The Illinois Supreme Court has stepped in to take on the question of whether a mother can use an Illinois privacy law to sue theme park operator Six Flags for forcing her teen son to digitally scan his fingerprints to obtain and use a season pass.
And, as Illinois appellate courts split on the legal question at the heart of the case, the state high court’s decision could carry far-reaching implications for a growing spate of class action lawsuits brought against a host of employers and other businesses of all varieties under the Illinois Biometric Information Privacy Act.
On Nov. 20, Illinois Supreme Court justices heard arguments from attorneys for both sides in Springfield.
Kathleen O'Sullivan
| Perkins Coie
And justices for the most part appeared skeptical of the reasoning behind the decision from the Illinois Second District Appellate Court, which had backed Six Flags in their dispute with plaintiff and putative class representative Stacy Rosenbach.
Rosenbach had filed a class action lawsuit against Six Flags Entertainment Corporation in 2016, alleging the company violated BIPA when it required her son, Alexander Rosenbach, to scan his fingerprint to use his season pass for admission at Six Flags Great America in north suburban Gurnee. Specifically, Rosenbach asserted the fingerprint scans violated her son’s rights, and her rights as his legal guardian, because Six Flags did not first obtain written consent or provide written disclosure concerning why the fingerprint scans were required, how long the company would keep the prints, how the company would store and safeguard the scans and how Six Flags would ultimately destroy the scans. BIPA requires such disclosures and consent before anyone can obtain a person’s personal biometric records, or data relying on unique physical characteristics, like fingerprints or retinal scans, which can be used to identify a person.
However, the case to date has not dealt with the question of whether Six Flags violated BIPA. Rather, it has centered on whether Rosenbach had standing to bring the case at all, particularly as attorneys for Six Flags argued she had never presented evidence the fingerprint scans resulted in any harm to her or her son.
Lake County Circuit Judge Luis A. Berrones allowed Rosenbach to continue with the lawsuit.
But on appeal, a three-justice panel of the Second District Appellate Court in Elgin sided with Six Flags, saying any violation would have been merely a technical violation of the BIPA law, which “does not equate to alleging an adverse effect or harm.”
Plaintiffs seeking to sue under BIPA, the Second District Appellate justices said, must demonstrate not only that the law was violated, but how they were harmed by the violation.
Rosenbach then appealed to the state Supreme Court. In the wake of the Second District ruling, the number of BIPA-related class actions filed in Cook County Circuit Court and other state courts appeared to have waned. However, after the state Supreme Court agreed to hear arguments in the Rosenbach case, interest from plaintiffs’ lawyers in BIPA-related litigation seems to have resurged, with dozens of new cases filed in the past few months, anticipating a potential reversal of the Second District’s Rosenbach decision and a new lease on life for lawsuits based solely on a technical violation of the BIPA law.
In his presentation to the state Supreme Court Tuesday, Rosenbach’s attorney Phillip Bock, of the firm of Bock Hatch Lewis & Oppenheim, of Chicago, argued the Second District answered the question incorrectly, saying the law not only specifically allows such lawsuits, but the harm, or injury, is the violation of the law itself, not only any potential harm that may follow from the collection of the fingerprint scans.
“The right (established under the BIPA law) is to decide whether or not you want to allow somebody to collect your biometrics. It’s a personal decision as to whether you want them to be able to do it, or don’t want them to be able to do it.
“And if they do it without giving you that option that’s required under the statute, you’ve been aggrieved. And so that aggrievement, that is the injury.”
Bock further likened the harm under an improper biometric information collection to theft and a violation of property rights, noting biometric information has economic value.
“You have a personal privacy interest that’s harmed when somebody takes your fingerprint in violation of a statute that says they can’t,” Bock said.
Justices had few questions for Bock, but justices Anne M. Burke and Robert R. Thomas, as well as Chief Justice Lloyd A. Karmeier peppered attorney Kathleen O’Sullivan, of the firm of Perkins Coie, of Seattle, who was representing Six Flags, with queries throughout her arguments.
O’Sullivan noted no one is misled into scanning their fingerprints and a notice of biometric identification is provided on Six Flags’ website. However, as the arguments at this point have centered on the question of whether Rosenbach can sue, O’Sullivan asserted state lawmakers worded the BIPA law in a way to limit who can bring lawsuits under the law.
“They could have adopted a more expansive definition” – for instance, allowing “any person” to sue under BIPA – “but they chose not to,” said O’Sullivan.
She said lawmakers intended to seek to balance the benefits of the use of biometric identifiers – for instance, using a fingerprint to unlock a mobile device – against the potential pitfalls, such as identity theft.
And she again noted the plaintiffs did not suffer “any adverse harm” from the scans, urging the court to find lawsuits should only be allowed from harm “flowing from” the collection of fingerprints and other biometric information.
Justice Thomas questioned whether the defendants’ desired interpretation of the BIPA language would essentially neutralize the law.
“Given the dire consequences arriving from a violation of the Act, doesn’t it make sense that the legislature would want to give the Act some teeth, to ensure all efforts are made to prevent the compromise of data?” Thomas asked.
He noted a different Illinois appeals court, the First District Appellate Court, had answered the question differently in a different case, allowing a class action lawsuit under BIPA to proceed against a L.A. Tan franchisee in Schaumburg over the collection of fingerprints without proper consent, as required by BIPA. The appellate justices in that case found it is “too late” to wait for private biometric data to be compromised to bring suit, when the collection methods already may have violated the BIPA statute.
Justice Burke similarly questioned whether plaintiffs should need to wait for their information to be compromised before they can sue under BIPA.
“Isn’t it too late then, to wait for the harm?” Burke asked. “They can’t do anything about it, and they may never know.
“You can’t get your fingerprints back. It’s irreparable harm.”
And in his final exchange with O’Sullivan, Chief Justice Karmeier also appeared to wonder whether Six Flags’ position on the question and the conclusion of the Second District appellate court might only encourage companies to take the risk of getting sued later, rather than strictly abide by BIPA now.
“Is there any method, any remedy, for violation of the law, then, if there has to be an injury, even though a company violates with impunity?” Karmeier asked.
“If someone has harm, that company can be punished,” O’Sullivan said.
“But if there’s no harm, the company can continue to violate the law with impunity?” Karmeier asked.
“The company risks great exposure from doing that,” O’Sullivan said.
The Supreme Court will issue its ruling on the case at a later date, likely next year.