Illinois’ Biometric Information Privacy Act (BIPA), which prohibits companies from using biometrics without user consent, is under evaluation by the state’s Supreme Court. The Electronic Frontier Foundation (EFF), a Privacy-protection group, filed a letter with the court asking it to avoid “defanging” the Act’s by removing the ability for an individual to sue regardless of actual injury. Currently, collection of the biometric without consent is sufficient to merit a lawsuit, but this has led to numerous cases that some argue are frivolous as no real harm can be shown by the plaintiff.
The question before the court is whether a person is “aggrieved,” and may sue, based solely on the collection of their biometric information without their informed opt-in consent
The case on appeal by the Supreme Court is Rosenbach v. Six Flags. A child purchased a season pass to the amusement park, and the park allegedly captured a fingerprint biometric without written consent. No specific harm was shown, and thus the case will interpret whether such harm should be necessary under the Act.
EFF has joined a small group – ACLU, CDT, the Chicago Alliance Against Sexual Exploitation, PIRG, and Lucy Parsons Labs – in the letter urging the Illinois Supreme Court to adopt a robust interpretation of BIPA.
According to a blog post Adam Schwartz of the EFF, “the Illinois Supreme Court will decide the effectiveness of BIPA’s enforcement tool. BIPA provides that “any person aggrieved by a violation of this Act” may file their own lawsuit against the company that violated the Act. The question before the court is whether a person is “aggrieved,” and may sue, based solely on the collection of their biometric information without their informed opt-in consent, or whether a person must also show some additional injury.”
EFF and the other letter signees state that a person is “aggrieved,” and may sue, based just on capture of their biometric alone. They offer several reasons. According to Schwartz, “first, biometric surveillance is a growing menace to our privacy, and we often have no ability as individuals to effectively shield ourselves. Second, BIPA follows in the footsteps of a host of other privacy laws that prohibit the capture of private information absent informed opt-in consent, and that define capture without notice and consent by itself as an injury. Third, allowing private lawsuits is a necessary means to ensure effective enforcement of privacy laws.”