CBA Record July-August 2019

Y O U N G L A W Y E R S J O U R N A L

courts due to the litigation prerequisite of standing. State Court Litigation. When BIPA is violated, a person who is “aggrieved” by this violation has the right to bring a law- suit. The Illinois Supreme Court recently defined who constitutes an “aggrieved” person in Rosenbach v. Six Flags Enter- tainment Corp. , 2019 IL 123186, issued on January 25, 2019. A mother brought suit on behalf of her son who gave his fingerprint to the Six Flags Great America amusement park as a part of their repeat- entry program. 2019 IL 123186, ¶ 5. The fingerprint was never compromised or disclosed to third parties, but Six Flags did not inform the son of the collection, stor- age, use, and destruction of his biometric data, and did not obtain a written release for any actions involving his data. The court held that the mother was permitted to sue Six Flags despite the fact that no actual damages occurred from the violation of BIPA.The court was concerned with the unique nature of biometric data that, once compromised, a person cannot simply change. According to the court in Rosenbach , BIPA seeks to provide compa- nies an incentive to proactively take better care of biometric data before any substan- tial and irreversible harm could result. Under this recent interpretation, if an employer fails to inform an employee or fails to receive his or her written consent regarding the collection and storage of biometric data, the employer could be held liable even if the data remains secure. Each BIPA violation results in either actual damages or liquidated damages of $1,000 (for negligent violation) or $5,000 (for intentional violation). For example, an employer could require an employee’s fingerprint for checking in and checking out of the office. If the company negligently fails to notify the employee of its collection and storage, each violation constitutes $2,000 per day per employee. This penalty, plus the reimburse- ment of attorneys’ fees, could effectively bankrupt an employer who simply wishes to track access to its business. Following the Rosenbach decision in

January 2019, 90 class action lawsuits have been filed in Illinois state circuit courts alleging violations of BIPA. Certain plain- tiffs’ firms have quickly filed class action lawsuits against companies that collect biometric information. Thus, it is not a question of “if ” an employer will be sued, but “when.” Federal Court Litigation. The federal case law surrounding BIPA predominantly focuses on the fundamental element to pursue litigation in federal court: stand-

Monroy v. Shutterfly , No. 16-C-10984, 2017 WL 4099846, at *5 (N.D. Ill. Sept. 15, 2017); Rivera v. Google, Inc. , No. 16-C-02714, 2017 WL 748590, at *5 (N.D. Ill. Feb. 27, 2017). Given the rela- tively uncharted waters of biometric data, more advanced technologies will no doubt reach litigation over definition of the term “biometric information.” BIPA commonly applies to Illinois employers or out-of-state employers that collect biometric data of Illinois residents, but it is not restricted to those circum- stances. Although BIPA does not expressly allow for extraterritorial application (the application of Illinois law outside of Illi- nois), federal courts have broadly examined whether the asserted violations occurred within Illinois. Rivera , 238 F. Supp. 3d at 1101. Under this examination, the court must determine whether the “circumstance relating to the transaction, [violations of BIPA] occurred primarily and substantially within Illinois.” In Monroy v. Shutterfly , plaintiff, a nonresident, sued Shutterfly, also a nonresident, for violations of BIPA when plaintiff’s photograph was taken by an Illinois resident and uploaded in Illinois from an Illinois IP address to Shutterfly. The court denied Shutterfly’s motion to dismiss, claiming improper extraterritorial application of BIPA because the court was unclear at the pleading stage whether the violations occurred in Illinois. Generally, BIPA requires employers to ask for and receive informed consent before collecting and using an employee’s biomet- ric data. 740 ILCS 14/15. Any disclosure or transmission of biometric data outside of the business requires express consent, a court order, or a law enforcement directive. Further, employers must utilize some level of security to protect the biometric data. While the failure to ask permission may appear harmless, BIPA and the Illinois Supreme Court demand strict enforcement and penalize those who fail to comply. Proper Plaintiffs and Associated Penalties of BIPA The early court proceedings over BIPA have differed greatly before state and federal

Young Lawyers Section Annual Boat Cruise AUGUST 15, 2019 Join theYoung Lawyers Section onThursday, August 15 for its annual cruise on Lake Michigan. The social will feature drinks, music and mingling aboard the Anita Dee Yacht. Boarding will begin at 6:15 p.m. at DuSable Harbor (located at lower Randolph Street and the lake front, on the south side of the Chicago River, east of Lake Shore Drive Bridge). The boat will re-dock at ap- proximately 10:00 p.m. Tickets are $65 per person ($50 law students). Buy tickets at www.chicagobar.org/chicagobar/ylsboat. Contact Jennifer Byrne at jbyrne@ chicagobar.org if your firm or company is interested in sponsoring the cruise. SAVE-THE-DATE

CBA RECORD 35