The Illinois Supreme Court finally made its long awaited ruling on standing to sue under the Illinois Biometric Information Privacy Act (BIPA), siding with the class action representative in Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, and allowing persons having suffered no actual injury to maintain a cause of action under BIPA.
BIPA has already given rise to 200+ putative class action lawsuits against businesses nationwide, including those with any measureable operation in Illinois. Businesses have fought back, arguing that BIPA’s private right of action and available statutory damages do not allow persons to sue who can only allege a mere “technical violation of the Act.”
However, the Illinois Supreme Court disagreed. Reversing the Appellate Court decision, the court concluded that BIPA’s reference to “aggrieved” persons (i.e., those who may bring suit and seek statutory damages of $1,000 or more per violation) includes any person who asserts a violation of the Act, whether connected to actual harm, such as identity theft, or not. The Court further explained that a failure to obtain informed consent and make the required disclosures with respect to the collection of protected biometric information is sufficient to maintain a putative class action lawsuit based solely on alleged violations of BIPA.
The ruling may potentially embolden the plaintiffs’ class action lawyers and result in a new wave of lawsuits. Nonetheless, the Illinois General Assembly has within its power the ability to fairly revise the statute if it did not in fact intend BIPA to permit the prosecution of mere technical violations.