The fingerprint a teenager gave to get a Six Flags season pass was enough of an injury to let him launch a class-action case, Illinois’s top court concluded Friday.
The case could have big implications for privacy protections, while also unleashing a rollercoaster ride for businesses bracing for a spike in class-action suits, experts say.
The decision only focused on whether a mere thumbprint — and no other alleged harm — made him an “aggrieved” person eligible to even bring a case. It didn’t discuss whether the amusement park was at fault for taking the print.
The ruling comes amid intense focus on Americans’ increasing loss of control over their personal data, as security breaches seem to grow more common by the day. Meanwhile, class-action cases — though increasingly confined by recent U.S. Supreme Court rulings — are still something businesses have to deal with in a big way.
Friday’s Illinois Supreme Court case started with 14-year-old Alexander Rosenbach’s spring 2014 school trip to a Six Flags Great America /zigman2/quotes/208050417/composite SIX -4.89% amusement park in Gurnee, Ill.
The eighth grader’s mom bought him a season pass ahead of time. Alexander arrived at the park and gave a thumbprint to claim his pass. Rosenbach’s mom never knew fingerprints would be part of the deal until her son told her later that day.
Rosenbach sued the theme park under the state’s Biometric Information Privacy Act. The 2008 law says how data should be handled for things like fingerprints, voice matches and eye scans. The case was a proposed class-action case for anyone who was ever fingerprinted at that park.
Six Flags was wrong to get the print without first getting releases or flagging that such a scan would be necessary, Rosenbach’s lawyers said.
Six Flags countered that Alexander didn’t get tricked into giving his prints, and argued that his mom even accessed a website which described the tickets as “biometric” season passes.
Friday’s ruling overruled a lower court to say Rosenbach didn’t need to show an “actual injury” other than a violation of his rights under the privacy act.
“We have seen over and over again how private companies collect this information and store and use it for purposes that the owner of the information has no clue about.”
— Rebecca Glenberg, senior staff attorney, American Civil Liberties Union of Illinois
Civil liberty, privacy and consumer groups supported Rosenbach, saying that strict consequences for the mishandling of biometric data mattered more than ever.
Rebecca Glenberg, a senior staff attorney at the American Civil Liberties Union of Illinois, called the ruling “a victory for privacy rights in Illinois.”
The state’s 2008 privacy act doesn’t stop companies from collecting biometric data, but underscored the importance of having informed consent when getting the data. If business models didn’t take that into consideration, Glenberg said, “it seems that business model needs a closer look.”
“This statute is all about giving individuals control over their biometric information. We have seen over and over again how private companies collect this information and store and use it for purposes that the owner of the information has no clue about,” she said.
National and state business groups supported Six Flags, noting, among other things, that finger scans were often how employees now punched in and out.
They predicted a flood of cases if Illinois’s high court sided with Rosenbach.
Robert Cattanach, a partner at Minneapolis-based Dorsey & Whitney who advises companies on cybersecurity law, told MarketWatch the ruling was a break with “the traditional notion that you really have to have something go wrong” to have grounds to sue. “This is a pretty big departure.”
He predicted “copycat” lawsuits and other states following Illinois’s lead.
He acknowledged the importance of data security and compliance, but noted the costs to both businesses and consumers. For consumers, “while it may be in the short term ‘Oh wait, this is great,’ the costs just get passed on for defending these suits.”
Six Flags didn’t immediately reply to a request for comment, nor did lawyers for Rosenbach.