Illinois’ Biometric Information Privacy Act: What Does It Mean to Be “Aggrieved”?

by Clausen Miller’s Data Privacy and Security Practice Group 

On January 25, 2019, the Illinois Supreme Court decided in Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186 (Ill. January 25, 2019), whether a person is “aggrieved” under the Biometric Information Act (“Act”), 740 ILCS 14/1, et seq., where there is no specific allegation of “some actual injury or adverse effect, beyond violation” of the Act. 2019 IL 123186, ¶1. In other words, is an individual entitled to the relief prescribed by the Act, even where that individual has not alleged a separate injury or harm? The Illinois Supreme Court held that yes, that individual very well may be. Id. at ¶40. A technical violation of the Act may be enough to recover under the Act. Id.

As an initial matter, the Act “imposes numerous restrictions on how private entities collect, retain, disclose and destroy biometric identifiers, including retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, or biometric information.” Id. at ¶1. The Act requires private entities to, for example, “inform[] the subject … in writing that a biometric identifier or biometric information is being collected or stored … inform[] the subject … in writing of the specific purpose and length of term for which a biometric identifier or biometric is being collected, stored, and used; and … receive[] a written release executed by the subject of the biometric identifier …”. 740 ILCS 14/1 § 15(b). The Act creates a cause of action, and allows a claimant to recover for “each violation” “the greater of liquidated damages [$1,000 or $5,000] or actual damages, reasonable attorney fees and costs, and any other relief, including an injunction, that the court deems appropriate.” Id.

In Rosenbach, the plaintiff’s teenage son provided his fingerprint to Six Flags during a school field trip in connection with the purchase of a season pass. Id. at ¶6. He, however, allegedly did not receive any paperwork from Six Flags regarding the use of this biometric information, and Six Flags has retained this identifier and related information. Id. at ¶9. Additionally, Six Flags allegedly does not have a “written policy” available that advises on a protocol regarding the retention or destruction of the biometric information. Id. Plaintiff filed suit on her son’s behalf, as well as all others similar situated, under the Act. Id. at ¶10. Six Flags moved to dismiss the complaint contending that “plaintiff had suffered no actual or threatened injury and therefore lacked standing to sue, and that plaintiff’s complaint failed to state a cause of action for violation of the Act …”. Id. at ¶12.

The trial court denied the motion in part, and Six Flags certified two questions to the Appellate Court:

(1)        whether an individual is an aggrieved person under §20 of [the Act] … and may seek statutory liquidated damages authorized under §20(l) of the Act when the only injury he alleges is a violation of §15(b) of the Act by a private entity who collected his biometric identifiers and/or biometric information without providing him the required disclosures and obtaining his written consent … and

(2)        whether an individual is an aggrieved person under §20 of [the Act] … and may seek injunctive relief under §20(4) of the Act when the only injury he alleges is a violation of §15(b) of the Act by a private entity who collected his biometric identifiers and/or biometric information without providing him the required disclosures and obtaining his written consent  …

The Appellate Court answered both questions in the negative, holding that more than a technical violation is necessary to recover under the Act. Id. at ¶15. The Illinois Supreme Court in Rosenbach reversed the Appellate Court. Id. at ¶40.

In reaching its decision, the Rosenbach court looked at “basic principles of statutory construction.” ¶24. The Court held that Six Flags’ construction—that there must be “some actual damage, beyond violation of the rights conferred by the statute”—was “untenable.” Id. at ¶25. The Court drew a comparison between Illinois’ AIDS Confidentiality Act, which also uses the term “aggrieved,” and also does not require “proof of actual damages” to recover. Id. at ¶26.

As with the AIDS Confidentiality Act, the Act does not contain its own definition of what it means to be ‘aggrieved’ by a violation of the law. Where, as here, a statutory term is not defined, we assume the legislature intended for it to have its popularly understood meaning. Likewise, if a term has a settled legal meaning, the courts will normally infer that the legislature intended to incorporate that established meaning into the law. … Applying these canons of construction, it is clear that defendants’ [Six Flags’] challenge to Rosenbach’s right to bring suit on behalf of her son is meritless.

Id. at ¶29.

Relying on an over-100-year-old case, the Court stated that, “to be aggrieved simply ‘means having a substantial grievance; a denial of some personal or property right.’” Id. at ¶30. (Internal citation omitted.) “A person who suffers actual damages as the result of the violation of his or her rights would meet this definition of course, but sustaining such damages is not necessary to qualify as ‘aggrieved.’” Id. The court in Rosenbach went on to describe the Illinois legislature’s intent with the Act to support its’ technical interpretation of the Act: “The Act vests in individuals and customers the right to control their biometric information by requiring notice before collection and giving them the power to say no by withholding consent. … When a private entity fails to adhere to the statutory procedures … ‘the right of the individual to maintain … biometric privacy vanishes into thin air. … This is no mere ‘technicality.’ The injury is real and significant.” Id. at ¶34. The Rosenbach case was remanded to the circuit court for further proceedings consistent with the Illinois Supreme Court’s analysis. Id. at ¶40.

The decision in Rosenbach is expected to open the floodgates for plaintiff class action litigation under the Act in Illinois, and, potentially serve as precedent for recovery in other similar cases where personal identifying information is handled contrary to particular requirements of a statute.