Oral Argument, Rosenbach v. Six Flags Entertainment Corp., No. 123186 (Ill. 2018).
On November 20, 2018, the Illinois Supreme Court heard oral arguments on Rosenbach v. Six Flags, its first case concerning the state’s Biometric Information Privacy Act (“BIPA”). At issue is whether a person whose biometric data has been inappropriately collected in violation of BIPA has standing to sue under the Act’s private right of action.
BIPA outlines several requirements for the collection and use of biometric information by private entities. Section 15(b) requires that a private entity collecting a person’s biometric information (1) inform a person in writing that his or her biometric information is being collected, (2) explain the purpose and length of time for which the information will be used, and (3) receive written consent. Section 20 provides a right of action for “[a]ny person aggrieved by a violation of this Act” to recover damages, legal fees, and other relief.
Stacy Rosenbach filed suit in the Circuit Court of Lake County on behalf of her minor son, alleging that Six Flags had collected his fingerprint in violation of Section 15(b) and seeking damages and injunctive relief under Section 20. Six Flags moved for dismissal, arguing that the plaintiff was not “aggrieved” because there was no injury beyond the BIPA violation. The trial court denied the motion but certified a question for interlocutory appeal as to whether an individual whose only alleged injury is a violation of the notice and consent provisions of Section 15(b) is “aggrieved” under Section 20. The Illinois Appellate Court, Second Division, interpreted Section 20 to read that such an individual was not “aggrieved.” Rosenbach v. Six Flags Entertainment Corp., 2017 IL App (2d) 170317U. Rosenbach then appealed to the Illinois Supreme Court.
In her brief, Rosenbach argued that “aggrieved” means “deprived of a legal right”: in this case, the right to make an informed decision about the collection of one’s biometric information. According to Rosenbach, Six Flags’s interpretation would render the notice and consent provisions of Section 15(b) unenforceable.
In their reply, Six Flags countered that a person must be “adversely affected” or “harmed” in order to be “aggrieved.” It argued that Rosenbach’s interpretation would render superfluous the phrase “person aggrieved by a violation,” because the word “aggrieved” would not add any meaning beyond the existence of a statutory violation.
In their questions, some justices seemed skeptical of Six Flags’s position. They asked whether its interpretation would allow companies to violate the notice and consent provisions with impunity and noted that punishment after an actual injury, such as an inappropriate disclosure or data breach, would be “too late.” They also referenced Sekura v. Krishna Schaumburg Tan, Inc., a recent decision in which a different Illinois appellate court disagreed with Six Flags’s interpretation of the statute. By contrast, the justices spent much less time questioning Rosenbach. Their main inquiry was to ask where the “legal right” referenced in her definition of “aggrieved” arose.
This decision may have far-reaching implications for the future of biometric litigation in Illinois. Some have argued that a ruling that injury beyond a violation of BIPA is required in order to bring suit would gut the ability of individuals to protect their biometric information. An amicus brief by privacy groups including the ACLU and the EFF and a separate brief by Electronic Privacy Information Center, both in support of Rosenbach, highlight this concern.
On the other hand, many businesses support the narrower interpretation of Section 20. Amicus briefs filed on behalf of restaurants, retail businesses, and the Illinois Chamber of Commerce aim to protect employers, many of whom use biometric systems to monitor when their employees check in and out. Some of these cases have been stayed pending the Rosenbach decision. The Internet Association also filed an amicus brief in support of Six Flags, recognizing that Rosenbach may affect lawsuits concerning the application of facial recognition technology to online photographs. Google, Facebook, Shutterfly, and Snapchat have all been subject to such suits.
BIPA is one of the most stringent biometric privacy laws in the nation, and this case may determine its future.