The Illinois Supreme Court ruled Friday that a 14-year-old boy is entitled to damages after Six Flags Great America used his biometric data without permission, setting up potential class-action lawsuits seeking billions from other companies, including Facebook.
The court reversed the previous appellate decision in Rosenbach v. Six Flags Entertainment. The appellate court ruled that the family wasn’t entitled to monetary damages because it couldn’t prove that the boy was “aggrieved.” The Illinois Supreme Court was unanimous in overturning that decision and remanding the suit for further consideration.
“Compliance should not be difficult,” Justice Lloyd Karmeier wrote in the Illinois Supreme Court decision. “Whatever expenses a business might incur to meet the law’s requirements are likely to be insignificant compared to the substantial and irreversible harm that could result if biometric identifiers and information are not properly safeguarded.”
A spokesperson for the theme park said company officials don’t comment on pending litigation.
The case will now go back to Lake County Circuit Court, where the family's attorney, Phil Bock, said Six Flags could be forced to pay his client and change company policies.
“More and more and more people are having to get their face scanned or their fingerprint scanned for this or that which is fine as long as companies get your written permission and then know they have to treat it correctly and then do,” he said.
Supporters of Illinois’ Biometric Information Privacy Act, which is the only law in the nation that allows for private citizens to file lawsuits alleging unwilling submission of unchangeable human characteristic data, say the Supreme Court has upheld the only enforcing characteristic of the law. That's the $1,000 fine that can scale up to $5,000 depending on the severity of the infraction.
“Now, the law’s going have real teeth,” said Jay Edelson, CEO of Chicago-based technology law firm Edelson PC. “Companies have been flouting the law for years, trying to use questionable arguments to avoid the law.”
The spotlight now turns to Edelson’s case against Facebook. Edelson sued the social media behemoth in 2015 and was granted class-action status later that year. Facebook successfully put the case on hold, anticipating that Six Flags would prevail in the case. If Edelson wins that case, it could result in a payout worth billions of dollars.
The spirit of the law, supporters say, is to protect data that cannot be changed in the event of a breach, said Abe Scarr, director of Illinois Public Interest Research Group.
“You can cancel your credit card, but you can’t cancel your face,” he said.
Experts representing businesses say the decision could have far-reaching implications that affect business decisions in Illinois and elsewhere.
“If allowed to stand – an appeal to the United States Supreme Court would appear to be likely – the Illinois Court’s ruling would signal a significant sea change in how courts allow claims without actual damages to proceed, and open the floodgates to class action [lawsuits] claiming privacy violations even without any showing of actual harm," said Robert Cattanach, partner at the international law firm Dorsey & Whitney.
Others worry the ruling will result in a cottage industry of claims for damages being filed in Illinois.
“I think this will result in a lot of forum shopping, with people going to try avoiding federal court and trying to bring claims in Illinois state court if possible,” said Jeffrey Neuburger, co-head of Technology, Media & Telecommunications at the Proskauer law group.
A number of counties in Illinois have been deemed “judicial hellholes” for their leniency in accepting asbestos and mesothelioma lawsuits from outside of the state, sometimes outside of the country.
Another worry is that companies, fearful of lawsuits, will not offer services to Illinois residents that would be available elsewhere. Home automation technology company Nest offers a facial recognition feature that will remember familiar faces and notify the user as such. Nest disabled that feature in Illinois. Neuburger said he expects more companies to follow suit.
“I think it’s happened already and is likely to happen again,” he said.