In Rosenbach v Six Flags Entertainment Corporation 2019 IL 123186 (January 25, 2019), the Illinois Supreme Court imposed a litigation threat on the amusement ride and water park industry. Rosenbach allows a private cause of action to be plead against an amusement ride or waterpark owner/operator without proof of actual damages by an aggrieved plaintiff/patron using the Biometric Information Privacy Act (BIPA). Below are details on the landmark case.
A mother purchased a season pass for her 14 year old son online, pre-season. When he visited the Six Flags in Gurnee, IL for the first time, security asked and took his thumb print; only then was the boy given a hard copy season pass card. There was nothing online advising a potential patron that a biometric identifier was a condition precedent for a repeat-use pass. At the park, there was also no notice to repeat-use patrons that, 1) a biometric identifier was required, 2) the purpose behind it and how long the park would keep the identifier, and 3) no written consent by the patron.
Biometric identifiers are finger prints, voice prints, retina scans and head or face scans. Defense counsel admitted that a thumb print was a biometric identifier. Defense counsel’s motion to dismiss argued that a mere technical violation of the notice/consent requirements of the Act, without proof of damages, is not actionable.
BIPA requires private entities:
- Inform the patron in writing that a biometric identifier is being collected;
- inform the patron in writing of the purpose and for how long the ‘identifier’ will be retained and;
- provide a written release of consent, executed by the patron.
Six Flags failed to comply and the patron’s complaint plead only the technical violation, without damages. By denying the defense motion to dismiss, Rosenbach holds that a cause of action will lie upon a mere violation of the Act alone, without pleading actual damages. Under BIPA, an aggrieved patron is entitled to $1,000 for each negligent violation and $5,000.00 for each reckless violation, in addition to attorney’s fees and costs. The Act further provides that a plaintiff is entitled to either the liquidated damages named above or actual damages, whichever is greater.
The Illinois Supreme Court acknowledged that digital identity theft is a reality the Act is meant to curtail and “…biometrics are unlike other unique identifiers that are used to access finances or other sensitive information…social security numbers, when compromised, can be changed. Biometrics however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft and is likely to withdraw from biometric-facilitated transactions.”
Biometric identifiers offer a real advantage to amusement park owners and operators. Repeat-use patrons can gain rapid entry into the park and an identifier prevents fraud by repeat-use hard copy pass patrons. However the Rosenbach case imposes a potentially expensive burden in litigation costs on owners and operators, for patrons who have sustained no actual damages.
Read more about the employer ramifications of Rosenbach in “Addressing the Ever-Expanding Issue of Biometrics and Privacy in the Workplace.”