Labor and Employment Alert: Illinois Appeals Court Holds That the Biometric Information Privacy Act Requires Actual Injury
As we previously reported, the Illinois Biometric Information Privacy Act (BIPA) requires individuals and companies to provide notice and obtain consent before collecting or using biometric data and then ensure the proper storage and disposal of that data. Numerous employers have faced class action lawsuits for failing to assiduously comply with BIPA’s requirements. But a recent ruling by an Illinois Appellate Court in Rosenbach v. Six Flags Entertainment may grant employers a reprieve.
The plaintiff in Rosenbach claimed that Six Flags violated BIPA when her son purchased a season pass for a Great America theme park and was fingerprinted without properly obtaining written consent or disclosing the company’s plan for the collection, storage, use or destruction of his biometric identifiers or information. The fingerprint is used as part of the security process for entering the park. The plaintiff did not claim that she or her son had suffered any actual injury. Instead, she claimed that, had she known of the company’s conduct, she would not have allowed her son to purchase the pass. She claimed that this made her a “person aggrieved by a violation of” BIPA and therefore entitled her and the putative class to the maximum statutory or actual damages the law provides –$5,000 per violation (plus attorney’s fees).
BIPA does not define what it means to be an “aggrieved” person. So the trial court requested the Appellate Court to determine whether an aggrieved person must suffer actual harm or whether a technical violation of BIPA’s notice and consent requirements suffices to incur liability. Six Flags argued that the interpretation of “aggrieved” most consistent with BIPA’s language and purpose is that the statute requires actual harm or other adverse consequences. The plaintiff contended that any technical violation is sufficient. The Appellate Court rejected the plaintiff’s position and ultimately concluded that some actual harm must be suffered.
The Court first looked to dictionary definitions which suggest there must be an actual injury, adverse effect, or other harm for the person to be “aggrieved.” The Court found these definitions to be consistent with a recent federal district court decision that had interpreted BIPA to require actual harm; that case had rejected the contention that mere technical violations of BIPA’s notice and consent provisions equated to actual harm. Finally, the court noted that, had the Illinois legislature intended to allow for a private cause of action for every technical violation of BIPA, it could have omitted the word “aggrieved” and stated that every violation was actionable. But this is not what the statute says. “A determination that a technical violation of the statute is actionable would render the word ‘aggrieved’ superfluous. Therefore, a plaintiff who alleges only a technical violation of the statute without alleging some injury or adverse effect is not an aggrieved person.”
The Rosenbach decision is an important one for Illinois employers that use or collect biometric information because it limits BIPA actions to those having an “injury, adverse effect, or harm.” Mere technical violations – like those alleged in the majority of pending BIPA class actions – should no longer suffice. Contact your Vorys lawyer if you have questions about complying with the BIPA.
