By John Fester and Law Clerk Jared Costanzo
February 22, 2019
On January 25, 2019, the Illinois Supreme Court held in Rosenbach v. Six Flags Entertainment Corp. that a plaintiff can allege a violation of rights under the state’s Biometric Information Protection Act (BIPA) without tangible harm. This is a departure from prior court precedent, which held that “standing” typically requires a plaintiff to plead actual harm or damage as part of their request for court intervention. For example, in Spokeo, Inc. v. Robins, the US Supreme Court held that bare allegations of statutory violation are not enough to satisfy standing requirements, rather concrete injury-in-fact had to be established.
BIPA was enacted in 2008 for the purpose of regulating the “collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” While BIPA generally covers only private entities, private entities that work with public school districts are subject to the Act. BIPA is enforced through private rights of action, enabling future litigants to sue entities for violating BIPA. Under BIPA, plaintiffs could potentially recover $1,000 or more per violation from entities that negligently violate the Act, or $5,000 per violation for intentional or reckless violations of the Act. Vendor contracts should be reviewed to ensure this potential liability is not shifted to the school district.
In Rosenbach, the plaintiff was fingerprinted in connection with his purchase of a season pass for Six Flags Theme Park. Six Flags sold repeat-entry passes since 2014, and used a fingerprinting process when issuing those passes. The plaintiff alleged that Six Flags had collected her minor son’s fingerprint during a school fieldtrip, without first informing her or her son of the purpose of the collection or the length of time the biometric data would be maintained. Neither the mother or teenage son signed any written release regarding the collection of fingerprints.
Six Flags moved to dismiss the lawsuit, asserting that while the theme park did collect the bio-scan fingerprint, the plaintiff had not suffered an actual or threatened injury and therefore lacked standing to sue. The Illinois Supreme Court held that injury or adverse effect does not need to be alleged for standing purposes. Simply put, the violation of BIPA, in itself, is sufficient to support plaintiff’s statutory cause of action. The plaintiff is not required to suffer from tangible harm to file suit.
The court’s ruling in Rosenbach will likely impact school districts. In Illinois, some schools collect biometric data to enable students to pay for lunch using just their fingerprint. To limit the risk under BIPA, school districts should include in third party contracts language that requires any private entity that intends to collect student biometric data to first obtain written consent and to provide notice to the legal guardians of students. School districts should also note the Illinois school code requires schools to obtain written consent from the student’s parent or guardian prior to the collection of biometric data. Further, all student biometric data must be destroyed upon 30 days after the discontinuation of use.
Should your school district need assistance in dealing with any of these issues, we welcome you to contact your attorney at Scariano, Himes and Petrarca, Chtd.