Illinois’ Biometric Information Privacy Act: What Does It Mean to Be “Aggrieved”?

January 29, 2019 / News / Writing and Speaking

by Clausen Miller’s Data Privacy and Security Practice Group 

On January 25, 2019, the Illinois Supreme Court decided in Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186 (Ill. January 25, 2019), whether a person is “aggrieved” under the Biometric Information Act (“Act”), 740 ILCS 14/1, et seq., where there is no specific allegation of “some actual injury or adverse effect, beyond violation” of the Act. 2019 IL 123186, ¶1. In other words, is an individual entitled to the relief prescribed by the Act, even where that individual has not alleged a separate injury or harm? The Illinois Supreme Court held that yes, that individual very well may be. Id. at ¶40. A technical violation of the Act may be enough to recover under the Act. Id.

As an initial matter, the Act “imposes numerous restrictions on how private entities collect, retain, disclose and destroy biometric identifiers, including retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, or biometric information.” Id. at ¶1. The Act requires private entities to, for example, “inform[] the subject … in writing that a biometric identifier or biometric information is being collected or stored … inform[] the subject … in writing of the specific purpose and length of term for which a biometric identifier or biometric is being collected, stored, and used; and … receive[] a written release executed by the subject of the biometric identifier …”. 740 ILCS 14/1 § 15(b). The Act creates a cause of action, and allows a claimant to recover for “each violation” “the greater of liquidated damages [$1,000 or $5,000] or actual damages, reasonable attorney fees and costs, and any other relief, including an injunction, that the court deems appropriate.” Id.

In Rosenbach, the plaintiff’s teenage son provided his fingerprint to Six Flags during a school field trip in connection with the purchase of a season pass. Id. at ¶6. He, however, allegedly did not receive any paperwork from Six Flags regarding the use of this biometric information, and Six Flags has retained this identifier and related information. Id. at ¶9. Additionally, Six Flags allegedly does not have a “written policy” available that advises on a protocol regarding the retention or destruction of the biometric information. Id. Plaintiff filed suit on her son’s behalf, as well as all others similar situated, under the Act. Id. at ¶10. Six Flags moved to dismiss the complaint contending that “plaintiff had suffered no actual or threatened injury and therefore lacked standing to sue, and that plaintiff’s complaint failed to state a cause of action for violation of the Act …”. Id. at ¶12.

The trial court denied the motion in part, and Six Flags certified two questions to the Appellate Court:

(1)        whether an individual is an aggrieved person under §20 of [the Act] … and may seek statutory liquidated damages authorized under §20(l) of the Act when the only injury he alleges is a violation of §15(b) of the Act by a private entity who collected his biometric identifiers and/or biometric information without providing him the required disclosures and obtaining his written consent … and

(2)        whether an individual is an aggrieved person under §20 of [the Act] … and may seek injunctive relief under §20(4) of the Act when the only injury he alleges is a violation of §15(b) of the Act by a private entity who collected his biometric identifiers and/or biometric information without providing him the required disclosures and obtaining his written consent  …

The Appellate Court answered both questions in the negative, holding that more than a technical violation is necessary to recover under the Act. Id. at ¶15. The Illinois Supreme Court in Rosenbach reversed the Appellate Court. Id. at ¶40.

In reaching its decision, the Rosenbach court looked at “basic principles of statutory construction.” ¶24. The Court held that Six Flags’ construction—that there must be “some actual damage, beyond violation of the rights conferred by the statute”—was “untenable.” Id. at ¶25. The Court drew a comparison between Illinois’ AIDS Confidentiality Act, which also uses the term “aggrieved,” and also does not require “proof of actual damages” to recover. Id. at ¶26.

As with the AIDS Confidentiality Act, the Act does not contain its own definition of what it means to be ‘aggrieved’ by a violation of the law. Where, as here, a statutory term is not defined, we assume the legislature intended for it to have its popularly understood meaning. Likewise, if a term has a settled legal meaning, the courts will normally infer that the legislature intended to incorporate that established meaning into the law. … Applying these canons of construction, it is clear that defendants’ [Six Flags’] challenge to Rosenbach’s right to bring suit on behalf of her son is meritless.

Id. at ¶29.

