Client Alert
Rosenbach v. Six Flags Entertainment Corporation:The Illinois Supreme Court Clarifies BIPA’s “Aggrieved” Pleading Requirement
February 06, 2019
By Behn Dayanim, Mark Pollack, Robert Silvers,Adam Reich , Peter Hegel
In a decision that may precipitate increased class action litigation under Illinois’ unique biometric privacy law, the Illinois Supreme Court recently hearkened back to a decision from more than 100 years ago, Glos v. People, 259 Ill. 332, 340 (1913), to clarify the term “aggrieved,” as used in the state’s Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (“BIPA”). [1] In Rosenbach v. Six Flags Entertainment Corporation, 2019 IL 123186, the Court considered in the context of a motion to dismiss whether a plaintiff who alleged a violation of BIPA without additional allegations about personal injury had met the pleading burden. [2] Referring to Glos, which held “that to be aggrieved simply ‘means having a substantial grievance . . . [,]’” the Court held that a plaintiff who alleges a violation of BIPA with respect to his or her own biometric information satisfies the “aggrieved” party pleading requirement. [3] As a result, it is anticipated that defendants may face greater difficulties in securing prompt dismissal of BIPA claims in Illinois, obliging businesses to take a fresh look at their respective policies and procedures.
BIPA
The Illinois Legislature passed BIPA in 2008 to “regulat[e] the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.”[4] BIPA “imposes numerous restrictions on how private entities collect, retain, disclose and destroy biometric identifiers, including retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, or biometric information.[5]” Under BIPA, “biometric information” is defined as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual.” [6] Biometric information is limited to “information derived from items or procedures” included in the definition of biometric identifiers, such as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” [7]
In order to “collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer's biometric identifier or biometric information,” BIPA requires that the private entity attempting to collect, purchase, receive, or otherwise obtain such information:
[inform] the subject or the subject's legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored;
[inform] the subject or the subject's legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and
[receive] a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative. [8]
BIPA provides a private right of action to any person “aggrieved by a violation” of BIPA, whereby such a person may seek damages, attorneys’ fees and costs, and injunctive relief. [9]
The Rosenbach Opinion
Rosenbach v. Six Flags Entertainment Corp involves a lawsuit filed under BIPA against Six Flags Entertainment Corporation (“Six Flags”) by Stacy Rosenbach, seeking “redress for [her son], individually, and on behalf of all other similarly situated persons.” [10] Ms. Rosenbach’s son, Alexander, visited the Six Flags Great America amusement park in Gurnee, Illinois on a school field trip when he was 14-years-old. In advance of the trip, Ms. Rosenbach purchased a season pass for her son online, but the process could not be completed until Alexander appeared in person at the amusement park. When he did appear, Alexander was asked to scan his thumb into Six Flags’ biometric data capture system, and after he did so, he was provided a season pass card.
Per the underlying Complaint, Ms. Rosenbach allegedly did not know that fingerprinting was a requirement for the season pass system, and neither Ms. Rosenbach nor her son was ever informed about the purpose and term for which the fingerprints were collected. [11] The Complaint also alleges that neither Ms. Rosenbach nor her son signed any written release regarding Alexander’s fingerprints, and neither of them consented in writing “to the collection, storage, use[,] sale, lease, dissemination, disclosure, redisclosure, or trade of, or for [Six Flags] to otherwise profit from, Alexander’s thumbprint or associated biometric identifiers or information.” [12]The Complaint further alleges that Six Flags has “not publicly disclosed what was done with the [plaintiff’s] information or how long it will be kept, nor do they have any ‘written policy made available to the public that discloses [Six Flags’] retention schedule or guidelines for retaining and then permanently destroying biometric identifiers and biometric information.’” [13]
Six Flags moved to dismiss the complaint, asserting, inter alia, that the plaintiff had not met the requisite pleading burden under BIPA because Alexander had “suffered no actual or threatened injury and therefore lacked standing to sue.” [14] The circuit court denied this portion of Six Flags’ motion to dismiss, and Six Flags sought interlocutory review. [15] Specifically, Six Flags asked the appellate court to consider whether an “aggrieved person” under BIPA may seek statutory liquidated damages and injunctive relief when “the only injury he alleges is a violation of §l5(b) of the Act by a private entity who collected his biometric identifiers and/or biometric information without providing him the required disclosures and obtaining his written consent.” [16]
The appellate court granted review and held that “a plaintiff is not ‘aggrieved’ within the meaning of the Act . . . solely on a defendant’s violation of the statute.” [17] In the appellate court’s view, a plaintiff must allege more than a “technical violation of the Act,” because “if the Illinois legislature intended to allow for a private cause of action for every technical violation of the Act, it could have omitted the word ‘aggrieved’ and stated that every violation was actionable.[18]”
The Illinois Supreme Court subsequently allowed a petition for review and entertained friend of the court briefs. On January 25, 2019, the Illinois Supreme Court issued a thirteen (13)-page Opinion reversing the appellate court and remanding the case back to the circuit court for further proceedings.
