Investor Alert

Jan. 25, 2019, 4:01 p.m. EST

Fingerprint taken for Six Flags season pass could clear way for class-action lawsuit

The case could have big implications for privacy protections

Watchlist Relevance

Want to see how this story relates to your watchlist?

Just add items to create a watchlist now:

  • X
    Six Flags Entertainment Corp. (SIX)
  • X
    Walt Disney Co. (DIS)

or Cancel Already have a watchlist? Log In

By Andrew Keshner

Getty Images/iStockphoto
Are a whole bunch of class action cases in store?

The fingerprint a teenager gave to get a Six Flags season pass was enough of an injury to let him launch a class-action case, Illinois’s top court concluded Friday.

The case could have big implications for privacy protections, while also unleashing a rollercoaster ride for businesses bracing for a spike in class-action suits, experts say.

The decision only focused on whether a mere thumbprint — and no other alleged harm — made him an “aggrieved” person eligible to even bring a case. It didn’t discuss whether the amusement park was at fault for taking the print.

The ruling comes amid intense focus on Americans’ increasing loss of control over their personal data, as security breaches seem to grow more common by the day. Meanwhile, class-action cases — though increasingly confined by recent U.S. Supreme Court rulings — are still something businesses have to deal with in a big way.

Friday’s Illinois Supreme Court case started with 14-year-old Alexander Rosenbach’s spring 2014 school trip to a Six Flags Great America /zigman2/quotes/208050417/composite SIX -4.89%   amusement park in Gurnee, Ill.

The eighth grader’s mom bought him a season pass ahead of time. Alexander arrived at the park and gave a thumbprint to claim his pass. Rosenbach’s mom never knew fingerprints would be part of the deal until her son told her later that day.

Rosenbach sued the theme park under the state’s Biometric Information Privacy Act. The 2008 law says how data should be handled for things like fingerprints, voice matches and eye scans. The case was a proposed class-action case for anyone who was ever fingerprinted at that park.

Six Flags was wrong to get the print without first getting releases or flagging that such a scan would be necessary, Rosenbach’s lawyers said.

Six Flags countered that Alexander didn’t get tricked into giving his prints, and argued that his mom even accessed a website which described the tickets as “biometric” season passes.

Friday’s ruling overruled a lower court to say Rosenbach didn’t need to show an “actual injury” other than a violation of his rights under the privacy act.

“We have seen over and over again how private companies collect this information and store and use it for purposes that the owner of the information has no clue about.”

— Rebecca Glenberg, senior staff attorney, American Civil Liberties Union of Illinois

Civil liberty, privacy and consumer groups supported Rosenbach, saying that strict consequences for the mishandling of biometric data mattered more than ever.

Rebecca Glenberg, a senior staff attorney at the American Civil Liberties Union of Illinois, called the ruling “a victory for privacy rights in Illinois.”

The state’s 2008 privacy act doesn’t stop companies from collecting biometric data, but underscored the importance of having informed consent when getting the data. If business models didn’t take that into consideration, Glenberg said, “it seems that business model needs a closer look.”

“This statute is all about giving individuals control over their biometric information. We have seen over and over again how private companies collect this information and store and use it for purposes that the owner of the information has no clue about,” she said.

Don’t Miss: Opinion: Giving TSA facial-recognition software isn’t worth a faster security line

National and state business groups supported Six Flags, noting, among other things, that finger scans were often how employees now punched in and out.

They predicted a flood of cases if Illinois’s high court sided with Rosenbach.

Robert Cattanach, a partner at Minneapolis-based Dorsey & Whitney who advises companies on cybersecurity law, told MarketWatch the ruling was a break with “the traditional notion that you really have to have something go wrong” to have grounds to sue. “This is a pretty big departure.”

He predicted “copycat” lawsuits and other states following Illinois’s lead.

He acknowledged the importance of data security and compliance, but noted the costs to both businesses and consumers. For consumers, “while it may be in the short term ‘Oh wait, this is great,’ the costs just get passed on for defending these suits.”

Six Flags didn’t immediately reply to a request for comment, nor did lawyers for Rosenbach.

Six Flags isn’t the only theme park to use biometrics. Guests at Disney World /zigman2/quotes/203410047/composite DIS -1.36%   are typically asked to do “Ticket Tags,” where their fingerprint is scanned and linked with their ticket or an annual pass. Disney’s privacy policy explains that the company converts the fingerprint image into a numerical key and discards the photo of the fingerprint immediately, so fingerprints are not stored in its system. Guests have the option of using photo ID instead. Disney did not respond immediately to a request for comment.

$ 33.42
-1.72 -4.89%
Volume: 1.73M
Jan. 26, 2021 4:00p
P/E Ratio
Dividend Yield
Market Cap
$2.99 billion
Rev. per Employee
$ 169.56
-2.33 -1.36%
Volume: 7.51M
Jan. 26, 2021 4:02p
P/E Ratio
Dividend Yield
Market Cap
$311.85 billion
Rev. per Employee

Andrew Keshner is a personal finance reporter based in New York.

This Story has 0 Comments
Be the first to comment
More News In
Personal Finance

Story Conversation

Commenting FAQs »

Rates »

Partner Center

Link to MarketWatch's Slice.