Relying on an over-100-year-old case, the Court stated that, “to be aggrieved simply ‘means having a substantial grievance; a denial of some personal or property right.’” Id. at ¶30. (Internal citation omitted.) “A person who suffers actual damages as the result of the violation of his or her rights would meet this definition of course, but sustaining such damages is not necessary to qualify as ‘aggrieved.’” Id. The court in Rosenbach went on to describe the Illinois legislature’s intent with the Act to support its’ technical interpretation of the Act: “The Act vests in individuals and customers the right to control their biometric information by requiring notice before collection and giving them the power to say no by withholding consent. … When a private entity fails to adhere to the statutory procedures … ‘the right of the individual to maintain … biometric privacy vanishes into thin air. … This is no mere ‘technicality.’ The injury is real and significant.” Id. at ¶34. The Rosenbach case was remanded to the circuit court for further proceedings consistent with the Illinois Supreme Court’s analysis. Id. at ¶40.

The decision in Rosenbach is expected to open the floodgates for plaintiff class action litigation under the Act in Illinois, and, potentially serve as precedent for recovery in other similar cases where personal identifying information is handled contrary to particular requirements of a statute.

  • Chicago

    Illinois 60603

    10 South LaSalle Street

    Chicago, Illinois 60603

    T: 312.855.1010 TF: 800.826.3505 F: 312.606.7777 Office Managing Partner: Dennis D. Fitzpatrick

  • New York

    New York 10005

    28 Liberty Street 39th Floor

    New York, New York 10005

    T: 212.805.3900 TF: 800.826.3505 F: 212.805.3939 Office Managing Partner: Carl M. Perri

  • Mission Viejo

    California 92691

    27285 Las Ramblas

    Suite 200

    Mission Viejo, California 92691

    T: 949.260.3100 TF: 800.826.3505 F: 949.260.3190 Office Managing Partner: Ian R. Feldman

  • Florham Park

    New Jersey 07932

    100 Campus Drive

    Florham Park, New Jersey 07932

    T: 973.410.4130 TF: 800.826.3505 F: 973.410.4169 Office Managing Partner: Carl M. Perri

  • Michigan City

    Indiana 46360

    200 Commerce Square

    Michigan City, Indiana 46360

    T: 219.262.6106 TF: 800.826.3505 F: 312.606.7777 Office Managing Partners: Paige M. Neel, Kimbley A. Kearney

  • Milwaukee

    Wisconsin 53202

    250 E. Wisconsin Avenue

    Suite 1800

    Milwaukee, Wisconsin 53202

    T: 414.279.5525 TF: 800.826.3505 F: 312.606.7777 Office Managing Partner: James M. Weck

  • Stamford

    Connecticut 06902

    68 Southfield Avenue

    2 Stamford Landing Suite 100

    Stamford, Connecticut 06902

    T: 203.921.0303 TF: 800.826.3505 F: 212.805.3939 Office Managing Partner: Matthew J. Van Dusen

  • Tampa

    Florida 33609

    4830 West Kennedy Boulevard, One Urban Center

    Suite 600

    Tampa, Florida 33609

    T: 813.509.2578 TF: 800.826.3505 F: 312.606.7777 Office Managing Partner: Dennis D. Fitzpatrick Co-Managing Partner: Kelly M. Vogt

  • San Francisco

    California 94111

    100 Pine Street

    Suite 1250

    San Francisco, California 94111

    T: 415.287.2744 TF: 800.826.3505 F: 949.260.3190 Office Managing Partner: Ian R. Feldman

  • Houston

    Texas 77019

    2929 Allen Parkway

    American General Center, Suite 200

    Houston, Texas 77019

    T: 346.229.4612 TF: 800.826.3505 F: 312.606.7777 Office Managing Partner: Ramy P. Elmasri

  • Dallas

    Texas 75201

    325 N. Saint Paul Street

    Suite 3100

    Dallas, Texas 75201

    T: 469.942.8635 TF: 800.826.3505 F: 312.606.7777 Office Managing Partner: Ramy P. Elmasri

  • Boca Raton

    Florida 33434

    7777 Glades Road

    Suite 405

    Boca Raton, Florida 33434

    T: 561.765.5305 TF: 800.826.3505 F: 312.606.7777 Office Managing Partner: Dennis D. Fitzpatrick Co-Managing Partner: Kelly M. Vogt