KD Alert: Illinois Supreme Court Issues Watershed Six Flags Illinois “BIPA” Decision Allowing Claims for Technical Violations of Act

The Illinois Supreme Court issued its highly anticipated decision today in Stacey Rosenbach v. Six Flags Entertainment Corporation, et al., which decision is cited at 2019 IL 123186. Plaintiff in Six Flags is the mother of minor Alexander Rosenbach, and the action is brought on behalf of Alexander and a putative similarly-situated class of individuals, who had their fingerprints scanned at Six Flags amusement parks for use in conjunction with repeat-entry passes. Plaintiff alleged that the fingerprints were taken without any written guidelines provided by the defendants regarding collection, use or disposition of such fingerprints, and without obtaining informed written consent. Plaintiff alleges the defendants’ conduct violates the requirements of the Illinois Biometric Privacy Act (740 ILCS 14/1 et seq.) (“BIPA”) and entitles Plaintiff and the class to liquidated damages and injunctive relief under BIPA.The case was on a permissive interlocutory appeal from the Second District Court of Appeals for Illinois after the Second District had taken up an interlocutory appeal and granted the 2-615 motion to dismiss filed by Defendant Six Flags and its co-defendants. The issues presented to the Illinois Supreme Court were essentially whether a plaintiff is “aggrieved” under the meaning of BIPA for only a technical violation of the statute, and in turn whether liquidated and injunctive relief is available under BIPA for such technical violations. More specifically, the two issues presented to the Illinois Supreme Court were:

(1) “[w]hether an individual is an aggrieved person under §20 of the Illinois Biometric Information Privacy Act, 740 ILCS 14/20, and may seek statutory liquidated damages authorized under §20(1) of the Act when the only injury he alleges is a violation of §15(b) of the Act by a private entity who collected his biometric identifiers and/or biometric information without providing him the required disclosures and obtaining his written consent as required by §15(b) of the Act” and

(2) “[w]hether an individual is an aggrieved person under §20 of the Illinois Biometric Information Privacy Act, 740 ILCS 14/20, and may seek injunctive relief authorized under §20(4) of the Act, when the only injury he alleges is a violation of §15(b) of the Act by a private entity who collected his biometric identifiers and/or biometric information without providing him the required disclosures and obtaining his written consent as required by §15(b) of the Act.”

The Court overturned the Second District and found the dismissal was incorrect. The court found that “aggrieved” as an undefined term in the statute should be given its common meaning akin to “having a substantial grievance; a denial of some personal or property right.” ¶ 30. The Court further adopted dictionary definitions of the term that equate to infringement upon or adversely affecting an individual’s “legal rights.” ¶ 32. The Court held that BIPA codifies an individual right to privacy in and control over biometric identifiers and biometric information, and that BIPA defines the “contours” of that statutory right. ¶ 33. The Court consequently concluded that a person or customer is “aggrieved” under BIPA when a private entity fails to comply with the requirements in Section 15 of BIPA, because it denies such person of a legal right. ¶33. Elaborating, the Court held that BIPA is intended to protect the right of an individual to control their biometric information, and that when breached, the “injury is real and significant.” ¶ 34.

The Court made a point to state that BIPA is intended to have “substantial force” as a preventative measure based upon its liquidated damages, injunctive relief and attorney fees and costs recovery provisions, chiding that the cost to comply with BIPA is far less than the potential harm to an individual whose biometric identifiers and information is not properly safeguarded. ¶¶ 36-37. The Court found that the violation of BIPA, even if only technical, renders an individual “aggrieved” under the statute and permits the pursuit of the remedies available under BIPA. The Court thus reversed the Second District Court of Appeal and denied the motion to dismiss, remanding the case for further proceedings.

The Court’s ruling thus overturns the primary decision under Illinois law supporting an “actual injury” approach to claims brought under BIPA, and aligns with the First District’s position set forth in Sekura v. Krishna Schaumburg Tan, Inc., 2018 IL App (1st) 180175. The Court further noted that its decision was the outcome predicted in the Facebook decision, In re Facebook Biometric Information Privacy Litigation, 326 F.R.D. 535 (N.D. Cal. 2018). The obvious practical implication of the Six Flags decision is that BIPA actions are going to be more easily pursued in Illinois and elsewhere, and technical violations of the statute will likely be sufficient to maintain an action and may allow the invocation of the significant remedies set forth in BIPA for each violation.