The Illinois Supreme Court recently handed down its much-anticipated decision in Rosenbach v. Six Flags Entertainment Corporation et al., clarifying what makes someone “aggrieved” and able to bring a claim under the Illinois Biometric Information Privacy Act (“BIPA”). We have addressed this issue in prior blogs, including here and here. The Supreme Court has now held an individual need not allege some actual injury or adverse effect to be “aggrieved” and have statutory standing. An individual can state a BIPA claim simply by alleging an entity’s failure to follow the statute’s notice and consent requirements.
The high court rejected Six Flags’ argument that the Illinois legislature intended individuals to suffer some actual damage beyond a mere violation of his or her statutory rights before being able to file a lawsuit. It looked at how the word “aggrieved” has been used and understood in other Illinois statutes and precedent, where the only requirement is violation of an individual’s legal rights, and nothing more.
The court concluded BIPA gives individuals a statutory “right to privacy in and control over their biometric identifiers and biometric information,” and that the statute’s notice and consent provisions “define the contours of that statutory right.” As a result, an entity that fails to notify an individual it is collecting or storing his or her biometric data, or fails to obtain an individual’s written consent to such collection or storage, violates that individual’s statutory right, making him or her “aggrieved” and able to sue.
The Illinois Supreme Court’s decision is likely to restart a new wave of BIPA lawsuits, which have become common in the last several years. However, the Rosenbach decision does not remedy the dissonance between statutory standing under BIPA and Article III standing, which a plaintiff must demonstrate in order to sue in federal court. As the United States Supreme Court held in Spokeo, Article III standing requires a concrete injury, even in the context of a statutory violation. Therefore, an individual who has not suffered a concrete injury (such as identity theft) could have standing to bring a BIPA claim in Illinois state court, but may not have standing to bring such a claim in federal court. Indeed, the Northern District recently dismissed a lawsuit brought under BIPA because the plaintiff lacked Article III standing. As a result, the bulk of future BIPA lawsuits may be concentrated in Illinois state courts due to plaintiffs seeking to avoid the heightened injury required to sue in federal court.
As before, but especially now, entities that collect and store biometric data such as finger prints, iris scans, and face scans should ensure they are familiar with and follow BIPA’s notice and consent requirements in order to limit their risk of exposure. BIPA allows successful plaintiffs to recover the greater of actual or liquidated damages of up to $5,000 for each violation, as well as attorneys’ fees and costs. This means a BIPA class action could potentially result in hundreds of thousands, if not millions, of dollars of damages. Compliance is straightforward, and the cost of implementing these statutorily-required policies now could save companies from huge damages awards in the future.