In a unanimous decision issued Jan. 25, 2019, the Illinois Supreme Court held that a plaintiff need not plead or prove actual harm to bring a claim under Illinois’ Biometric Information Privacy Act (BIPA). The court’s decision in Rosenbach v. Six Flags Entertainment Corp. settles a split among Illinois’ appellate courts, which centered on what a plaintiff needs to plead to be considered “aggrieved” under BIPA.
BIPA, 740 ILCS 14/1, et seq, regulates how private entities may collect and use an individual’s biometric information (e.g., fingerprint, facial feature, or retina information). Illinois is one of a few states that has enacted a statute to protect biometric information, and it is the only state that provides a private cause of action for individuals. Under BIPA, “[a]ny person aggrieved by a violation of [the] Act shall have a right of action.” (Emphasis added.) 740 ILCS 14/20.
In Rosenbach, the plaintiff sought to recover under BIPA after she alleged Six Flags theme park collected her 14-year-old son’s fingerprints for a season pass without complying with the notice and consent provisions of BIPA. But the plaintiff did not plead that her son had suffered any sort of actual harm, such as his fingerprint information being lost or disclosed to a third party. In 2017, the Second District dismissed the plaintiff’s BIPA claim, finding that she did not allege any actual harm and thus was not “aggrieved” under the statute.
In reversing the Second District’s opinion, the Illinois Supreme Court made clear that a plaintiff need not allege any actual harm to state a claim under BIPA. The court first noted that the Illinois General Assembly can make clear when it intends that a plaintiff show actual harm in bringing a private cause of action. The court cited Illinois’ Consumer Fraud and Deceptive Business Practices Act as an example of when actual harm is clearly required. The court found BIPA was more like the Illinois AIDS Confidentiality Act, which also creates a private right of action for any person “aggrieved” by a violation of the act but does not require proof of actual harm.
Next, noting that BIPA did not define the term “aggrieved,” the court looked to how it had defined the term in the past, as well as more general, popular definitions. The court noted that both definitions supported a finding that a technical violation of the statute rendered a plaintiff “aggrieved.”
Perhaps the court’s strongest justification for reversal was what it viewed as the overriding purpose of BIPA, which was to preserve an individual’s “right to control their biometric information.” Requiring a plaintiff to plead actual harm “misapprehends” BIPA’s purpose. Accordingly, the court found that a technical violation of the statute — i.e., collecting a person’s biometric information without consent or notice — denies the individual the right to control their biometric privacy. The court stated, “[t]his is no mere ‘technicality.’ This injury is real and significant.”
The court’s decision appears to settle a threshold question for most, if not all, plaintiffs bringing BIPA claims. Illinois was already experiencing a rise in BIPA-focused suits, with about 200 cases being filed in recent years. With the court ruling technical violations can render a plaintiff “aggrieved” under BIPA, Illinois courts will likely see this trend continue.