On Friday, companies that collect biometric information suffered a major blow when the Illinois Supreme Court held that actual damages are not required to file suit under Illinois' Biometric Information Privacy Act (BIPA).

In the case, Rosenbach v. Six Flags Entertainment Corp., a teenage boy visited Six Flags Great America amusement park and registered for a season pass. The company scanned his thumbprint, which allowed him to access the park as a season pass holder. However, the company failed to provide any of the written notifications required by BIPA. For instance, under BIPA, a company that collects biometric information must notify the subject, in writing, that his or her biometric information is being collected or stored and the specific purpose and length of time for which it is being stored. Any person aggrieved by a violation of BIPA is entitled to file suit for actual damages or liquidated damages, whichever is greater.

The boy’s mother filed suit on his behalf for violations of BIPA. Six Flags argued that the plaintiff was not an "aggrieved" person, and therefore did not have standing to sue, because he did not have any actual damages. The Illinois Supreme Court disagreed. After examining the dictionary definition of "aggrieved," other courts' use of the term, and the legislature's intent in enacting the statute, the court held that an individual need not allege some actual injury in order to file suit under BIPA. The court’s opinion can be found here.

This ruling could have a major impact on employers that use biometric information, such as fingerprints, to log employees' work hours. Companies should be sure to review their policies and practices to ensure strict compliance with the statute, as any employee who does not receive the statutory notifications could potentially file suit, even if they have not suffered any actual harm.