The Illinois Supreme Court recently handed down its much-anticipated decision in Rosenbach v. Six Flags Entertainment Corporation et al., clarifying what makes someone “aggrieved” and able to bring a claim under the Illinois Biometric Information Privacy Act (“BIPA”). We have addressed this issue in prior blogs, including here and here. The Supreme Court has now held an individual need not allege some actual injury or adverse effect to be “aggrieved” and have statutory standing. An individual can state a BIPA claim simply by alleging an entity’s failure to follow the statute’s notice and consent requirements.
Continue Reading Actual Injury Unnecessary to Sue Under Illinois Biometric Law

On November 20, 2018, the Illinois Supreme Court heard oral arguments in Rosenbach v. Six Flags Entertainment Corp. and Great America LLC to decide whether a technical violation of Illinois’ Biometric Information Privacy Act (BIPA), 740 ILCS 14 et seq., without some additional injury, is enough to give an individual standing to sue under the Act.

As explained in further detail here, BIPA establishes certain notice-and-consent requirements that private entities must follow if they are going to collect, store, and use biometric identifiers and information, such as fingerprints. BIPA also creates a private right of action for individuals who are “aggrieved” by a violation of the act. In recent years, there has been a huge upswing in the number of cases filed under BIPA. The main issue these cases encounter early on is whether a company’s mere technical violation of the notice-and-consent requirements is enough to make a plaintiff “aggrieved,” and therefore have standing to sue, or if additional injury is required.


Continue Reading The Fight Over Standing Under the Biometric Information Privacy Act Continues in Illinois High Court

In recent years, the use of biometrics in business has been growing. In the employment context, for example, some employers use biometric time clocks, which allow employees to “clock in” with a fingerprint or iris scan. Unlike a password or social security number, however, an individual’s biometric identifier or information cannot be changed or replaced if compromised. In the event of a data breach, individuals may have no recourse against identity theft, due to the biologically unique nature of biometrics.
Continue Reading Actual Injury Required to Sue Under Illinois Biometric Information Privacy Act