Illinois Supreme Court Justices sceptical of defendant position on harm in biometric privacy suit

At least three of seven Illinois Supreme Court justices appear to be sceptical of the position expressed in oral arguments by Six Flags legal representation that plaintiffs must allege more harm than a technical violation under the state’s Biometric Information Privacy Act (BIPA) to establish standing, Law360 reports. The Rosenbach v. Six Flags case is expected to significantly influence the status of numerous lawsuits filed in response to technical or procedural violations of BIPA’s informed consent rules.

Six Flags attorney Kathleen O’Sullivan argued that whether an individual is aggrieved under BIPA is a separate question from whether the statutes consent and disclosure requirements have been violated. While BIPA was crafted to address concerns about compromised data, O’Sullivan told the court that “did not mean the Legislature intended to create a private right of action for someone whose biometric data has not been compromised at all,” according to Law360.

Justice Anne Burke responded that once biometric data has been collected without informed consent, it is “too late to wait” for it to be compromised. “They may never know, and you can’t get your fingerprints back. It’s irreparable harm,” she said.

Justice Robert Thomas likewise commented that the law’s purpose is to prevent actual harm from occurring.

Chief Justice Lloyd Karmeier asked whether a lack of harm from data collection practices means a company can violate BIPA “with impunity.” O’Sullivan answered that the company would be exposed to risk, but that the law was created by the Legislature to provide compensation only to harmed individuals.

Rosenbach attorney Phillip Bock was asked significantly fewer questions from the bench in urging the appellate court’s ruling to be overturned, Law360 reports. He argued that the privacy, property, and informational interests were identified by the Legislature to ensure companies are transparent in biometric data collection. He also said that biometric data compromise is dealt with separately in Illinois’ Personal Information Privacy Act, and that the same private right of action is contained in the state’s AIDS Confidentiality Act.

“That doesn’t make any sense to say ‘aggrieved’ means this statute, or that statute, can’t be enforced when the defendant does exactly what is prohibited,” he argued.

Amicus briefs have been filed by interest groups on both sides, and attorneys have cautioned that while the Six Flags case will establish precedent, its scope is narrow and that it is an early step in a larger process of establishing BIPA’s limits.

Article Topics

Biometric Information Privacy Act (BIPA)  |  biometrics  |  data protection  |  legislation  |  privacy