Over the past year, the number of class action lawsuits alleging violations of the Illinois Biometric Information Privacy Act (“BIPA” or the “Act”) has exceeded sixty. See here. A majority of these lawsuits have been filed against out-of-state companies with facilities or other locations in Illinois, that use biometric information in the workplace for such things as timekeeping, security access, wellness programs and workplace safety and efficiency.  Now, for the first time, an Illinois Appellate Court (2nd District, covering among others, DuPage, Kane, Lake, Kendall and McHenry counties) has held that without any actual injury, a technical violation of BIPA is not enough to allege a viable cause of action under the Act. Rosenbach v. Six Flags Entertainment Corp., 2017 IL App (2d) 170317, available here.

The Rosenbach decision is significant for companies that use biometric information and have offices, facilities or other locations in Illinois.  However, other Federal Courts and some State Courts have allowed similar suits to continue without an allegation of any harm.  Thus, Illinois employers that utilize fingerprint or retina technology should continue to ensure they create and implement BIPA policies and obtain their employees’ written consent for using/collecting their biometric information.

The Second District Appellate Court’s Decision

In Rosenbach, the Plaintiff (a mother of her minor son) alleged that when her son purchased a season pass for a Great America theme park from the Defendants, Six Flags Entertainment Corp. (“Six Flags”) and Great America LLC (“Great America”), he was finger printed (along with other customers) without obtaining written consent, or disclosing their plan for the collection, storage, use and destruction of their customers’ biometric identifiers or information.  The Plaintiff did not allege that her son sustained an actual injury, but that had she known of the Defendants’ conduct, she would not have allowed her son to purchase the pass. She sought $5,000 per violation for each potential class member (which could have added up to millions of dollars in damages). The Defendants moved to dismiss the complaint, which was denied by the trial court. The trial court later reconsidered its prior ruling and certified two questions relating to whether “a person aggrieved by a violation of the Act” must allege some actual harm.

The Illinois Appellate Court first considered the history, purpose, language of the Act and BIPA’s statutory requirements, which mandates that private entities (a) develop written policies made available to the public; (b) establish a retention schedule and guidelines for the destruction of biometric identifiers; (c) inform the subject that their biometric information is being stored and must receive written consent to collect the information; and (d) not sell or disclose the information without written consent. The Appellate Court also noted that the Act does not define an “aggrieved person.” Therefore, it relied on recent Federal Court and out-of-state decisions holding that alleging a technical violation of the Act is not enough and to be “aggrieved,” a plaintiff must allege some type of actual harm. Based on this, it found that a “plaintiff who alleges only a technical violation of the statute without alleging some injury or adverse effect is not an aggrieved person under section 20 of the Act.”

Takeaway from the Rosenbach Decision

While it is hopeful that this decision will turn the tide in favor of employers sued under BIPA, this is the first and only Illinois Appellate Court to provide any substantive guidance on this matter.  The Plaintiffs’ class action bar likely will continue to refine their arguments in an attempt to distinguish the Rosenbach decision by either bringing those suits outside of the Second District or in Federal Court, and allege that their clients have been “aggrieved.”  However, as more of these cases are appealed to other Illinois Appellate Courts, it is anticipated that the landscape will become clearer, and employers will begin to have more defenses in their arsenal to fight these lawsuits. We at Clark Hill will continue to monitor how other Illinois Appellate Courts rule on this issue and whether the plaintiff in Rosenbach attempts to appeal the decision to the Illinois Supreme Court.