On December 21, 2017, an Illinois appellate court issued an opinion that will significantly slow down the onslaught of putative class action lawsuits filed under Illinois’s Biometric Information Privacy Act (“BIPA”). In Rosenbach v. Six Flags Entertainment Corp., et al., 2017 IL App (2d) 170317, the court held that a BIPA plaintiff who alleges a statutory violation without a resulting injury may not sue under the statute. This is the first significant guidance an Illinois appellate court has provided about who may sue under BIPA, and is sure to derail many current and potential BIPA cases that allege no injury beyond a claimed statutory violation.

BIPA basics: the statute regulates private entities’ collection, storage, and use of biometric information. 
BIPA regulates private entities’ collection, storage, and use of a defined class of biometric information, which is limited to “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry,” or any information derived from those things. 740 ILCS 14/10. 

Under the statute, a private entity may not capture, buy, or otherwise obtain a person’s biometrics unless it first does the following: (1) develops a publicly available written retention schedule governing how long the biometrics will be kept; (2) gives the person written notice that the biometrics are being collected or stored, the purpose of doing so, and how long the biometrics will be kept; and, (3) obtains a written release from the person. 740 ILCS 14/15(a), (b). BIPA also prohibits companies from selling biometrics and restricts how such information can be transmitted and stored.

There is a private right of action under the statute for any “person aggrieved” by a statutory violation, and plaintiffs may seek the greater of either actual damages or “liquidated damages” of $1,000 for a negligent violation or $5,000 for an intentional or reckless violation. 740 ILCS 14/20. Reasonable attorneys’ fees and injunctive relief are also available. Id. 

“Person aggrieved” is not defined in the statute, and while some federal district courts have addressed this requirement for a private right of action, Illinois courts have not provided guidance on what this term means. Compare McCollough v. Smarte Carte, Inc., 2016 WL 4077108, at *4 (N.D. Ill. Aug. 1, 2016) (dismissing BIPA action for lack of actual damages) and Vigil v. Take-Two Interactive Software, Inc., 235 F. Supp. 3d 499, 521 (S.D.N.Y. 2017) (dismissing BIPA claim where there was no injury attributable to procedural BIPA violation) (aff’d 2017 WL 5592589 (2nd Cir. Nov. 21, 2017)) with Monroy v. Shutterfly, Inc., 2017 WL 4099846, at *9 (N.D. Ill. Sept. 15, 2017) (rejecting argument that “person aggrieved” requires an actual injury). 

In Rosenbach, the appellate court limited a “person aggrieved” to people with an actual injury.
In Rosenbach, defendants allegedly collected plaintiffs’ fingerprints in connection with purchases of season passes to defendants’ theme park. Defendants allegedly did not provide the specific notice or receive from plaintiff the written release required by BIPA. Plaintiff did not allege that she or her son—who purchased the season pass—were injured by these alleged violations. Instead, plaintiff claimed that she would not have allowed the purchase if she had known about defendants’ conduct. The district court denied a motion to dismiss but allowed an interlocutory appeal to address the meaning of “person aggrieved.” 

The appellate court noted that the generally accepted definition of “aggrieved” suggested a requirement for an actual injury, adverse effect, or harm. 2017 IL App (2d) 170317, ¶ 20. Using this definition, the court found instructive rulings in McCollough and Vigil, and held that “[a]lleging only technical violations of the notice and consent provisions of the statute … does not equate to alleging an adverse effect or harm.” Id. ¶ 21. Further, the court found that the inclusion of the word “aggrieved” in BIPA signals the Illinois legislature’s intent that not every technical violation is actionable. Id. ¶ 23 (“A determination that a technical violation of the statute is actionable would render the word “aggrieved” superfluous.”). Therefore, the court held, “a plaintiff who alleges only a technical violation of the statute without alleging some injury or adverse effect is not an aggrieved person under” BIPA. Id. An injury or adverse effect need not be pecuniary, however. Id. ¶ 28.  

Subject to any further review, the Rosenbach holding significantly curtails potential plaintiffs’ ability to bring BIPA actions where the statutory violations have not resulted in a concrete injury. And for defendants in state courts where Spokeo-type standing arguments are not available, this holding gives defendants a solid basis for early dispositive motions in cases where plaintiffs do not allege an injury or harm.