Privacy & Information Security Law Blog

The Illinois Supreme Court ruled today that an allegation of “actual injury or adverse effect” is not required to establish standing to sue under the Illinois Biometric Information Privacy Act, 740 ILCS 14 (“BIPA”). This post discusses the importance of the ruling to current and future BIPA litigation.

The Illinois Supreme Court rendered a decision on January 25, 2019, that gives the green light to certain plaintiffs seeking redress under the BIPA. BIPA provides a private right of action to Illinois residents “aggrieved” by private entities that collect their biometric data (including retina scans, fingerprints and face geometry) without complying with the statute’s notice and consent requirements. Hundreds of cases have been filed under the law, including many putative class actions, enticed by per-violation statutory damages of $1,000 or more.

In the opinion, the Illinois Supreme Court unanimously found that allegations of a technical violation alone can sustain an action, and that limiting BIPA claims to those individuals who can plead and prove an actual injury would depart from the plain and unambiguous meaning of the law. The case is styled Stacy Rosenbach v. Six Flags Entertainment Corp., No. 123186 (Ill.).

BIPA currently is the most watched statute in the U.S. concerning the collection and use of biometric data because it is the only such law that provides a private right of action. The court’s decision resolves a jurisdictional issue that had derailed some prior lawsuits. Today’s decision promises to ramp up an already steady stream of litigation both in and outside of Illinois.

Use of biometric technology by businesses for employee timekeeping, customer identification, and other applications is increasing. The importance of strict compliance with BIPA for companies operating in Illinois is now unavoidably clear.