Illinois Supreme Court Reaches Decision in the Rosenbach "Biometric" Case 

Cliff Perry and Matt Kellam

01.26.2019

In December, we notified our readership that in 2019 the Illinois Supreme Court would reach a decision in the Rosenbach v. Six Flags Entertainment case, a matter that involves the Illinois Biometric Information Privacy Act (BIPA). (Click here to read our last article on BIPA).  

Under BIPA, if a private entity employer collects, captures or otherwise obtains biometric information of employees (which includes the use of a fingerprint or hand scanner to keep track of an employee’s hours worked), the employer must develop and distribute a written policy that addresses various issues related to biometric information, and obtain written consent from employees before collecting, capturing or otherwise obtaining their biometric information. 

What happens if an employer violates the technical requirements of BIPA, however, but the employee does not allege any additional harm, such as a data breach resulting in the employee’s biometric data being released to the general public (which, one could argue, increases the chances that the employee could be the victim of identity theft)? This was the issue addressed in Rosenbach. 

The Illinois Appellate Court for the Second District had previously held in Rosenbach that a mere technical violation of BIPA, standing alone, does not entitle an individual to damages. Rather, to qualify as an “aggrieved” person under BIPA, a plaintiff must allege an “injury or adverse effect,” such as the employee's biometric information being compromised.      

On January 25, 2019, the Illinois Supreme Court reversed the decision of the Appellate Court for the Second District, holding that an individual is “aggrieved” under BIPA (and, thus, qualified to seek damages and attorneys’ fees) even if the individual does not allege an actual injury or adverse effect beyond her employer’s violation of the technical requirements of the statute.  The Illinois Supreme Court’s decision further reinforces the seriousness of biometric information and compliance with BIPA. 

Please let us know if we can assist you in evaluating your BIPA compliance. Several class action BIPA lawsuits are already pending and more will likely be filed following the Illinois Supreme Court’s decision.