Appellate Court Limits Who May Sue Under Biometric Information Privacy Act

As noted in a prior Commentary, plaintiffs continue to bring a flood of lawsuits under Illinois' Biometric Information Privacy Act ("BIPA") against companies that collect, use, or store biometric identifiers. Many of these cases are class actions.

The Illinois legislature passed BIPA in 2008 to provide standards for private entities that collect, use, or store biometric identifiers, such as fingerprints, face scans, and retina scans. BIPA also provides for a private right of action for any "person aggrieved by a violation" of the statute.

The first appellate court to interpret the "aggrieved by" provision recently did so in Rosenbach v. Six Flags Entertainment Corporation, 2017 IL App (2d) 170317. The plaintiff alleged that, in connection with her son's purchase of an amusement park season pass, the defendants failed to properly obtain written consent and disclose its plan for the collection, storage, use, and destruction of her son's biometric identifiers.