Illinois Appellate Court Concludes that Actual Harm is not Required under Biometric Information Privacy Act
An Illinois appellate court’s recent opinion may very well open the flood gates for litigation arising out of alleged violations of the Illinois Biometric Information Privacy Act (“BIPA”) by eliminating the need to allege actual harm to have standing to sue. Sekura v. Krishna Schaumburg Tan, Inc., 2018 IL App (1st) 180175.
BIPA regulates the use and storage of information derived from biometric identifiers such as fingerprints, iris scans, and voiceprints. Under BIPA, before obtaining a customer’s biometric identifier, private entities must disclose the specific purpose and length of time for which the data will be collected, stored, and used, and how that data will eventually be destroyed. A BIPA violation allows plaintiffs to recover the greater of either actual damages or statutory damages. The statute provides for damages of $1,000 for each negligent violation and $5,000 for each reckless or willful violation. Importantly, BIPA states that “any person aggrieved by a violation” may bring a legal cause of action.
In Sekura, a tanning salon scanned Klaudia Sekura’s finger prints for enrollment in the company’s national membership database, which then allowed customers to use their membership at other locations across the country. A customer sued, alleging that the salon violated BIPA in a number of ways: by not obtaining written consent to use her fingerprints; by failing to disclose the salon’s plans to store the fingerprint data or how the data would be destroyed in the event a customer’s membership was terminated or the salon closed; and by disclosing her fingerprints to an out-of-state third-party vendor.
The tanning salon moved to dismiss the lawsuit for failure to state a claim under BIPA, arguing that plaintiff failed to allege actual harm and thus lacked standing to sue. The trial court initially denied the motion, but on a motion to reconsider, stayed the proceeding in light of multiple cases pending before the Illinois Appellate Court involving similar legal issues. Then, the Second District Appellate Court issued its opinion in Rosenbach v. Six Flags Entertainment Corp., 2017 IL App (2d) 170317. In Rosenbach, the plaintiff alleged that when her minor son purchased a theme park season pass, the defendant collected his fingerprints without obtaining consent or disclosing the plan for collection, storage, and destruction of that biometric data. The Second District affirmed the trial court’s decision to grant defendant’s motion to dismiss, finding that the mere allegation of a statutory violation without an allegation of “injury or adverse effect” is insufficient to confer standing under BIPA. With Rosenbach in mind, the trial court in Sekura granted the defendant’s motion to dismiss, and plaintiff appealed.
In Sekura, the only issue on appeal was whether harm or injury is required to have standing under BIPA. This issue hinges on the meaning of the statutory language: “person aggrieved by a violation” of BIPA. Contrary to Rosenbach, the First District held that the plain language of BIPA supported the Sekura plaintiff’s right to sue and emphasized that BIPA’s legislative intent is to “prevent any harm from occurring in the first place, thereby reassuring the public, who will then be willing to participate in [biometric data] technology." The First District explained that, unlike lost keys or identification cards, the mere release of biometric information constitutes an irreparable harm because a person cannot obtain new fingerprints, new eyeballs, or new DNA. The First District explained that “[f]orcing a member of the public to wait until after irretrievable harm has already occurred in order to sue would confound the very purpose of [BIPA].” Id. Accordingly, the Sekura court concluded that plaintiff was “a person aggrieved by a violation” of BIPA and, therefore, had standing to sue. The First District also noted that even if it agreed with the Rosenbach court’s interpretation of BIPA, Sekura is distinguishable because, unlike Rosenbach, Ms. Sekura did allege an “injury or adverse effect” in the form of (a) an injury to her legal right to privacy of her own biometric information by the disclosure of this information to an out-of-state third party vendor, and (b) mental anguish.
For now, practitioners on both sides of the bar have case law to support diametrically opposed legal positions. While defendants will no doubt continue to seek dismissal of BIPA claims based on a purported lack of standing, Sekura affords the plaintiffs with a legal basis for countering such motions. Clearly, the district court split created by Rosenbach and Sekura will eventually need to be resolved by the Illinois Supreme Court in order to ensure a consistent application of this important law.
- PROFESSIONAL LIABILITY CLIENT ALERT: Application of Judgmental Immunity in Illinois
- REAL ESTATE CLIENT ALERT: Michigan Court of Appeals Held That Non-Tenants May Not Sue Landlords Under Common Theories of Liability
- CYBER RISK CLIENT ALERT: What Companies can Learn from Uber’s Recent $148 Million Settlement
- DATA BREACH LITIGATION UPDATE: District Court Judge Rejects Remijas Settlement and Decertifies Class
- LIFE SCIENCES CLIENT ALERT: Artificial Intelligence, Healthcare, Life Science, and the Next Merger
- PROFESSIONAL LIABILITY CLIENT ALERT: Physicians Beware: New Jersey Supreme Court Erodes Self-Critical Analysis Privilege
- EMPLOYMENT LAW CLIENT ALERT: Tenth Circuit Rules Failure to File Discrimination Claim with EEOC No Longer Jurisdictional Bar
- EMPLOYMENT LAW: Can Employers Really Take a Deep Breath in the Wake of Epic Systems Corp. v. Lewis?
- LIFE SCIENCES CLIENT ALERT: Seventh Circuit Reverses $3 Million Judgment Against GlaxoSmithKline Citing Preemption
- Professional Liability
- Class Action
- Insurance & Reinsurance Litigation & Counseling
- Complex Commercial Litigation
- Insurance Coverage
- Cyber Risk & Liability
- Toxic Tort
- Professional Development
- Product Liability
- Construction Litigation & Counseling
- Employment Litigation & Counseling
- Discrimination, Harassment & Hostile Workplace Claims
- Social Media & Privacy
- Workers' Compensation
- Medical Negligence & Healthcare Liability
- Pharmaceutical & Medical Device Litigation