Rosenbach v. Six Flags Entm't Corp. - 2019 IL 123186, 432 Ill. Dec. 654, 129 N.E.3d 1197

Rule:

Through the Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (2016), our General Assembly has codified that individuals possess a right to privacy in and control over their biometric identifiers and biometric information. The duties imposed on private entities by § 15 of the Act (740 ILCS 14/15 (2016)) regarding the collection, retention, disclosure, and destruction of a person's or customer's biometric identifiers or biometric information define the contours of that statutory right. Accordingly, when a private entity fails to comply with one of § 15 of the Act's requirements, that violation constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose biometric identifier or biometric information is subject to the breach. Consistent (with the authority cited above), such a person or customer would clearly be "aggrieved" within the meaning of § 20 of the Act (740 ILCS 14/20 (2016)) and entitled to seek recovery under that provision. No additional consequences need be pleaded or proved. The violation, in itself, is sufficient to support the individual's or customer's statutory cause of action. 

Facts:

The Biometric Information Privacy Act (Act) (740 ILCS 14/1 et seq. (West 2016)) imposes numerous restrictions on how private entities collect, retain, disclose and destroy biometric identifiers, including retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, or biometric information. Under the Act, any person "aggrieved" by a violation of its provisions "shall have a right of action against an offending party" and "may recover for each violation" the greater of liquidated damages or actual damages, reasonable attorney fees and costs, and any other relief, including an injunction, that the court deems appropriate. § 20. The central issue in this case, which reached the appellate court by means of a permissive interlocutory appeal pursuant to Illinois Supreme Court Rule 308, is whether one qualifies as an "aggrieved" person and may seek liquidated damages and injunctive relief pursuant to the Act if he or she has not alleged some actual injury or adverse effect, beyond violation of his or her rights under the statute. The appellate court answered this question in the negative. In its view, "a plaintiff who alleges only a technical violation of the statute without alleging some injury or adverse effect is not an aggrieved person" within the meaning of the law. 

Issue:

Does one qualify as an "aggrieved" person and may seek liquidated damages and injunctive relief pursuant to the Act if he or she has not alleged some actual injury or adverse effect, beyond violation of his or her rights under the statute?

Answer:

Yes.

Conclusion:

With regard to the Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (2016), the Court held that when a private entity fails to comply with one of the requirements of 740 ILCS 14/15 (2016), that violation constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose biometric identifier or biometric information is subject to the breach. Consistent with the authority the Court cited, such a person or customer would clearly be "aggrieved" within the meaning of 740 ILCS 14/20 (2016) and entitled to seek recovery under that provision. The Court found that no additional consequences need be pleaded or proved. The violation, in itself, is sufficient to support the individual's or customer's statutory cause of action.