contrast to another appellate court in a separate matter, which found that no additional injury was required: In re Facebook Biometric Information Privacy Litigation, 326 F.R.D. 535. Constraining a plaintiff’s right to bring a cause of action to circumstances where the plaintiff has sustained actual damage beyond violation of the rights conferred by the Act was against the statutory intent. When the Illinois General Assembly has sought to impose such a requirement, it made that intent clear, according to the court.

“Aggrieved” party. When, as with the AIDS Confidentiality Act, the Act does not contain its own definition of what it means to be an “aggrieved” party, the assumption is that the legislature intended the term to have its popular or legal meaning. The the term “aggrieved” would encompass a person who had their legal rights invaded such as through the violation of a statute is the understanding repeated frequently in Illinois courts. As a result, when a private entity fails to comply with the requirements of the Act to the extent that the violation constitutes an invasion, impairment, or denial of the statutory rights of any person, then the person would be aggrieved within the meaning of the Act and would be entitled to seek recovery under its private right of action. No additional injury is required. The appellate court’s ruling was reversed and the case remanded to the circuit court for further proceedings.

Source: http://www.employmentlawdaily.com/index.php/news/no-actual-injury-necessary-for-illinoisbiometric-privacy-act-suit-fingerprint-scan-suit-revived/