Rosenbach v. Six Flags Entertainment Corp.

• Author: Swafford, Julia
• Position: Standing and right of privacy rulings - Illinois

129 N.E.3D 1197 (ILL. 2019)

In Rosenbach v. Six Flags Entertainment Corp., the Supreme Court of Illinois reversed the appellate court's holding and found that a technical violation of Illinois's Biometric Information Privacy Act ("BIPA"), without a showing of actual damages, can give rise to a cause of action. (1) The court relied on the Illinois statute's plain meaning to determine that a plaintiff's standing under this statute is not determined by actual harm, but rather by an invasion and infringement upon a statutory right, which gives rise to a cause of action. (2)

1. BACKGROUND

   BIPA states that a private entity cannot obtain a person's biometric information unless it provides the person whose information is obtained or their representative with written notice of what biometric information is stored, informs said subject of the purpose and duration of information storage, and obtains a written release from the subject or representative. (3) The Act also gives aggrieved persons a right of action to recover liquidated or actual damages. (4)

   Plaintiff Alexander Rosenbach, whose interests were represented by his mother Stacy Rosenbach, formed a class of similarly situated plaintiffs. (5) Alexander visited the amusement park Six Flags Great America on a field trip. (6) Prior to his visit, Alexander's mother, Stacy, purchased a season pass for Alexander online. (7) Alexander needed to complete two steps at the park in order to obtain his pass: go to a security checkpoint to scan his thumbprint into the park's database and proceed to another building to collect his season pass. (8) Six Flags stated they utilize this biometric data to "quickly verify customer identities" and to "make entry into the park faster and more seamless," which in turn aids in maximizing revenue. (9) Six Flags claimed the point of the biometric scan was to reduce season pass fraud and tie a unique identifier like a thumbprint to a season pass. (10)

   After returning home, Alexander's mother asked him for a booklet of paperwork associated with the season pass, to which he responded "that no paperwork was provided." (11) Additionally, the complaint alleged that Six Flags retained Alexander's biometric information and that there was neither any publicly available information on "what was done with the information or how long it will be kept, nor... any 'written policy made available to the public that discloses [defendants'] retention schedule or guidelines for retaining and...