Where a person whose biometric information was collected by a private entity who failed to comply with the requirements of the Illinois Biometric Information Privacy Act was an aggrieved person entitled to sue within the meaning of the act even if they had sustained no further injury beyond the violation of the act itself.
Six Flags Entertainment Corporation and its subsidiary Great America LLC own and operate the Six Flags Great America amusement park in Gurnee, Illinois. As part of this operation, Six Flags sells repeat-entry passes to the park. Since 2014, Six Flags has used a fingerprinting process when issuing those passes. The Six Flags system scans pass holders’ fingerprints, collects, records and stores “biometric” identifiers and information gleaned from the fingerprints, and then stores that data in order to quickly verify customer identities upon visits by pass holders to the park.
In May or June 2014, while the fingerprinting system was in operation, Stacy Rosenbach’s 14-year-old son, Alexander, visited the amusement park on a school field trip. In anticipation of the trip, Rosenbach purchased Alexander a season pass online. Rosenbach paid for the pass and provided personal information about Alexander, but Alexander was required to complete the sign-up process at the amusement park. Alexander was asked to scan his thumb into Six Flags’ biometric data capture system. He was then issued a season pass card. Rosenbach allegedly learned that Alexander’s fingerprints had been taken for the first time when Alexander returned home from the field trip.
Rosenbach eventually filed suit, acting in her capacity as mother and next friend of Alexander, against Six Flags. Rosenbach alleged that Six Flags violated the Biometric Information Privacy Act, 740 ILCS 14/1, which provides that any person aggrieved by a violation of the Act’s provisions shall have a right of action against an offending party. Rosenbach’s complaint sought damages on the grounds that Six Flags violated section 15(b) of the act by collecting biometric identifiers from Alexander without informing them in writing that the information was being collected or stored; that Six Flags failed to inform Alexander of the specific purpose for which the information was being collected or for how long Six Flags would retain the information; and that Six Flags failed to obtain a written release before collecting the information.
Six Flags moved to dismiss. The circuit court denied Six Flags’ motion with respect to counts I and II, but granted the motion with respect to Rosenbach’s claim for unjust enrichment. Six Flags sought interlocutory review, requesting a review of the question of whether an individual is an aggrieved person under the meaning of the act and may seek damages or injunctive relief when the only injury is the alleged violation of the act by a private entity. The appellate court granted review and determined that such an individual was not an aggrieved person within the meaning of the act and that additional injury or adverse effect must be alleged. Rosenbach then appealed.
The Illinois Supreme Court began by noting that while the appellate court had ruled in favor of Six Flags, a separate district of the appellate court subsequently rejected the identical argument in Sekura v. Krishna Schaumburg Tan, Inc. The court then stated that it would agree with the appellate court in Sekura and also reject the reasoning of the appellate court in the instant case.
The court stated that when the Illinois General Assembly had wanted to impose a requirement of actual injury in other situations, it has made that intention explicitly clear in the legislation. The court cited Section 10a(a) of the Consumer Fraud and Deceptive Business Practices Act as an example. The court noted that the act in question did not define the meaning of “aggrieved person” within the act itself. Therefore, the court reasoned, it would interpret the term in accordance with the settled legal meaning. CIting Glos v. People, the court stated that the precedent in Illinois was that an aggrieved person was merely a person who had a substantial grievance, or a denial of some personal or property right.
The court then stated that based upon this construction, the appellate court’s response to the certified question was incorrect. The court stated that the General Assembly had codified that individuals possess a right to privacy in and control over their biometric identifiers and biometric information. Therefore, the court reasoned, when a private entity fails to comply with the requirements of the act, that violation constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose information was subject to the breach. The court, therefore, reversed the decision of the appellate court and remanded the case for further proceedings.
You can view the decision here.
Our Naperville, Illinois consumer rights private law firm handles individual and class action gift card, data breach, privacy rights, deceptive advertising, predatory lending, unfair debt collection, lemon law, and other consumer fraud cases that government agencies and public interest law firms such as the Illinois Attorney General may not pursue. Class action lawsuits our law firm has been involved in or spear-headed have led to substantial awards totaling over a million dollars to organizations including the National Association of Consumer Advocates, the National Consumer Law Center, and local law school consumer programs. The Chicago consumer lawyers at Lubin Austermuehle are proud of our achievements in assisting national and local consumer rights organizations to obtain the funds needed to ensure that consumers are protected and informed of their rights. By standing up to consumer fraud and consumer rip-offs, and in the right case filing consumer protection lawsuits and class-actions you too can help ensure that other consumers’ rights are protected from consumer rip-offs and unscrupulous or dishonest practices.
Our Schaumburg and Evanston consumer attorneys provide assistance in data breach, privacy violation, fair debt collection, consumer fraud, and consumer rights cases including in Illinois and throughout the country. You can click here to see a description of the some of the many individual and class-action consumer cases our Chicago consumer lawyers have handled. A video of our lawsuit which helped ensure more fan friendly security at Wrigley Field can be found here. You can contact one of our Skokie and Lincolnwood consumer protection, gift card and data breach attorneys who can assist in consumer fraud, consumer rip-off, lemon law, unfair debt collection, predatory lending, wage claims, unpaid overtime and other consumer, or consumer class action cases by filling out the contact form at the side of this blog or by clicking here. You can also call our toll-free number at 630-333-0333.