Illinois Appellate Court Reinstates Biometric Information Privacy Act Class Action

On September 28, 2018, the Illinois Appellate Court’s First District issued an opinion reinstating a previously dismissed class action under the Illinois Biometric Information Privacy Act, 740 ILCS § 14/1 et seq. (BIPA). The ruling suggests a lower threshold for maintaining a cause of action under this statute.

The plaintiff, Klaudia Sekura, alleged that an L.A. Tan franchise violated BIPA when it required her to scan her fingerprints to enroll in the company’s national membership database. Sekura filed a proposed class action in Cook County alleging the salon violated BIPA by failing to advise her of its biometric information retention policies and by disclosing her fingerprints to a third-party vendor. The Circuit Court dismissed Sekura’s suit for failing to allege any harm or injury that would qualify her as an “aggrieved person” under the statute. Only the second appellate court decision to address BIPA’s scope, the Sekura Court reversed the lower court’s dismissal, holding that, although the plaintiff had not alleged any additional injury, her allegations of statutory violations, disclosure and mental anguish were sufficient to maintain a cause of action under BIPA.

The Illinois legislature passed BIPA in 2008 in response to concerns about growing use of biometric identifiers and information in financial transaction and screening procedures. 740 ILCS § 14/5(a). BIPA limits the right to sue to “person[s] aggrieved” by a violation of the statute. In the past year, there has been a flurry of proposed class actions brought in Illinois state and federal courts under BIPA, and courts have grappled with determining when an individual is “aggrieved” under BIPA. The First District in Sekura held that a violation of BIPA’s requirements may be sufficient to invoke the statute’s private right of action.

Until the Illinois Supreme Court weighs in, companies who use “biometric information” for their customers and employees should continue to be mindful of BIPA and its requirements.

The Sekura decision conflicts with the Second District’s decision in Rosenbach v. Six Flags Entertainment Corporation, 2017 IL App (2d) 170317, which had dismissed a proposed class brought against an amusement park operator for allegedly using patrons’ fingerprints without providing disclosures. The Rosenbach court had held that to constitute an “aggrieved person” under BIPA, a plaintiff had to allege harm beyond mere technical violations of the statute. Rosenbach is currently on appeal to the Illinois Supreme Court. 

Until the Illinois Supreme Court weighs in, companies who use “biometric information” for their customers and employees should continue to be mindful of BIPA and its requirements, especially considering this recent decision.