Private Employers Take Note: Actual Injury Not Necessary to Pursue Biometric Privacy Violation Claim

The Illinois Biometric Information Privacy Act (the “Act”), 740 ILCS 14/1 et seq., places a number of restrictions on how private entities may collect, retain, disclose, and destroy biometric identifiers, including, but not limited to, fingerprints.   Specifically, the Act requires a private entity that collects this information to inform the subject in writing that a biometric identifier is being collected from them and the specific purpose and length of the term for which the biometric information is being collected, used, and stored.  The Act also requires that the entity receive a written release from the individual from whom the biometric information is being taken from. 

A prevailing plaintiff may recover either (a) actual damages or (b) liquidated damages of $1,000 for each negligent violation of the Act or $5,000 for each reckless or intentional violation.  The Illinois Supreme Court, faced with the question of whether a plaintiff qualifies as an “aggrieved” person under the Act if he or she has not alleged an actual injury or adverse effect, recently ruled that a technical violation of the Act is, in itself, enough to support a claim.  Rosenbach v. Six Flags Entertainment (January 25, 2019).

In Rosenbach, the mother of a teenager brought a lawsuit against Six Flags Entertainment based on her son’s fingerprint being collected when he purchased a season pass to the Six Flags Great America amusement park.  Neither the teen nor his mother were informed in writing, or in any other way, of the purpose and length of time for which his fingerprint was collected, and neither signed a release consenting to the amusement park’s collection and storage of the thumbprint.  In response to the lawsuit, Six Flags argued that the plaintiff had suffered no actual or threatened injury and thus was not an “aggrieved” person under the Act.

The Illinois Supreme Court reversed the decision of the Appellate Court, which had held a plaintiff was not “aggrieved” within the meaning of the Act and thus could not pursue damages or an injunction based solely on a defendant’s technical violation of the procedures noted above.  In ruling for the plaintiff, the Court noted that prior courts have held that a person is “aggrieved,” in the legal sense, when a legal right is invaded and that the Illinois legislature was aware of this interpretation when enacting the law.  As such, when a private entity does not comply with the Act’s requirements, the Court concluded that this violation creates an “aggrieved” person or customer who may then be permitted to seek recovery under the Act.

The Illinois Supreme Court’s decision is predicted to open a floodgate of litigation.  Employers subject to the Act are advised to take immediate note of the Court’s decision and the notice of requirements set forth in the Act.  Particularly, employers who collect employees’ biometric data, including thumbprints for attendance and payroll tracking, need to ensure that the technical requirements of the Act are being followed to limit exposure to lawsuits. 

Contact your Robbins Schwartz attorney to discuss the implications of this decision on your existing and planned operations.

Print this page