In a landmark decision, the Supreme Court of Illinois unanimously held that unlawful collection and processing of biometric data, in violation of the Illinois Biometric Information Privacy Act of 2008 (BIPA) is actionable per se for liquidated damages of up to 5,000 dollars and can be asserted in a class action suit. 

Illinois is one of only three states in the US to enact a biometric information privacy law and is the only one with a private right of action. The Illinois’ court decision was delivered in a dispute between a teenager and his mom who filed a class action suit against the amusement park operator Six Flags, for allegedly collecting and processing the son’s fingerprints without complying with the notice and consent requirements of BIPA.

One of Six Flags’ defense arguments was that even if they had violated BIPA’s notice and consent requirements, the teenager was not aggrieved by any actual and concrete injury beyond the mere statutory violation, thus barring the plaintiff’s demand for damages. The Supreme Court of Illinois rejected the defense, finding that when a company fails to comply with BIPA’s requirement “the right of the individual to maintain [his or] her biometric privacy vanishes into thin air. The precise harm the Illinois legislature sought to prevent is then realized. This is no mere “technicality.” The injury is real and significant.” 

The Illinois Supreme Court also found that its interpretation of BIPA is consistent with the legislature’s intent to give the only enforcement mechanism in BIPA substantial force. It explained that “when private entities face liability for failure to comply with the law’s requirements without requiring affected individuals or customers to show some injury beyond violation of their statutory rights, those entities have the strongest possible incentive to conform to the law and prevent problems before they occur and cannot be undone."

CLICK HERE to read the court’s decision.