In a landmark ruling, the Illinois Supreme Court held that consumers can sue for violations of their privacy under the state’s biometric privacy law, even if no actual harm could be shown.
The case, Rosenbach v. Six Flags Entertainment Corp., concerned a 14-year-old boy who was asked to scan his thumb into a biometric data capture system before receiving a season pass to a Six Flags amusement park.

The boy and his mother claimed they were not informed of the purpose and length of term for which his fingerprint had been collected and neither of them had signed a release for the taking of the biometric information, in violation of the state’s Biometric Privacy Information Act.

The ruling will have a broad impact, opening the door to lawsuits in the Illinois courts, according to Justin Kay, a partner in the Chicago office of law firm Drinker Biddle & Reath.

“The issue for the court to decide in Rosenbach was whether the Illinois Biometric Information Privacy Act would be a ‘gotcha’ statute, based on the failure of businesses to use magic words when using technology that incorporates biometrics,” says Mr. Kay. “With their ruling today, it is.”

Mr. Kay explains that under the court’s reasoning, “a company that tells you verbally they are going to take your fingerprint for access control or security purposes —or that doesn’t tell you, but you know, based on the context— but that fails to inform you in writing that they are doing exactly what it is obvious they are doing, is still on the hook for thousands of dollars in statutory damages. Indeed, they could have military-level encryption and security protocols to safeguard your fingerprint information, but because they did not provide that information in a publicly available policy, they are subject to suit.”

As a result of the ruling, Mr. Kay predicts, the push for an amendment to the statute will now probably intensify. “Efforts were made several years ago to amend the statute after the first spate of lawsuits against tech companies like Facebook related to facial recognition software, but those efforts failed. Last February, bills were again introduced in both the Illinois House and Senate to rein in the scope of the Illinois law, but they did not advance.”

Mr. Kay adds that legislators across the country are increasingly proposing legislation to address biometrics. “Just as the Illinois statute served as a model for many of those proposals and was cited by legislators, the Supreme Court’s interpretation here is likely to have an impact on how those laws are drafted.”