The Illinois Supreme Court’s Opinion in Rosenbach purports to be grounded in “basic principles of statutory construction,” and concludes that it is “untenable” to interpret BIPA to require proof of actual damages at the pleading stage. [19]The Court analogizes BIPA to the Illinois AIDS Confidentiality Act, which also grants a private right of action to “any person ‘aggrieved’ by a violation of the statute or a regulation promulgated under the statute.” [20] Because courts have held that “[p]roof of actual damages is not required in order to recover” under the AIDS Confidentiality Act, the Illinois Supreme Court reasons in Rosenbach that the result should be no different under BIPA. [21] The capstone of the Court’s BIPA construction, however, is its interpretation of the term “aggrieved.” Here, the Court references the Glos opinion from 1913 as key precedent for interpreting the term “aggrieved” to “mean[] having a substantial grievance; a denial of some personal or property right.” [22]
Potential Impact Of Rosenbach
Although the Illinois Supreme Court’s holding in Rosenbach clarifies a narrow pleading issue, many important questions regarding BIPA remain unanswered, including, for example, the duration of time a plaintiff has after an alleged violation to file a claim and the limits of what constitutes sufficient disclosure and consent. Additionally, the Rosenbach decision does not provide definitive guidance as to whether merely alleging a technical violation of the statute would satisfy a plaintiff’s pleading burden to establish standing under Article III of the United States Constitution. It would appear this is not the case, as Article III requires plaintiffs to demonstrate an “injury-in-fact.”[23] Indeed, on December 29, 2018, the United States District Court for the Northern District of Illinois dismissed a complaint under BIPA precisely because the plaintiffs failed to allege a concrete injury sufficient to establish standing under Article III. [24]
Notwithstanding the many remaining open questions, it is conceivable that the Plaintiffs’ bar will be emboldened by Rosenbach to file new class action lawsuits in state courts in Illinois based on mere allegations of technical or facial violations of the statute. Consequently, companies should consider proactively reviewing their existing policies and procedures to ensure that they deploy adequate measures to obtain consent and manage the retention and destruction of biometric identifiers and information. Further, companies—including senior management and directors—should review their biometric information retention policies to ensure they have a thorough understanding of the litigation risks posed and the policies in place that address such risks.
Paul Hastings is uniquely positioned to aid in the review and revision of biometric information collection and retention policies and can draw on a wealth of experience, capably guiding companies through the most intricate data privacy compliance challenges. Our Chicago legal team is experienced with BIPA and its subsequent, nuanced litigation complexities, and Paul Hastings is able to employ a unique, cross-disciplinary team of legal and regulatory experts across multiple offices, including a former Assistant Secretary for Cyber Policy at the U.S. Department of Homeland Security, high-profile privacy and security officers of Fortune 100 companies, and Ph.D.-credentialed data scientists with diverse perspectives and experience in business, law, and technology.
[1] See [_Rosenbach v. Six Flags Ent. Corp, 2019 IL. 123186](http://www.illinoiscourts.gov/Opinions/SupremeCourt/2019/123186.pdf)_, at pp. 9–10, ¶ 30.
[2] The Rosenbach Court did not express any opinion as to whether any actual BIPA violations had occurred.
[3] Id. at ¶¶ 30, 40.
[4] 740 ILCS 14/5(g).
[5] Rosenbach, at 1, ¶ 1.
[6] 740 ILCS 14/10.
[7] Id. Notably, BIPA expressly excludes from biometric identifiers: “writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color.” Id.
[8] 740 ILCS 15(b).
[9] 740 ILCS 14/20.
[10] Rosenbach, at 4, ¶ 10.
[11] (See Compl. ¶¶ 23–25.)
[12] (See id. ¶¶ 26–27.)
[13] (See id. ¶ 28); see also 740 ILCS 14/15 (BIPA requires a “private entity in possession of biometric identifiers or biometric information” to, inter alia, “develop a written policy, made available to the public, establishing a retention schedule.”).
[14] Id., at 4, ¶ 12.
[15] Illinois has a three-tiered court system. The Illinois Supreme Court is the highest court in the state, followed by the Illinois Appellate Court (where a party generally has the right to appeal its case), and the Illinois Circuit Court, which is a court of general jurisdiction that has original jurisdiction in all matters apart from those in which the Illinois Supreme Court has jurisdiction.
[16] Id., at 5, ¶ 14.
[17] Id., ¶ 15.
[18] 2017 IL App (2d) 170317, ¶¶ 23, 28.
[19] Rosenbach, at 6, ¶¶ 24–25.
[20] See 410 ILCS 305/1 et seq.; Rosenbach, at 7, ¶ 26 (citing 410 ILCS 305/13).
[21] Id. (citing Doe v. Chand, 335 Ill. App. 3d 809, 822 (2002)).
[22] Glos, 259 Ill. at 340. The Court also quotes the Merriam-Webster’s Collegiate Dictionary’s definition of the term “aggrieved” as justification for its conclusion. See Rosenbach, at 7, ¶ 32,
[23] See Rule 16a-6 under the Exchange Act.
[24] For example, Rule 16a-3(g) under the Exchange Act provides that, in the case of a transaction made pursuant to (a) a contract, instruction, or written plan that satisfies the affirmative defense conditions of Exchange Act Rule 10b5-1(c), or (b) an employee benefit plan at the volition of a plan participant, where the insider does not select the date of execution of such transaction, the two-day filing requirement for the Form 4 with respect the transaction is calculated from the earlier of (i) the date a broker-dealer or plan administrator notifies the insider of the execution, and (ii) the third business day after the trade date.
Contributors
