On December 21, 2017, an Illinois appellate court issued an opinion that will significantly slow down the onslaught of putative class action lawsuits filed under Illinois’s Biometric Information Privacy Act (“BIPA”). In Rosenbach v. Six Flags Entertainment Corp., et al., 2017 IL App (2d) 170317, the court held that a BIPA plaintiff who alleges a statutory violation without a resulting injury may not sue under the statute. This is the first significant guidance an Illinois appellate court has provided about who may sue under BIPA, and is sure to derail many current and potential BIPA cases that allege no injury beyond a claimed statutory violation.
BIPA basics: the statute regulates private entities’ collection, storage, and use of biometric information.
BIPA regulates private entities’ collection, storage, and use of a defined class of biometric information, which is limited to “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry,” or any information derived from those things. 740 ILCS 14/10.
Under the statute, a private entity may not capture, buy, or otherwise obtain a person’s biometrics unless it first does the following: (1) develops a publicly available written retention schedule governing how long the biometrics will be kept; (2) gives the person written notice that the biometrics are being collected or stored, the purpose of doing so, and how long the biometrics will be kept; and, (3) obtains a written release from the person. 740 ILCS 14/15(a), (b). BIPA also prohibits companies from selling biometrics and restricts how such information can be transmitted and stored.
There is a private right of action under the statute for any “person aggrieved” by a statutory violation, and plaintiffs may seek the greater of either actual damages or “liquidated damages” of $1,000 for a negligent violation or $5,000 for an intentional or reckless violation. 740 ILCS 14/20. Reasonable attorneys’ fees and injunctive relief are also available. Id.
“Person aggrieved” is not defined in the statute, and while some federal district courts have addressed this requirement for a private right of action, Illinois courts have not provided guidance on what this term means. Compare McCollough v. Smarte Carte, Inc., 2016 WL 4077108, at *4 (N.D. Ill. Aug. 1, 2016) (dismissing BIPA action for lack of actual damages) and Vigil v. Take-Two Interactive Software, Inc., 235 F. Supp. 3d 499, 521 (S.D.N.Y. 2017) (dismissing BIPA claim where...
