Skip to main content

Biometrics Privacy Law Challenged in Six Flags' Lawsuit

By William Vogeler, Esq. on October 22, 2018 | Last updated on March 21, 2019

Illinois, the first state to enact a privacy law for biometric data, will soon have another first in the field.

The Illinois Supreme Court will decide whether plaintiffs have to show harm to sue under the privacy law. In Rosenbach v. Six Flags Entertainment Corp., a state appeals court said a mother wasn't an "aggrieved party" when she sued Six Flags for scanning her son's thumbprint.

In that sense, it is a unique case. But the outcome could affect a lot of other biometric privacy cases.

Pioneering Law

Bolstered by the pioneering Illinois law, biometric privacy suits are on the rise. It is the only statute that includes a private right of action and statutory damages.

Despite attacks on the Biometric Information Privacy Act, the Electronic Frontier Foundation says it is also the strongest of its kind. It says private entities must:

  • Obtain consent from people before collecting their biometrics
  • Store securely any biometric data they collect
  • Destroy the data in a timely manner

Stacy Rosenbach sued Six Flags for scanning her son's thumbprint as part his season pass. She said the company didn't have written consent.

The state Supreme Court will decide if that mattered. If not, it could be the end of the road for similar cases.

End of the Road?

Southwest Airlines Co., Wendy's International Inc., Hooters Management Corp., Presence Health Network and other employers, retailers and service providers have been sued for biometric privacy violations.

"If the court upholds the principle that a technical violation does not result in an aggrieved person, I think it will knock out a number of cases," said Jeffrey Neuburger, a partner at Proskauer Rose. "Creative plaintiff lawyers will do what they can to survive, but I think it would be fatal for many of those cases."

Related Resources:

Copied to clipboard