Locke Lord QuickStudy: Biometrics: Illinois Supreme Court to Decide Whether Injury is Required for Biometric Information Privacy Act Claims

On May 30, 2018, the Illinois Supreme Court accepted an appeal from an Illinois appellate court’s decision rejecting “no-injury” lawsuits under Illinois’s Biometric Information Privacy Act (“BIPA”) [Dkt. No. 123186]. The Court’s ultimate decision will likely either sharply restrict claims alleging only technical BIPA violations or reopen the floodgates for putative class actions in Illinois after they were slowed dramatically by the appellate court in Rosenbach v. Six Flags Entertainment Corp., et al., 2017 IL App (2d) 170317. The decision could also substantially impact the massive BIPA litigation currently pending in federal court against Facebook, in which the Ninth Circuit is currently reviewing the propriety of a multi-million member certified class.

BIPA regulates private entities’ collection, storage, and use of biometric information.

BIPA prohibits private entities from obtaining or using an individual’s biometric information without first providing defined notices and obtaining written consent to do so. 740 ILCS 14/15(a), (b). BIPA allows any “person aggrieved” by a statutory violation to sue for either actual damages or “liquidated damages” of between $1,000 and $5,000, plus attorneys’ fees and injunctive relief. 740 ILCS 14/20.

“Person aggrieved” is not defined in the statute, which has led to conflicting decisions about whether an actual injury is required. Compare McCollough v. Smarte Carte, Inc., 2016 WL 4077108, at *4 (N.D. Ill. Aug. 1, 2016) (dismissing BIPA action for lack of actual damages) and Vigil v. Take-Two Interactive Software, Inc., 235 F. Supp. 3d 499, 521 (S.D.N.Y. 2017) (dismissing BIPA claim where there was no injury attributable to procedural BIPA violation) (aff’d 2017 WL 5592589 (2nd Cir. Nov. 21, 2017)) with Monroy v. Shutterfly, Inc., 2017 WL 4099846, at *9 (N.D. Ill. Sept. 15, 2017) (rejecting argument that “person aggrieved” requires an actual injury) and In re Facebook Biometric Information Privacy Litigation, 2018 WL 1794295, at *7 (N.D. Cal. Apr. 16, 2018) (holding that a statutory violation is an invasion of privacy sufficient to create statutory standing to sue, and that no further tangible injury (such as identity theft or financial loss) needs to be shown).

The Rosenbach appellate decision sharply limited who could sue under BIPA.

Rosenbach is the first and only Illinois appellate decision to consider whether a plaintiff must allege harm to be “aggrieved” and thus have statutory standing to sue. There, defendants allegedly collected class members’ fingerprints in connection with purchases of season passes to defendants’ theme park. The appellate court held that “[a]lleging only technical violations of the notice and consent provisions of the statute … does not equate to alleging an adverse effect or harm.” 2017 IL App (2d) 170317, ¶ 21. Thus, the court held, “a plaintiff who alleges only a technical violation of the statute without alleging some injury or adverse effect is not an aggrieved person under” BIPA. Id. ¶ 23. But an injury or adverse effect need not be pecuniary. Id. ¶ 28.

While the Rosenbach decision has significantly diminished the number of new BIPA filings in Illinois, its impact has been in question since a California federal court rejected it in In re Facebook Biometric Information Privacy Litigation, 2018 WL 1794295 (N.D. Cal. Apr. 16, 2018). There, a class of individuals suing Facebook under BIPA was certified despite Facebook’s argument that each class member would need to show that they had suffered a tangible injury to be “aggrieved” and thus eligible for statutory damages under BIPA. Facebook, 2018 WL 1794295 at *6-8. The court disagreed with and distinguished Rosenbach, holding that an individual need only show a statutory violation—and need not show a resulting tangible injury—to sue. Id. at *6–7.

The Supreme Court’s decision will substantially affect pending and future BIPA litigation.

In deciding the Rosenbach appeal, the Supreme Court will likely decide whether a “person aggrieved” includes a plaintiff who has experienced only a technical statutory violation or whether an actual injury is required as well. The decision will be binding on Illinois courts as well as federal courts applying BIPA. If the Supreme Court in Rosenbach affirms the appellate court, the dozens of class actions currently pending in Illinois state courts will likely be subject to dismissal. At the very least, a Rosenbach affirmance will make class certification very difficult because whether each class member suffered an injury would be an individualized determination. Similarly, in the Facebook case—which the Ninth Circuit has stayed pending an interlocutory appeal of the class-certification order—Facebook would likely argue that individualized damages issues should preclude class certification. On the other hand, if the Supreme Court finds no actual-injury requirement for a BIPA claim, the class actions pending in Illinois will likely become more treacherous for defendants and the Ninth Circuit will be much more likely to affirm the class-certification order in Facebook.