Rosenbach v. Six Flags Entertainment Corp.
129 N.E.3d 1197
Ill.2019Background
- Six Flags used a fingerprint-based system to issue season passes; it scanned and stored patrons’ thumbprints without providing written disclosures or obtaining written consent as required by the Biometric Information Privacy Act (BIPA).
- Alexander, a 14-year-old, was fingerprinted during a school field trip after his mother purchased a season pass; neither he nor his mother received the statutorily required written notice or release.
- Defendants retained Alexander’s biometric data after his visit; no public retention/destruction policy or disclosures were provided.
- Stacy Rosenbach filed suit as next friend for Alexander under BIPA seeking statutory (liquidated) damages and injunctive relief; defendants moved to dismiss arguing lack of standing/aggrievement absent actual injury beyond statutory violation.
- The appellate court held that a plaintiff alleging only a statutory ("technical") violation without additional injury is not an "aggrieved" person under BIPA; the Illinois Supreme Court granted leave and reversed.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether a person is “aggrieved” under BIPA and may recover statutory liquidated damages when only a §15(b) violation is alleged | Rosenbach: statutory violation alone makes a person "aggrieved" and entitles them to liquidated damages | Six Flags: must plead some actual injury or adverse effect beyond the statutory violation to be "aggrieved" | Held: No additional injury required; statutory violation alone suffices to be "aggrieved" |
| Whether a person may seek injunctive relief under BIPA when only a §15(b) violation is alleged | Rosenbach: statutory violation alone supports an injunction to enforce BIPA’s protections | Six Flags: injunctive relief requires an actual or threatened injury beyond mere violation | Held: Injunctive relief may be sought based on statutory violation alone |
Key Cases Cited
- Cochran v. Securitas Security Servs. USA, Inc., 2017 IL 121200 (Illinois Supreme Court) (standard for accepting well-pleaded facts on 2-615 review)
- Glos v. People, 259 Ill. 332 (1913) (definition of “aggrieved” as denial of a legal or property right)
- Acme Markets, Inc. v. Callanan, 236 Ill. 2d 29 (2009) (plain meaning of statutory language controls construction)
- Patel v. Facebook Inc., 290 F. Supp. 3d 948 (N.D. Cal. 2018) (recognizing biometric privacy interests and harms; procedural protections in biometric privacy law)
- In re Facebook Biometric Info. Privacy Litig., 326 F.R.D. 535 (N.D. Cal. 2018) (federal decision rejecting requirement of additional injury beyond statutory violation)