Illinois Appellate Court Concludes that Actual Harm is not Required under Biometric Information Privacy Act
An Illinois appellate court’s recent opinion may very well open the flood gates for litigation arising out of alleged violations of the Illinois Biometric Information Privacy Act (“BIPA”) by eliminating the need to allege actual harm to have standing to sue. Sekura v. Krishna Schaumburg Tan, Inc., 2018 IL App (1st) 180175.
BIPA regulates the use and storage of information derived from biometric identifiers such as fingerprints, iris scans, and voiceprints. Under BIPA, before obtaining a customer’s biometric identifier, private entities must disclose the specific purpose and length of time for which the data will be collected, stored, and used, and how that data will eventually be destroyed. A BIPA violation allows plaintiffs to recover the greater of either actual damages or statutory damages. The statute provides for damages of $1,000 for each negligent violation and $5,000 for each reckless or willful violation. Importantly, BIPA states that “any person aggrieved by a violation” may bring a legal cause of action.
In Sekura, a tanning salon scanned Klaudia Sekura’s finger prints for enrollment in the company’s national membership database, which then allowed customers to use their membership at other locations across the country. A customer sued, alleging that the salon violated BIPA in a number of ways: by not obtaining written consent to use her fingerprints; by failing to disclose the salon’s plans to store the fingerprint data or how the data would be destroyed in the event a customer’s membership was terminated or the salon closed; and by disclosing her fingerprints to an out-of-state third-party vendor.
The tanning salon moved to dismiss the lawsuit for failure to state a claim under BIPA, arguing that plaintiff failed to allege actual harm and thus lacked standing to sue. The trial court initially denied the motion, but on a motion to reconsider, stayed the proceeding in light of multiple cases pending before the Illinois Appellate Court involving similar legal issues. Then, the Second District Appellate Court issued its opinion in Rosenbach v. Six Flags Entertainment Corp., 2017 IL App (2d) 170317. In Rosenbach, the plaintiff alleged that when her minor son purchased a theme park season pass, the defendant collected his fingerprints without obtaining consent or disclosing the plan for collection, storage, and destruction of that biometric data. The Second District affirmed the trial court’s decision to grant defendant’s motion to dismiss, finding that the mere allegation of a statutory violation without an allegation of “injury or adverse effect” is insufficient to confer standing under BIPA. With Rosenbach in mind, the trial court in Sekura granted the defendant’s motion to dismiss, and plaintiff appealed.
In Sekura, the only issue on appeal was whether harm or injury is required to have standing under BIPA. This issue hinges on the meaning of the statutory language: “person aggrieved by a violation” of BIPA. Contrary to Rosenbach, the First District held that the plain language of BIPA supported the Sekura plaintiff’s right to sue and emphasized that BIPA’s legislative intent is to “prevent any harm from occurring in the first place, thereby reassuring the public, who will then be willing to participate in [biometric data] technology." The First District explained that, unlike lost keys or identification cards, the mere release of biometric information constitutes an irreparable harm because a person cannot obtain new fingerprints, new eyeballs, or new DNA. The First District explained that “[f]orcing a member of the public to wait until after irretrievable harm has already occurred in order to sue would confound the very purpose of [BIPA].” Id. Accordingly, the Sekura court concluded that plaintiff was “a person aggrieved by a violation” of BIPA and, therefore, had standing to sue. The First District also noted that even if it agreed with the Rosenbach court’s interpretation of BIPA, Sekura is distinguishable because, unlike Rosenbach, Ms. Sekura did allege an “injury or adverse effect” in the form of (a) an injury to her legal right to privacy of her own biometric information by the disclosure of this information to an out-of-state third party vendor, and (b) mental anguish.
For now, practitioners on both sides of the bar have case law to support diametrically opposed legal positions. While defendants will no doubt continue to seek dismissal of BIPA claims based on a purported lack of standing, Sekura affords the plaintiffs with a legal basis for countering such motions. Clearly, the district court split created by Rosenbach and Sekura will eventually need to be resolved by the Illinois Supreme Court in order to ensure a consistent application of this important law.
- 11th Circuit Court Clarifies Harvey v Geico Florida Supreme Court Decision on Evidence of Claimant and Claimant Counsel Action in Bad Faith Case
- Finally! Discovery Harassment of Top-Level Corporate Officers is Curtailed
- Limitations for Policyholders Seeking Coverage in Employment-Related BIPA Cases
- Vaccine Mandates in the Workplace Are Spreading
- The Death of Impartiality - "Dr. Death," Reptilian Tactics, and Fighting Juror Bias
- Considerations That Employers Should be Mindful of as Employees Return to the Office
- A Win for Policyholders Seeking Coverage in a BIPA Class Action Suit
- Reasonable Disagreement or Fraud? Competing Estimates of Property Damage in First Party Claims
- Malpractice Mayhem: An Insurer's Standing to Sue Counsel Retained to Defend Its Insured
- Prejudgment Interest Now a Reality in Illinois
- Professional Liability
- Class Action
- Complex Commercial Litigation
- Insurance & Reinsurance Litigation & Counseling
- Insurance Coverage
- Cyber Risk & Liability
- Toxic Tort
- Professional Development
- Discrimination, Harassment & Hostile Workplace Claims
- Workers' Compensation
- Employment Litigation & Counseling
- Medical Negligence & Healthcare Liability
- Pharmaceutical & Medical Device Litigation
- Product Liability
- Construction Litigation & Counseling
- Social Media & Privacy