Illinois Supreme Court Defines “Aggrieved” Person Under the State Biometric Privacy Act
Recently, the Supreme Court of Illinois held that an individual who has suffered a violation of a statutory right under Illinois’s Biometric Information Privacy Act is an “aggrieved” person and has standing to sue pursuant to the statute’s private right of action.
Rosenbach v. Six Flags Entertainment Corporation et al., was brought against a large amusement park by a putative class, including the family of a minor whose fingerprints were taken in conjunction with the use of a repeat-entry pass. The fingerprints were taken by the park without following the appropriate disclosure and consent requirements as laid out in Illinois’s Biometric Information Privacy Act. The plaintiffs alleged, among other claims, that the park violated the Act by: 1) collecting or storing the fingerprints from the child without informing him or his family in writing that the information was being collected or stored; 2) not informing the family in writing of the intended use of the information or how long the information would be stored; and 3) not obtaining a written release executed by either the minor or the family before the collection of the information.
The park moved to dismiss the complaint, asserting that the plaintiff had suffered no actual or threatened injury meaning they could not be an “aggrieved” person with the ability to sue. The lower court denied the motion and the park appealed. The appellate court agreed with the park, holding that a plaintiff cannot be “aggrieved” based solely on a violation of the statute without an allegation of some additional injury or adverse effect. The family of the minor appealed.
Upon review, the Illinois Supreme Court reversed the judgment of the appellate court, holding the Act created a privacy right in the collection, use, and storage of biometric identifiers and information. The way the Act achieves this goal is by placing on parties who collect and store such information various obligations related to this practice. The court reasoned that the legislature did not mean to restrict the definition of an “aggrieved” person to only those who had suffered an injury beyond violation of the rights conferred by the statute—namely the disclosure and consent requirements at issue in the current lawsuit. The Act was meant to give individuals the right to control their biometric information and when a party violates that right by not complying with the statutory requirements, they have opened themselves up to liability. As such, an individual who was not given the required disclosures or asked for consent may be considered an “aggrieved” person under the Act and may sue the entity responsible. The case was remanded to the trial court for further proceedings consistent with the Supreme Court of Illinois’s opinion.
