Illinois Supreme Court rules against Six Flags in landmark biometric privacy case

The Illinois Supreme Court has ruled against Six Flags in a landmark Biometric Information Privacy Act (BIPA) case which could result in hundreds of companies paying thousands of dollars in damages for failing to properly notify and obtain consent from people about the collection of their biometrics.

The decision (PDF) reverses the decision of the appellate court that the violations alleged are merely “technical” in nature, and do not constitute harm under the statute.

Early indications were that at least three of the court’s seven justices were sceptical of Six Flags’ argument, also used in many of the approximately 100 class actions brought under the statute alleging procedural violations, that the plaintiff does not qualify as “aggrieved.”

The court noted that the procedural protections are crucial, as biometric identifiers cannot be changed if compromised, and also that the private right of action is the only enforcement mechanism available. The ruling also notes that the cost of compliance with BIPA is likely to be insignificant compared to the potential harm caused a breach or misuse of biometric data.

“When a private entity fails to comply with one of section 15’s requirements, that violation constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose biometric identifier or biometric information is subject to the breach,” the justices wrote in the ruling.

“The violation, in itself, is sufficient to support the individual’s or customer’s statutory cause of action.”

Several amicus briefs have been filed in the Six Flags suit and related actions, and positive reaction from rights groups was not surprisingly swift.

“The decision is a victory for consumers across Illinois over Facebook and other tech giants, who argue in courts that consumers do not face “harm” from privacy violations and have pushed legislation in recent years to undermine the Illinois law,” the Illinois Public Interest Research Group said in a statement reported by Capitol Fax. “Consumer and privacy advocates such as Illinois PIRG Education Fund continue to defend BIPA in the courts and in the Illinois General Assembly. Illinois PIRG Education Fund’s national staff is fighting Congressional efforts by Facebook and others to enact a national law that would permanently preempt any existing or prevent any future state actions on data protection.”

The ruling could also be bad news for Facebook, which is involved in its own BIPA suit.

Article Topics

biometric data  |  Biometric Information Privacy Act (BIPA)  |  biometrics  |  data protection  |  fingerprint biometrics  |  legislation  |  privacy