On Friday, the Illinois Supreme Court support consumers rights to sue companies for collecting data like a fingerprint or iris scan without telling the owners how it will be used. Illinois’ Biometric Information Privacy Act (or BIPA) law passed in 2008, and both Facebook and Google have faced lawsuits for alleged BIPA violations in their photo-tagging feature.
As per this law, it requires affirmative consent for companies to collect biometric markers from their customers which includes facial recognition and fingerprints. The most recent case filed against Six Flags Entertainment Corp by a Family of a 14-year-old teenager whose data was collected back in 2014 when he bought a season pass to Great America, the company’s Gurnee amusement park.
Contesting the case, Six Flags argued that the company becomes accused of all charges unless the plaintiff shows an injury from the unauthorized data collection. If the concerned party becomes successful in showing then Six Flags’ would significantly limit BIPA’s power and made facial recognition much easier for companies like Facebook and Google.
However, the Illinois Supreme Court was unconvinced by the argument and ruled that Six flags have violated the law and need to pay the boy damages, when in fact there were no damages. The ruling sets an example in Illinois that if a company violates the citizen privacy without notice or consent, the plaintiff does not need to show harm for the law to protect them. The court said violating the law is harmful in itself.
“An individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Act, in order to qualify as an ‘aggrieved’ person and be entitled to seek liquidated damages and injunctive relief,” the court wrote in its 13-page opinion.
A Senior legislative counsel Neema Singh Guliani at the American Civil Liberties Union praised the decision and said:
“The tech industry insists that consumers shouldn’t be able to take companies to court merely because the companies violate privacy laws, We applaud the Illinois Supreme Court for rejecting these self-serving arguments and making clear that companies that fail to comply with Illinois’ biometric law can be sued for damages.”
The ruling was attended by both privacy groups and some from business groups.