Illinois Supreme Court Holds Aggrieved Person Under Biometric Information Privacy Act Need Not Show Actual Injury

The Supreme Court of the State of Illinois (“Illinois Supreme Court” ) held in its opinion filed on January 25, 2019 that an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Biometric Information Privacy Act (“Act”) (740 ILCS 14/1 et seq. (West 2016)), in order to qualify as an “aggrieved” person and be entitled to seek liquidated damages and injunctive relief pursuant to the Act.

The Act was enacted in 2008 to help regulate “the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” § 5(g). The Act defines “biometric identifier” to mean “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” § 10. “Biometric information” means “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual.”

The Act imposes numerous restrictions on how private entities collect, retain, disclose and destroy biometric identifiers. Section 15 of the Act (§ 15) imposes on private entities various obligations regarding the collection, retention, disclosure, and destruction of biometric indentifiers and biometric information. Among these is the following:  (b) No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier or biometric information, unless it first: (1) informs the subject or the subject’s legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored; (2) informs the subject or the subject’s legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and (3) receives a written release executed by the subject of the biometric identifier or biometric information or the subject’s legally authorized representative.

Under the Act, any person “aggrieved” by a violation of its provisions “shall have a right of action *** against an offending party” and “may recover for each violation” the greater of liquidated damages or actual damages, reasonable attorney fees and costs, and any other relief, including an injunction, that the court deems appropriate. § 20.

In the case the Illinois Supreme Court was deciding,  Six Flags Entertainment Corporation and its subsidiary Great America LLC (“defendants”) own and operate the Six Flags Great America amusement park in Gurnee, Illinois. Defendants sell repeat-entry passes to the park. Since at least 2014, defendants have used a fingerprinting process when issuing those passes. The defendants’ system scans pass holders’ fingerprints; collects, records and stores ‘biometric’ identifiers and information gleaned from the fingerprints; and then stores that data in order to quickly verify customer identities upon subsequent visits by having customers scan their fingerprints to enter the theme park, making entry into the park faster and more seamless, maximizing the time pass holders are in the park spending money, and eliminating lost revenue due to fraud or park entry with someone else’s pass.

The plaintiff’s 14-year-old son visited defendants’ amusement park on a school field trip in May or June 2014, while the fingerprinting system was in operation. The plaintiff purchased a season pass for her son online. The plaintiff paid for the pass and provided personal information about her son, but he had to complete the sign-up process in person once he arrived at the amusement park. The process involved two steps. First, the plaintiff’s son went to a security checkpoint, where he was asked to scan his thumb into defendants’ biometric data capture system. After that, he was directed to a nearby administrative building, where he obtained a season pass card. The card and his thumbprint, when used together, enabled him to gain access as a season pass holder.

The plaintiff’s class-action complaint alleged that neither the plaintiff nor her minor son were informed in writing or in any other way of the specific purpose and length of term for which his fingerprint had been collected. Neither of them signed any written release regarding taking of the fingerprint, and neither of them consented in writing “to the collection, storage, use sale, lease, dissemination, disclosure, redisclosure, or trade of, or for [defendants] to otherwise profit from, [the son’s] thumbprint or associated biometric identifiers or information.”

The defendants argued, and the intermediate appellate court agreed,  that  a plaintiff is not “aggrieved” within the meaning of the Act and may not pursue either damages or injunctive relief under the Act based solely on a defendant’s violation of the statute. Additional injury or adverse effect must be alleged. The injury or adverse effect need not be pecuniary, the appellate court held, but it must be more than a “technical violation of the Act.”

The Illinois Supreme Court stated that through the Act, the Illinois General Assembly has codified that individuals possess a right to privacy in and control over their biometric identifiers and biometric information. The duties imposed on private entities by section 15 of the Act regarding the collection, retention, disclosure, and destruction of a person’s or customer’s biometric identifiers or biometric information define the contours of that statutory right. The Illinois Supreme Court held that accordingly, when a private entity fails to comply with one of section 15’s requirements, that violation constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose biometric identifier or biometric information is subject to the breach. Such a person or customer would clearly be “aggrieved” within the meaning of section 20 of the Act and entitled to seek recovery under that provision (a person is prejudiced or aggrieved, in the legal sense, when a legal right is invaded by the act complained of or his pecuniary interest is directly affected by the decree or judgment.). No additional consequences need be pleaded or proved. The violation, in itself, is sufficient to support the individual’s or customer’s statutory cause of action.

Source

If your business is presently or may soon be involved in litigation in the United States, email us at info@businesslitigationcontingencylawyers.com or telephone us toll-free in the United States at 800-756-2143 to find business litigation contingency lawyers who may handle your business litigation matter on a contingency basis.

BusinessLitigationContingencyLawyers.com – The Practical Solution For Business Litigation