The Illinois Court of Appeals for the Second District, in Rosenbach v. Six Flags Entertainment Corporation, recently issued a decision restricting potential plaintiffs’ ability to pursue claims under the Biometric Information Privacy Act (BIPA), holding that it is not enough to simply allege a violation of the Act’s provisions; a plaintiff must also allege facts establishing that he or she suffered an actual injury as a result.
Passed into law in 2008, BIPA governs the “collection, use, safeguarding, handling, storage and retention and destruction of biometric identifiers and information.” “Biometric identifiers” are defined to include “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry” while “biometric information” includes “any information, regardless of how it is captured, converted, stored or shared, based on an individual’s biometric identifier used to identify a person.” Prompted by concerns attendant with the increased use of biometric data in commercial transactions, BIPA requires any party that collects or obtains biometric identifiers or information to (1) inform the subject in writing that the identifier or information is being collected or stored, (2) inform the subject in writing why and for how long the data is being collected, stored or used, and (3) obtain the subject’s written consent.
BIPA provides for a private right of action that allows “any person aggrieved by a violation of this Act” to recover $1,000 for each negligent violation, $5,000 for each reckless violation, or their actual damages, whichever is greater, as well as attorney’s fees and other litigation expenses. This provision has accounted for a recent spike in class action claims filed against ventures such as Google, Shutterfly, Facebook, and others who use biometric data in their commercial products, as well as numerous employers who use biometric data to track employees’ time worked and to help manage payrolls.
The Rosenbach Court addressed the question of what constitutes a “person aggrieved by a violation of this Act.” In that case, the mother of Alexander Rosenbach, a minor, alleged that Six Flags failed to provide proper disclosures or obtain a written release prior to collecting Rosenbach’s thumbprint, which it obtained as part of its season pass card program. Rosenbach’s mother filed a putative class action on behalf of her son and other season pass purchasers. The complaint, however, failed to allege that the potential class members suffered any specific injury, and instead asserted claims for statutory or actual damages based on the mere allegation of a violation.
On appeal, the Court determined that the statute must be construed so that each word is given meaning and not rendered superfluous. Relying on dictionary definitions, the Second District determined that “there must be an actual injury, adverse effect, or harm in order for the person to be ‘aggrieved.’” It went on to examine decisions from analogous cases and ultimately determined that “if the Illinois legislature intended to allow for a private cause of action for every technical violation of the Act, it could have omitted the word ‘aggrieved’ and stated that every violation was actionable.”
Notably, one of the cases the Rosenbach Court relied upon was McCollough v. Smarte Carte, Inc. In that case, the Court relied upon the same “aggrieved party” requirement to dismiss a complaint that alleged a technical violation of BIPA, but not an actual injury. Although the Rosenbach decision is not controlling authority outside the Second District, and the McCollough decision, which was issued by a federal trial court, is not controlling at all, it is significant that two courts that have addressed the issue have agreed that “[i]f a person alleges only a technical violation of the Act without alleging any injury or adverse effect, then he or she is not aggrieved and may not recover under any of the provisions in section 20.”
While this decision is significant, some plaintiffs already appear to have anticipated the aggrieved party requirement in more recent cases. Following the McCollough opinion, it has not been uncommon for plaintiffs to include allegations of personal injury, including claims of emotional distress purportedly suffered as a result of alleged BIPA violations. It will merit watching whether these allegations allow complaints to clear the actual injury hurdle, and what sort of factual defenses may arise out of such allegations. While these recent decisions add a useful defense to BIPA claims, they do not appear to be the end of the story for this new frontier of litigation.