In a unanimous decision handed down on January 25, 2019, the Illinois Supreme Court reversed a lower court opinion and held that a plaintiff need not show actual harm to seek relief under the Biometric Information and Privacy Act (BIPA). Instead, a procedural violation is sufficient to bring forth a claim under the law. The decision in Rosenbach v. Six Flags Entertainment Corp. is welcome news to plaintiffs’ attorneys, who will now have fewer impediments to pursue no-injury class action lawsuits under this biometric information protection statute, which allows for recovery of statutory damages of up to $5,000 per single violation and attorneys’ fees, with no cap on damages. Although the Rosenbach decision is at odds with most—but not all—federal case law on this issue, companies that collect, store, and use biometric information should be aware of its implications. The law applies broadly to all companies and vendors that collect biometric information, though it does entirely exempt certain entities, such as those financial institutions covered under the Gramm-Leach-Bliley Act. Thus far, companies that collect biometric data from their employees and customers have been the primary targets of BIPA class actions.
The Rosenbach complaint was filed on behalf of a minor whose fingerprints were collected and retained by defendant Six Flags in connection with a season pass to the amusement park. The plaintiff alleged that Six Flags violated BIPA by collecting the biometric fingerprint information without obtaining prior written consent, and by failing to inform the plaintiff and other class members of its data storage, use, and collection practices. Six Flags moved to dismiss the complaint, arguing that Rosenbach did not qualify as an “aggrieved person” under BIPA because he did not suffer an actual injury as a result of Six Flags’ failure to comply with the law’s requirements. An Illinois appellate court ruled in favor of Six Flags in December of 2017 and dismissed the case. Thereafter, in a different case, another Illinois appellate court found that a plaintiff does not need to allege actual harm to pursue a BIPA claim. The Illinois Supreme Court was thus poised to resolve the lower court split.
In reversing the lower court’s dismissal, the Illinois Supreme Court pointed out that the legislature has enacted other statutes that explicitly require a plaintiff to suffer actual harm to bring a claim but had not done so under BIPA. The court also rejected the notion that the harm in this case was merely technical. According to the court (and the state legislature), there is an inherent right to privacy associated with biometric data.
Enacted in 2008, BIPA is the oldest and most punitive of the biometric protection statutes in the United States. It remains the only biometrics law (for now) that provides for a private right of action, statutory damages, and attorneys’ fees. In each of the last few years, plaintiffs’ lawyers have filed dozens of putative class actions alleging violations of BIPA, against companies of all sizes. Following Rosenbach, the number of lawsuits against companies for BIPA violations will likely increase exponentially, because businesses will no longer be able to argue that plaintiffs should be forced to show actual harm before bringing claims under the law—at least in those cases brought in Illinois state courts.
On the other hand, there is still uncertainty surrounding whether procedural harm alone is sufficient for plaintiffs to meet Article III’s standing requirement in federal court. In March 2018, a federal district court in California allowed plaintiffs to move forward in a BIPA lawsuit against Facebook—even though the plaintiffs did not allege any actual injury—because the court found that the Illinois legislature had “codified a right of privacy in personal biometric information” and that right “is quintessentially an intangible harm that constitutes an injury in fact.” In December 2018, however, a federal district court in Illinois reached an opposite conclusion, finding that a mere procedural violation of BIPA cannot confer Article III standing to plaintiffs.
How the BIPA standing issue gets resolved at the federal court level remains to be seen. Nevertheless, there will be an uptick of BIPA litigation in Illinois state court. Companies that have not paid particularly close attention to the law’s disclosure and written consent requirements now face increased pressure to do so or risk litigation exposure.
[View source.]
