Locke Lord: QuickStudy: Biometrics: Illinois Supreme Court Allows No-Injury Biometric Information Privacy Act Claims in Complete Victory for Plaintiffs’ Bar.

On January 25, 2019, the Illinois Supreme Court held that plaintiffs can assert claims and recover statutory damages under Illinois’s Biometric Information Privacy Act (“BIPA”) based on a bare violation of the statute without any showing of consequential harm. Rosenbach v. Six Flags, 2019 IL 123186. This question had split Illinois appellate courts over the last two years. The Court’s decision will likely prompt filing of even more BIPA class actions; over a hundred have already been filed over the last two years in Illinois and elsewhere. And, because at least some federal courts have held that no-injury BIPA claims do not create the “case or controversy” required for federal-court jurisdiction, defendants may be required to litigate such claims in state court.

BIPA regulates private entities’ collection, storage, and use of biometric information.
BIPA prohibits private entities from obtaining or using an individual’s biometric information without first providing defined notices and obtaining written consent to do so. 740 ILCS 14/15(a), (b). BIPA allows any “person aggrieved” by a statutory violation to sue for either actual damages or “liquidated damages” of between $1,000 and $5,000, plus attorneys’ fees and injunctive relief. 740 ILCS 14/20.

“Person aggrieved” is not defined in the statute, which led to conflicting decisions in Illinois appellate courts about whether a tangible injury—beyond a mere statutory violation—is required for a plaintiff to have statutory standing to sue. Compare Rosenbach v. Six Flags Entertainment Corp., 2017 IL App (2d) 170317 (plaintiff must have tangible injury to sue); Sekura v. Krishna Schaumburg Tab, Inc., 2018 IL App (1st) 180175 (plaintiff can sue based solely on statutory violation).

Plaintiff sued based on a violation of BIPA without a tangible injury.
The plaintiff in Rosenbach—a minor represented by his mother—had his fingerprints taken by defendant for a season pass when he visited a Six Flags amusement park. 2019 IL 123186, ¶¶ 4–6. Plaintiff’s mother alleged that defendant created a biometric profile for her son without providing the notice and obtaining the consent required by BIPA. Id. ¶ 8. She did not allege that she or her son had been damaged by the alleged statutory violation, such as through a theft or other disclosure of his biometric information or through any kind of identity theft. Id. ¶ 22.

Defendant moved to dismiss the complaint, arguing that the lack of any tangible injury meant plaintiff was not “aggrieved” and thus had no right of action under the statute. Id. ¶ 12. The trial court denied the motion, but on interlocutory appeal, the appellate court reversed and held that a plaintiff could only be aggrieved under the statute if they could show some tangible harm beyond a mere statutory violation. Id. ¶ 15. The Illinois Supreme Court then granted leave to appeal that decision.

In Rosenbach, the Illinois Supreme Court allowed BIPA claims to proceed based solely on statutory violations.
The Supreme Court in Rosenbach gave a clear and final answer that will be binding on all courts that consider BIPA claims: plaintiffs need only allege a statutory violation to have a private right of action and an ability to collect statutory damages. 2019 IL 123186, ¶ 40 (“an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Act, in order to qualify as an ‘aggrieved’ person and be entitled to seek liquidated damages and injunctive relief pursuant to the Act.”).

In reaching its conclusion, the Supreme Court relied on both statutory text and legislative intent. Looking at the text, the Court noted that a dictionary defines “aggrieved” as including an invasion of a legal right. Id. ¶ 32. The Court also noted that other Illinois statutes that use the word “aggrieved” in similar fashion have been interpreted to authorize a private right of action, and that Illinois statutes that require a tangible injury to sue explicitly express that requirement. Id. ¶¶ 25–27.

Regarding policy, the Court noted the Illinois legislature’s desire to both require companies handling biometric information to safeguard that information and to deter violations of the Act. The Court believed that significantly limiting a plaintiff’s ability to sue to enforce the statute’s requirements would undercut the legislature’s purpose. Id. ¶ 37 (“To require individuals to wait until they have sustained some compensable injury beyond violation of their statutory rights before they may seek recourse, as defendants urge, would be completely antithetical to the Act’s preventative and deterrent purposes.”).

Impact: More BIPA cases will be filed, and Defendants may be stuck in state court.
Over a hundred BIPA class actions have been filed over the last two years. Filings seemed to slow after the appellate court decided Rosenbach and held that plaintiffs must have a tangible injury to have a viable BIPA claim. Now that the Illinois Supreme Court has conclusively held that claims can be stated based solely on statutory violations, BIPA class actions will undoubtedly increase.

Further, defendants may be precluded, in at least some jurisdictions, from removing no-injury BIPA cases to federal court. Federal district courts in Illinois, and the 2nd Circuit Court of Appeals, have all held that bare violations of BIPA without a tangible injury do not create a case or controversy as required under Article III for federal subject-matter jurisdiction. Santana v. Take-Two Interactive Software, 717 Fed. App’x. 12 (2nd Cir. Nov. 17, 2017); McGinnis v. U.S. Cold Storage, No. 17 C 08054, 2019 WL 95154 (N.D. Ill. Jan. 3, 2019); Rivera v. Google, Inc., No. 16 C 02714, 2018 WL 6830332 (N.D. Ill. Dec. 29, 2018). All of these decisions relied on the U.S. Supreme Court’s 2016 decision in Spokeo v. Robins, 136 S. Ct. 1540 (2016). But see, Patel v. Facebook, Inc., 290 F. Supp. 3d 948 (N.D. Cal. 2018) (finding Article III standing in BIPA case despite lack of injury).

Thus, defendants caught up in the new wave of BIPA cases may find themselves in the odd position of arguing that a plaintiff’s bare statutory violation is sufficiently tangible to support federal-court jurisdiction. Otherwise those defendants will be forced to defend in plaintiff’s oft-preferred forum: state court.