Illinois upholds biometric privacy law
28 January 2019 16:37 GMT

The Illinois Supreme Court on Friday held that people can sue just for having biometric information collected without consent.

Illinois has a law that requires companies that want to collect biometric data have to obtain informed opt-in consent. It recognizes that a biometric privacy violation is actionable under the law even in the absence of harm following from the violation, like identity theft.

The case began with a class trip to Six Flags Great America, where 14-year-old Alexander Rosenbach had his thumbprint scanned. His family sued under Illinois’ biometric privacy law. But Six Flags argued there wasn’t any actual harm.

Six Flags challenged the family's lawsuit on the grounds that the family had not alleged any actual harm, something that's difficult to prove with privacy cases, and a state appellate court agreed.

The justices rejected that. 

"Contrary to the appellate court's view, an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Act, in order to qualify as an 'aggrieved' person and be entitled to seek liquidated damages and injunctive relief pursuant to the Act," the court concluded.

Adam Schwartz, with the digital-privacy watchdog Electronic Frontier Foundation, welcomed the decision in an interview with WSIU

“Invasions of biometric privacy are uniquely harmful because we can’t change our biometrics, and because the ultimate consequences of biometric surveillance are not yet known, because they’re going to unfold in unpredictable ways in the future,” Schwartz said in a telephone interview.

However, Illinois Chamber of Commerce issued a statement saying it's disappointed in the decision.

“We fear that today’s decision will open the floodgates for future litigation at the expense of Illinois’ commercial health,” Todd Maisch, the chamber's CEO, said in a statement.