(CN) – The Illinois Supreme Court ruled Friday that consumers in the state do not have to assert actual harm when they sue companies under the state’s biometric privacy law.
The court’s seven justices came to a unanimous decision that plaintiffs do not have to allege a concrete injury, such as stolen money or identity, when filing such lawsuits because an alleged violation of the Illinois Biometric Information Privacy Act, or BIPA, alone is sufficient to establish standing.
“When a private entity fails to comply with one of section 15’s requirements, that violation constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose biometric identifier or biometric information is subject to the breach,” Chief Justice Lloyd Karmeier wrote in the 13-page opinion. “Such a person or customer would clearly be ‘aggrieved’ within the meaning of section 20 of the Act and entitled to seek recovery under that provision.”
BIPA was enacted in 2008 as a way to help regulate the collection, storage and use of biometric data, including a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.
The ruling comes in a class action filed in 2016 in Lake County Circuit Court by Stacy Rosenbach, a mother who claimed Six Flags violated BIPA when it scanned her son’s thumbprint for a theme park season pass without her permission during a field trip.
Rosenbach argued her son and others like him are entitled to damages and injunctive relief because the theme park did provide proper notification of the scan, obtain consent for it or explain how the data would be used or for how long. She is represented by attorneys from Chicago-based Bock, Hatch, Lewis & Oppenheim, LLC and Progressive Law Group LLC.
Friday’s ruling reversed the state appeals court’s dismissal of Rosenbach’s lawsuit, which was based on the argument from Six Flags’ counsel, international firm Perkins Coie LLP, that the boy lacked a concrete injury. The case is now headed back to the circuit court for further proceedings.
Attorneys for Rosenbach and Six Flags did not immediately respond Friday to email requests for comment.
The ruling could have a big impact on a $30 billion biometric privacy class action against Facebook currently pending before the Ninth Circuit.
Facebook is appealing a similar decision issued last year by a federal judge in California who found a jury must decide users’ claim that the social network’s photo-tagging software is a violation of their privacy.
The ruling setting a jury trial was stayed last May pending outcome of the appeal.