On Nov. 20, 2018, the Illinois Supreme Court heard oral arguments in the case of Rosenbach v. Six Flags, which reportedly is the first case concerning Illinois’ Biometric Information Privacy Act (BIPA). The issue in the case was whether a person whose biometric data has been inappropriately collected in violation of BIPA has standing to sue under the Act’s private right of action.
The requirements of BIPA for collection and use of biometric information by private entities is outlined in Section 15(b), which requires that a private entity collecting a person’s biometric information (1) inform a person in writing that his or her biometric information is being collected, (2) explain the purpose and length of time for which the information will be used, and (3) receive written consent. In addition, Section 20 of the Act provides a right of action for “[a]ny person aggrieved by a violation of this Act” to recover damages, legal fees and other relief.
In this case, Stacy Rosenbach filed a lawsuit in the Circuit Court of Lake County, Ill., on behalf of her minor son, alleging that Six Flags had collected his fingerprint in violation of Section 15(b) and sought damages and injunctive relief pursuant to Section 20 of the Act. Six Flags moved for dismissal maintaining that Rosenbach was not “aggrieved” because there was no injury beyond the BIPA violation.