The Illinois Supreme Court has today ruled in Rosenbach v. Six Flags Entertainment Corp. that a person does not need to show actual harm to bring a claim under the Biometric Information Privacy Act (BIPA).
Key points
- A technical breach of BIPA, such as collecting fingerprints without written consent, is enough to be “aggrieved”.
- Liquidated damages of $1,000 per negligent violation, or $5,000 per intentional or reckless violation, are available.
- The ruling is expected to drive a significant increase in class action litigation.
- Employers using fingerprint time clocks are a likely target.
UK organisations using biometrics, such as facial recognition or fingerprint access control, for employees or customers in Illinois should check consent and retention policies urgently.
Source: Rosenbach v. Six Flags, 2019 IL 123186 (Illinois Courts)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
