On January 25, 2019, the Illinois Supreme Court published its widely anticipated decision in Rosenbach v. Six Flags Entertainment Corporation et al., addressing the question of what it means to be an “aggrieved” person under the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (“BIPA”). Under BIPA, aggrieved persons are entitled to seek liquidated damages and injunctive relief. In a unanimous decision authored by Chief Judge Karmeier, the court held that individuals seeking relief under BIPA “need not allege some actual injury or adverse effect” to be considered aggrieved persons.
The court’s decision reversed a lower court ruling that distinguished between “actual” and “technical” BIPA violations. BIPA requires private entities to (i) inform individuals about the collection and storage of their biometric identifiers or information, (ii) detail the purpose and length of time for which such data will be collected, stored, or used, and (iii) obtain a written release from individuals prior to the collection of such data. The lower court characterized violations of these three requirements alone as “technical” violations of BIPA that would not entitle plaintiffs to relief absent allegations of “injury or adverse effect.”
In coming to its decision, the Illinois Supreme Court first considered the plain meaning of the term “aggrieved” in other statutory schemes. The court found it instructive that the term “aggrieved” in another Illinois statute, the AIDS Confidentiality Act, 410 ILCS 305/1 et seq., is understood to be satisfied merely by violating a substantive right created by the statute. Like BIPA, the AIDS Confidentiality Act also creates a private right of action for “aggrieved” persons.
The court next turned to the legal and dictionary definitions of the term “aggrieved” and determined that both supported understanding the term to mean violation of a right created by the statute, without the need to show actual harm. The court also contemplated the legislative intent underlying BIPA’s enactment. In doing so, it adopted language from Patel v. Facebook Inc., a Northern District of California decision that characterized violations of BIPA’s procedural protections as “[t]he precise harm the Illinois legislature sought to prevent.” The court further identified two ways by which the Illinois legislature crafted BIPA to protect biometric data: (i) by imposing procedural “safeguards” on the collection, storage, and use of biometrics and (ii) by providing individuals with a private right of action to enforce statutory requirements. The second, according to the court, “is as integral to implementation of the legislature’s objectives as the first” because of its deterrent effect.
Ultimately, the court expressed that both the “plain” and the “unambiguous” meaning of the statute, in conjunction with the legislative purpose of BIPA, required a finding that “aggrieved” persons include those individuals who have suffered only a violation of their statutory rights.
This decision will affect numerous pending federal and state BIPA actions that have struggled to interpret BIPA’s statutory requirements. It may also re-ignite pressure on the Illinois legislature to clarify and limit the scope of the statute—an effort contemplated by an amendment that was introduced, but not passed, last year. Despite developments in the Illinois state courts, a recent Northern District of Illinois decision suggested that BIPA claims brought in federal court may not be able to satisfy Article III standing requirements under the Supreme Court’s decision in Spokeo v. Robins absent an “actual” harm. Thus, the Rosenbach decision, while significant in its substance, may have limited effect in the federal courts.