On Nov. 20, 2018, the Illinois Supreme Court heard oral arguments in the case of Rosenbach v. Six Flags, which reportedly is the first case concerning Illinois’ Biometric Information Privacy Act (BIPA). The issue in the case was whether a person whose biometric data has been inappropriately collected in violation of BIPA has standing to sue under the Act’s private right of action.
The requirements of BIPA for collection and use of biometric information by private entities is outlined in Section 15(b), which requires that a private entity collecting a person’s biometric information (1) inform a person in writing that his or her biometric information is being collected, (2) explain the purpose and length of time for which the information will be used, and (3) receive written consent. In addition, Section 20 of the Act provides a right of action for “[a]ny person aggrieved by a violation of this Act” to recover damages, legal fees and other relief.
In this case, Stacy Rosenbach filed a lawsuit in the Circuit Court of Lake County, Ill., on behalf of her minor son, alleging that Six Flags had collected his fingerprint in violation of Section 15(b) and sought damages and injunctive relief pursuant to Section 20 of the Act. Six Flags moved for dismissal maintaining that Rosenbach was not “aggrieved” because there was no injury beyond the BIPA violation.
The trial court denied the motion but certified a question for interlocutory appeal as to whether an individual whose only alleged injury is a violation of the notice and consent provisions of Section 15(b) is “aggrieved” under Section 20.
The Illinois Appellate Court, Second District, interpreted Section 20 to read that such an individual was not “aggrieved.” Rosenbach v. Six Flags Entertainment Corp., 2017 IL App (2d) 170317U. Rosenbach then appealed to the Illinois Supreme Court.
She argued in the Illinois Supreme Court appeal that “aggrieved” means “deprived of a legal right”: in this case, the right to make an informed decision about collection of one’s biometric information. According to the Rosenbach brief, Six Flags’s interpretation would render the notice and consent provisions of Section 15(b) unenforceable.
In reply, Six Flags argued that a person must be “adversely affected” or “harmed” in order to be “aggrieved.” Six Flags argued that Rosenbach’s interpretation of the law would render superfluous the phrase “person aggrieved by a violation,” because the word “aggrieved” would not add any meaning beyond the existence of the statutory violation.
Some of the comments from the oral argument were that it seemed that some of the justices were skeptical of Six Flags’s position. The Supreme Court panel asked whether its interpretation would allow companies to violate the notice of consent provisions with impunity and noted that punishment after an actual injury, such as an inappropriate disclosure or data breach, would be “too late.” The Supreme Court also referenced the case of Sekora v. Krishna Schaumburg Tan Inc., a recent decision in which a different Illinois Appellate Court disagreed with Six Flags’s interpretation of this statute. By contrast, the Supreme Court justices spent much less time questioning Rosenbach’s attorney. The Supreme Court panel’s main inquiry was to ask whether “legal right” referenced in her definition of “aggrieved” arose.
According to the reporting, the oral argument and briefing in this case, the Illinois Supreme Court’s decision may have far-reaching implications for the future of biometric litigation in Illinois. Some have argued that an injury beyond a violation of BIPA is required in order for a lawsuit would gut the ability of individuals to protect their biometric information. An amicus brief by privacy groups including the ACLU and the EFF and a separate brief by Electronic Privacy Information Center, both are in support of Rosenbach.
Many businesses take sides with Six Flags, maintaining support for the narrower interpretation of Section 20. Amicus briefs filed on behalf of restaurants, retail businesses and the Illinois Chamber of Commerce aim to protect employers, and many of them use biometric systems to monitor their employees as they check in and out. Some of these cases have stayed pending the Rosenbach decision. The Internet Association also filed an amicus brief in support of Six Flags, recognizing that Rosenbach may affect lawsuits concerning the application of facial recognition technology to online photographs. In the past, the tech companies, Google, Facebook, Shutterfly and SnapChat have all been subject to lawsuits.
BIPA is one of the most stringent biometric privacy laws in the country. This case may determine the future of the Illinois law.
Rosenbach v. Six Flags Entertainment Corp. and Great America, LLC, No. 123186 (Ill. 2018).
Kreisman Law Offices has been handling corporate matters, contract disputes, business litigation, shareholder lawsuits, partnership disputes, probate litigation and guardianships for individuals, families and loved ones for more than 40 years in and around Chicago, Cook County and its surrounding areas, including Rosemont, Richton Park, Barrington, Antioch, Arlington Heights, Orland Park, Palos Park, Palatine, Flossmoor, Olympia Fields, Chicago (East Garfield Park, East Rogers Park, Ukrainian Village, Fulton River District, Humboldt Park, Buena Park, Bucktown, Bronzeville, Bridgeport, Beverly, Archer Heights, Albany Park, Uptown, West Loop, Sauganash, Roscoe Village, River North), Hinsdale, Romeoville, Bolingbrook, Joliet, Waukegan and Midlothian, Ill.
Related blog posts: