The Biometric Information Privacy Act

The Illinois legislature enacted the Biometric Information Privacy Act (BIPA) in 2008. Since that time, the plaintiff’s class action bar has discovered the statute and attempted to prosecute class actions on multiple occasions in state and federal courts. On Dec. 21, 2017, the Second District Appellate Court of Illinois (Second District) issued a decision finding that a BIPA plaintiff must allege actual harm or injury in order to survive a motion to dismiss. Rosenbach v. Six Flags Entertainment Corporation, 2017 IL App (2d) 170317.

BIPA requires private entities that collect biometric information to protect the data and also comply with other statutory criteria. Pursuant to the statute, a “biometric identifier is a retina or iris scan, fingerprint, voiceprint or a geometric scan of the hand or face.” 740 ILCS 14/10. Private entities must also establish a schedule for retention and the ultimate destruction of biometric identifiers. 740 ILCS 14/15(a). In addition, a private entity that collects biometric identifiers must also:

1. inform subjects that the information will be collected or stored;
2. inform persons of the purpose for the collection and the time period the information will be stored; and
3. secure written consent from all individuals for the collection of their biometric information. 740 ILCS 14/15(b).     

The collecting entity is also prohibited from utilizing the information or disclosing the biometric identifier without the consent of the individual. 740 ILCS 14/15(c), (d).

In Six Flags, the named class plaintiff alleged that her son was fingerprinted as part of the security process for entering into a Six Flags Great America park located in Illinois. The plaintiff alleged multiple violations of BIPA, including the lack of consent for the collection and storage of the biometric identifier. Six Flags, 2017 IL App (2d) 170317 at *2.

The trial court denied the defendant’s motion to dismiss, which asserted that the plaintiff was not a “person aggrieved” pursuant to the statute because she did not allege any actual injury. The Second District reversed after the trial court certified two issues for interlocutory appeal. In making its decision the Second District noted that “the certified questions revolve around whether a person is ‘aggrieved,’ and thus may bring an action for liquidated damages or injunctive relief when the only injury is a violation of the notice and consent requirements of Section 15(b) of the Act.” BIPA does not contain a statutory definition of “person aggrieved.”

In finding for the defendant, the Second District relied in part on the Black’s Law Dictionary definition of “aggrieved party” as a “party whose personal, pecuniary, or property rights have been adversely affected by another person’s actions or by a court’s decree or judgment.” Six Flags, 217 IL App (2d) 170317 at *3; Black’s Law Dictionary (10^th ed. 2014). The Second District also relied on federal decisions wherein the trial court decided that allegations of statutory violations of BIPA are not sufficient without allegations of actual harm to the plaintiff. McCullough v. Smarte Carte, Inc., 2016 WL 4077108 (N.D. Ill. Aug. 1, 2016); Westlake Financial Group, Inc. v. CDH-Delnor Health System, 2015 IL (2d) 140589, 25 N.E.3d 1166.  

The Second District’s interpretation of BIPA required the plaintiff to properly allege that there was actual harm, thus narrowing the scope of potential plaintiffs. Nevertheless, businesses must remain vigilant because if a plaintiff properly alleges some actual harm, a party in violation of BIPA would not only be subject to liability for the plaintiff’s actual harm, but also subject to the many statutory penalties prescribed by BIPA. BIPA allows a prevailing party to recover their reasonable attorneys’ fees from a private entity in violation of the Act, and for each violation, $1,000 (liquidated or actual damages depending on which is greater) for negligent violations and $5,000 for intentional or reckless violations. 740 ILCS 14/20. Consequently, the best defense to any BIPA claim is full compliance with the statute. 

This Chuhak & Tecson, P.C. communication is intended only to provide information regarding developments in the law and information of general interest. It is not intended to constitute advice regarding legal problems and should not be relied upon as such.

Client Alert authored by: David J. Tecson, Principal and O. Koplan Nwabuoku, Associate

This alert originally appeared in The Diagnosis newsletter.