Illinois Appellate Court Finds that BIPA Plaintiffs Must Show Actual Harm

Over the past several months, we have continued to keep track of a wave of class action litigation under the Illinois Biometric Information Privacy Act (BIPA). Recently, in Rosenbach v. Six Flags Entertainment Corp., 2017 IL App (2) 170317, an Illinois appellate court weighed in on BIPA for the first time regarding the minimum amount of injury a plaintiff must show to satisfy the statute’s standing requirement. Section 20 of BIPA states that “[a]ny person aggrieved by a violation of this Act shall have a right of action….” Defendants have interpreted that section as requiring some form of actual harm before a plaintiff may bring suit under BIPA. In other words, procedural violations—such as failing to issue the proper notification and obtain consent—would not be actionable unless the plaintiff was actually harmed by those violations (e.g., through identity theft).

In Rosenbach, the court agreed, holding that “[i]f a person alleges only a technical violation of the Act without alleging any injury or adverse effect, then he or she is not aggrieved and may not recover under any of the provisions in section 20.” In reaching this conclusion, the court engaged in significant statutory analysis as to the meaning of “aggrieved” and also looked to recent federal decisions interpreting BIPA’s statutory standing requirement. Thus, this decision clearly articulates the standard under BIPA that a person must suffer actual harm in order to be “aggrieved” under BIPA and will serve as a useful tool for defendants seeking to dismiss BIPA class actions at an early stage.

TIP: While this decision will serve as a guidepost for other courts’ interpretation of standing under BIPA—under both the statute and Article III—this is still an unsettled area of law. As we have previously noted, companies that collect or use biometric data are well advised to ensure that they are in compliance with BIPA in order to avoid this costly wave of class action litigation.