On December 21, 2017, the Illinois Second District Appellate Court dealt a significant blow to the recent wave of Illinois Biometric Information Privacy Act (BIPA) class actions, holding in Rosenbach v. Six Flags Entertainment Corp. that plaintiffs alleging mere procedural violations of BIPA, without “any injury or adverse effect,” are not “aggrieved” persons entitled to any relief—monetary or otherwise—under the statute.1
BIPA prohibits companies from collecting biometric information from individuals without notice and written consent.2 The Illinois legislature passed BIPA in 2008 in response to the growing use of biometric technology in the business and security screening sectors in Illinois.3 Specifically, lawmakers were concerned about companies like Pay By Touch—which, in the early 2000s, brought biometric authentication to payment systems —going bankrupt and, consequently, putting consumers’ sensitive personal information at risk.4 To that end, BIPA contains a private right of action that allows any person “aggrieved” by a violation of the act to bring a claim against the offending party for $1,000 or actual damages per negligent violation, and $5,000 or actual damages per intentional or reckless violation.5 Critically, the statute does not define “aggrieved” persons, which proved to have a decisive impact on the Rosenbach court’s ruling.
Since its enactment almost ten years ago, BIPA has become more and more controversial as it remains the only biometric privacy law on the books with a private right of action, making it all the more attractive to the plaintiff’s bar. Indeed, courts have been flooded with BIPA cases over the past year, mostly against businesses that use fingerprint or facial recognition technology to authenticate the identities of their employees and customers. While federal courts have weighed in on BIPA standing issues,6 until Rosenbach, it remained unclear whether technical violations of BIPA’s notice and consent provisions were enough for these cases to move forward.
In Rosenbach, the plaintiffs alleged that Six Flags Entertainment and Great America violated BIPA when they fingerprinted the plaintiffs without notice of—or an opportunity to consent to—their biometric collection, storage, use, and destruction policies as required by the statute.7 Based on these allegations, the plaintiffs claimed that they were harmed because, had they known of the defendants’ conduct, they would not have purchased tickets from them in the first place.8
In January 2016, the plaintiffs filed a lawsuit seeking $5,000 per violation.9 The defendants moved to dismiss the complaint on the basis that a person who suffers no actual harm has not been “aggrieved” within the meaning of BIPA. The trial court denied the motion to dismiss, but later certified two questions for appeal, including: (1) whether an individual alleging technical violations of Section 15 of the act (i.e., the notice and consent provisions) is an “aggrieved” person entitled to liquidated damages; and (2) whether an individual alleging those same violations is an “aggrieved” person entitled to injunctive relief under the act.10
Ultimately, the court answered both questions in the negative.
First, because the term “aggrieved” is not defined in the statute, the court looked to Black’s Law Dictionary’s definition of the terms “aggrieved” and “aggrieved party” to analyze the certified questions. Black’s Law Dictionary defines “aggrieved party” as “[a] party entitled to remedy; esp., a party whose personal, pecuniary, or property rights have been adversely affected by another person’s actions or by a court’s decree or judgment.”11 Similarly, “aggrieved” is defined as “having legal rights that are adversely affected; having been harmed by an infringement of legal rights.”12 Based on these definitions and the cases interpreting them,13 the court concluded that plaintiffs must allege an actual injury, adverse effect, or harm to be “aggrieved.”14 Had the Illinois legislature intended otherwise, the court explained, it would not have bothered including the term “aggrieved” in the statute; rather, it would have simply stated that every BIPA violation was actionable.15 Based on this line of reasoning, the court concluded that plaintiffs alleging technical violations of BIPA are not “aggrieved,” and therefore are not entitled to liquidated damages or injunctive relief under the act.
The court’s ruling is a victory for businesses that use or plan to use biometrics to verify the identities of their employees or customers. Not only has the Illinois Second District Appellate Court raised the standing hurdle for plaintiffs, but this ruling narrows their ability to bring these claims even further. Overall, the court’s decision suggests that we can expect to see a significant rollback of BIPA cases in the future, and likely an increase in business’ use of this technology for employee and customer verification because of it.
1 Rosenbach v. Six Flags Entertainment Corp., No. 2-17-0317, 2017 IL App (2d) 170317 (Ill. App. Dec. 21, 2017).
2 740 ILCS 14/15(b).
3 740 ILCS 14/5.
4 See, e.g., Allison Grande, Gas, Food Chains Hit With Ill. Biometric Privacy Suits, Law360 (Sept. 7, 2017), https://www.law360.com/articles/961707/gas-food-chains-hit-with-ill-biometric-privacy-suits.
5 740 ILCS 14/20.
6 See Santana v. Take-Two Interactive Software, Inc., No. 17-303 (2d Cir. Nov. 21, 2017) (Summary Order) (BIPA claim against videogame maker for scanning users’ faces to create personalized avatars).
7 740 ILCS 14/15(b).
8 Rosenbach, No. 2-17-0317, 2017 IL App (2d) 170317, ¶ 10.
10 Id. ¶ 15.
11 Black’s Law Dictionary (10th ed. 2014).
13 E.g., McCollough v. Smarte Carte, Inc., No. 16-c-03777, 2016 WL 4077108 (N.D. Ill. Aug. 1, 2016) (relying on Black’s Law Dictionary’s definition of aggrieved in holding technical violations of BIPA do not meet the definition without facts that show an individual’s rights have been adversely affected by the violations).
14 Rosenbach, No. 2-17-0317, 2017 IL App (2d) 170317, ¶¶ 20-23.
15 Id. ¶ 23.