Six Flags Biometric Privacy Class Action Must Allege Actual Harm, Says Court

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

An Illinois mother suing Six Flags for violation of a state biometric privacy law will have to allege she suffered actual harm, according to an appeals court’s recent opinion.

Three judges of the Second District Appellate Court of Illinois concur that the civil suit provision of the state’s Biometric Information Privacy Act can’t be invoked for purely technical violations of the law that don’t actually harm the plaintiff.

BIPA, which imposes notice and consent requirements on private entities that handle biometric information, allows “aggrieved” persons to sue over violations. But the court concluded that a person who can’t allege particular harm traceable to the alleged violation is not an “aggrieved” person within the meaning of the statute.

BIPA governs the capture and use of individuals’ biometric information, such as by scans of eyes, faces or fingerprints. Private entities that collect and use such information must have a written, publicly-available policy establishing a retention schedule and disposal procedures for biometric information.

Entities that collect or purchase such information must inform the subject that the information is being collected or stored, tell them the purpose and length of time for which the information will be stored, and get the subject’s consent to collect the information.

If the entity fails to follow these or other requirements, BIPA allows a person aggrieved by the violation to bring a civil BIPA lawsuit seeking liquidated damages of up to $5,000 per violation.

The current appeal revolves around the word “aggrieved.” The case on appeal was filed in January 2016 by plaintiff Stacy Rosenbach on behalf of her son and a proposed Class of similarly situated persons.

According to Rosenbach’s complaint, Six Flags uses a fingerprint scanning system to identify season pass holders at the Six Flags Great America amusement park outside Chicago.

Rosenbach says that when her son bought a season pass, Six Flags scanned his thumbprint into a “biometric data capture system.” She alleges Six Flags did not provide her or her son with any written release regarding the scanning and storage of his thumbprint, nor did she ever consent to Six Flags’ capture and use of that thumbprint.

Rosenbach did not claim any harm resulted, but she did allege she would not have purchased the season pass had she known Six Flags would commit the alleged BIPA violations.

After the circuit court denied Six Flag’s motion to dismiss, Six Flags asked the court to certify two questions for resolution by the appeals court. The questions addressed whether a person can be “aggrieved” merely by a technical violation of the statute and whether such a person can seek liquidated damages or injunctive relief.

Since BIPA does not define “aggrieved,” the appeals court considered the word’s dictionary definition. The court concluded that “aggrieved” requires some sort of actual adverse effect or harm that resulted from the violation.

Purely technical violations of the notice and consent provisions fall short of that requirement, the court said. The court did note, however, that harm does not have to be pecuniary to render the plaintiff “aggrieved.”

The decision could significantly limit the number of claims brought under the state’s biometric privacy law. Many employers who use biometric-based control systems have faced similar claims for violation of the law’s technical requirements.

The case now goes back to the circuit court.

The Six Flags Biometric Information Privacy Act Class Action Lawsuit is Rosenbach v. Six Flags Entertainment Corp. and Great America LLC, Case No. 16-CH-13, in the Appellate Court of Illinois, Second District.

UPDATE: On Jan. 25, 2019, the Illinois Supreme Court decided that Six Flags indeed violated the state’s biometric privacy laws by obtaining fingerprints from visitors without collecting legally-required permission.