Skip to Content
BIPA regulates the use and storage of information derived from biometric identifiers such as fingerprints, iris scans, and voiceprints. Under BIPA, before obtaining a customer’s biometric identifier, private entities must disclose the specific purpose and length of time for which the data will be collected, stored, and used, and how that data will eventually be destroyed. A BIPA violation allows plaintiffs to recover the greater of either actual damages or statutory damages. The statute provides for damages of $1,000 for each negligent violation and $5,000 for each reckless or willful violation. Importantly, BIPA states that “any person aggrieved by a violation” may bring a legal cause of action.
In Sekura, a tanning salon scanned Klaudia Sekura’s finger prints for enrollment in the company’s national membership database, which then allowed customers to use their membership at other locations across the country. A customer sued, alleging that the salon violated BIPA in a number of ways: by not obtaining written consent to use her fingerprints; by failing to disclose the salon’s plans to store the fingerprint data or how the data would be destroyed in the event a customer’s membership was terminated or the salon closed; and by disclosing her fingerprints to an out-of-state third-party vendor.
The tanning salon moved to dismiss the lawsuit for failure to state a claim under BIPA, arguing that plaintiff failed to allege actual harm and thus lacked standing to sue. The trial court initially denied the motion, but on a motion to reconsider, stayed the proceeding in light of multiple cases pending before the Illinois Appellate Court involving similar legal issues. Then, the Second District Appellate Court issued its opinion in Rosenbach v. Six Flags Entertainment Corp., 2017 IL App (2d) 170317. In Rosenbach, the plaintiff alleged that when her minor son purchased a theme park season pass, the defendant collected his fingerprints without obtaining consent or disclosing the plan for collection, storage, and destruction of that biometric data. The Second District affirmed the trial court’s decision to grant defendant’s motion to dismiss, finding that the mere allegation of a statutory violation without an allegation of “injury or adverse effect” is insufficient to confer standing under BIPA. With Rosenbach in mind, the trial court in Sekura granted the defendant’s motion to dismiss, and plaintiff appealed.
In Sekura, the only issue on appeal was whether harm or injury is required to have standing under BIPA. This issue hinges on the meaning of the statutory language: “person aggrieved by a violation” of BIPA. Contrary to Rosenbach, the First District held that the plain language of BIPA supported the Sekura plaintiff’s right to sue and emphasized that BIPA’s legislative intent is to “prevent any harm from occurring in the first place, thereby reassuring the public, who will then be willing to participate in [biometric data] technology." The First District explained that, unlike lost keys or identification cards, the mere release of biometric information constitutes an irreparable harm because a person cannot obtain new fingerprints, new eyeballs, or new DNA. The First District explained that “[f]orcing a member of the public to wait until after irretrievable harm has already occurred in order to sue would confound the very purpose of [BIPA].” Id. Accordingly, the Sekura court concluded that plaintiff was “a person aggrieved by a violation” of BIPA and, therefore, had standing to sue. The First District also noted that even if it agreed with the Rosenbach court’s interpretation of BIPA, Sekura is distinguishable because, unlike Rosenbach, Ms. Sekura did allege an “injury or adverse effect” in the form of (a) an injury to her legal right to privacy of her own biometric information by the disclosure of this information to an out-of-state third party vendor, and (b) mental anguish.
For now, practitioners on both sides of the bar have case law to support diametrically opposed legal positions. While defendants will no doubt continue to seek dismissal of BIPA claims based on a purported lack of standing, Sekura affords the plaintiffs with a legal basis for countering such motions. Clearly, the district court split created by Rosenbach and Sekura will eventually need to be resolved by the Illinois Supreme Court in order to ensure a consistent application of this important law.
