Sekura v. Krishna Schaumburg Tan, Inc.
115 N.E.3d 1080
Ill. App. Ct.2019Background
- Sekura sued Krishna Schaumburg Tan, Inc., alleging violations of the Illinois Biometric Information Privacy Act (BIPA) for collecting customers’ fingerprints without required disclosures and for disclosing fingerprint data to an out-of-state vendor (SunLync).
- Complaint pleads BIPA claim (Count I), unjust enrichment (Count II), and negligence (Count III); only Count I is at issue on appeal after dismissal under section 2-615.
- Trial court initially denied defendant’s motion to dismiss, but after the Second District’s Rosenbach decision, the trial court reconsidered and dismissed Count I with prejudice and certified the dismissal for immediate appeal under Ill. S. Ct. R. 304(a).
- Sekura alleged she was never provided required written releases, retention policies, or disclosures, that her fingerprint was scanned each visit, that data was disclosed to SunLync, and that she suffers mental anguish about potential misuse or loss of her biometric data.
- Appellate court reviews de novo whether the complaint alleges facts that, if true, entitle Sekura to relief and focuses on whether a plaintiff must plead an injury beyond a statutory BIPA violation to be "a person aggrieved" under 740 ILCS 14/20.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether BIPA grants a private right to sue to “any person aggrieved by a violation” without alleging additional injury | "Aggrieved by a violation" is satisfied by the statutory violation itself; BIPA’s plain language and structure permit suit and allow liquidated damages without proof of actual damages | The word “aggrieved” requires an injury or adverse effect beyond a mere statutory violation; otherwise “aggrieved” is superfluous | Court holds BIPA’s plain language permits suit for a violation; no separate harm is required to state standing under the statute |
| Whether Rosenbach (requiring additional injury) controls Sekura’s claim | Even if additional injury is required, Sekura alleged disclosure to a third-party and mental anguish, satisfying Rosenbach | Rosenbach should preclude suit absent injury beyond a technical violation | Court distinguishes Rosenbach: Sekura alleged (1) disclosure to out-of-state vendor (concrete privacy injury) and (2) mental anguish; either suffices to confer standing under Rosenbach’s standard |
| Whether disclosure to a third-party constitutes a concrete injury | Disclosure infringes the statutory privacy right and is an injury the legislature sought to prevent | Disclosure absent a data compromise is not necessarily a concrete injury | Court agrees disclosure to an out-of-state third-party is a concrete injury to the statutory privacy right and supports standing |
| Whether mental anguish pleaded in the complaint can constitute injury | Mental anguish from risk/misuse of biometric data is an injury cognizable under similar privacy statutes | Mental anguish absent pecuniary loss is speculative and insufficient | Court finds the pleaded mental anguish can constitute an injury or adverse effect for purposes of standing |
Key Cases Cited
- Bogenberger v. Pi Kappa Alpha Corp., 2018 IL 120951 (Ill. 2018) (standard for section 2-615 motion to dismiss)
- Doe v. Chand, 335 Ill. App. 3d 809 (Ill. App. Ct. 2002) (under similar confidentiality statute, liquidated damages recoverable without proof of actual damages)
- Gubala v. Time Warner Cable, 846 F.3d 909 (7th Cir. 2017) (federal standing analysis finding insufficient concrete injury where plaintiff alleged only speculative harms)
- Citibank, N.A. v. Illinois Department of Revenue, 2017 IL 121634 (Ill. 2017) (court’s role is to ascertain legislative intent from statutory language and not to rewrite statutes)