Appellate Court Limits Who May Sue Under Biometric Information Privacy Act

Appellate Court Limits Who May Sue Under Biometric Information Privacy Act

As noted in a prior Commentary, plaintiffs continue to bring a flood of lawsuits under Illinois' Biometric Information Privacy Act ("BIPA") against companies that collect, use, or store biometric identifiers. Many of these cases are class actions.

The Illinois legislature passed BIPA in 2008 to provide standards for private entities that collect, use, or store biometric identifiers, such as fingerprints, face scans, and retina scans. BIPA also provides for a private right of action for any "person aggrieved by a violation" of the statute.

The first appellate court to interpret the "aggrieved by" provision recently did so in Rosenbach v. Six Flags Entertainment Corporation, 2017 IL App (2d) 170317. The plaintiff alleged that, in connection with her son's purchase of an amusement park season pass, the defendants failed to properly obtain written consent and disclose its plan for the collection, storage, use, and destruction of her son's biometric identifiers. Furthermore, the plaintiff alleged "not that she or [her son] suffered any actual injury but that, had she known of defendants' conduct, she would not have allowed [her son] to purchase the pass." The plaintiff filed the lawsuit as a class action on behalf of all similarly situated season-pass holders and sought the maximum statutory damages provided under BIPA of $5,000 per violation.

In interpreting the "aggrieved by" provision, the court held that "[i]f a person alleges only a technical violation of the Act without alleging any injury or adverse effect, then he or she is not aggrieved and may not recover" under the statute. The court distinguished statutes that "unambiguously identif[y] a concrete harm" or are strict liability statutes. The court ended its decision by stating, without elaboration, that "the injury or adverse effect need not be pecuniary."

This decision may be useful to defendants who seek dismissal of claims that contain similar alleged BIPA violations. In response, plaintiffs will likely try to be more creative in their pleadings to avoid Rosenbach's mandate.

Lawyer Contacts

For further information, please contact your principal Firm representative or one of the lawyers listed below. General email messages may be sent using our "Contact Us" form, which can be found at

J. Todd Kennard

Aaron D. Charfoos

William F. Dolan

Jackson D. Lavelle

Jones Day publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information purposes only and may not be quoted or referred to in any other publication or proceeding without the prior written consent of the Firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our "Contact Us" form, which can be found on our website at The mailing of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship. The views set forth herein are the personal views of the authors and do not necessarily reflect those of the Firm.