Big companies are harvesting and monetizing your face print, fingerprints, and other sensitive biometric information, without your knowledge and consent. That’s why Illinois wisely enacted the Biometric Information Privacy Act (BIPA), which prohibits companies from gathering, using, or sharing your biometric information without your informed opt-in consent. Now companies are asking the Illinois Supreme Court to defang BIPA, by narrowly interpreting its enforcement tool and thus depriving injured parties of their day in court.
EFF has joined an amicus curiae brief urging the Illinois Supreme Court to adopt a robust interpretation of BIPA. Our fellow amici are ACLU, CDT, the Chicago Alliance Against Sexual Exploitation, PIRG, and Lucy Parsons Labs. In the case on appeal, Rosenbach v. Six Flags, an adolescent who purchased a season pass to an amusement park alleges the park scanned and stored his thumbprint biometrics without written consent or notice about its plan to collect, store, and use his biometric information.
The Illinois Supreme Court will decide the effectiveness of BIPA’s enforcement tool. BIPA provides that “any person aggrieved by a violation of this Act” may file their own lawsuit against the company that violated the Act. The question before the court is whether a person is “aggrieved,” and may sue, based solely on the collection of their biometric information without their informed opt-in consent, or whether a person must also show some additional injury.
EFF and our fellow amici argue that a person is “aggrieved,” and may sue, based just on capture of their biometric information without notice and informed consent. We offer several reasons. First, biometric surveillance is a growing menace to our privacy. Our biometric information can be harvested at a distance and without our knowledge, and we often have no ability as individuals to effectively shield ourselves from this grave privacy intrusion. Second, BIPA follows in the footsteps of a host of other privacy laws that prohibit the capture of private information absent informed opt-in consent, and that define capture without notice and consent by itself as an injury. Third, allowing private lawsuits is a necessary means to ensure effective enforcement of privacy laws.
Perhaps most importantly, more businesses than ever are capturing and monetizing our biometric information. Retailers use face recognition to surveil shoppers’ behavior as they move about the store, and to identify potential shoplifters. Employers use fingerprints, iris scans, and face recognition to manage employee access to company phones and computers. People have filed BIPA lawsuits against major technology companies like Facebook, Google, and Snapchat, alleging the companies applied face recognition to their uploaded photographs without their consent. The U.S. Chamber of Commerce recently filed an amicus brief in one of these lawsuits, urging a federal appellate court to gut BIPA.
Illinois’ BIPA is the strongest biometric privacy law in the United States. EFF and other privacy groups for years have resisted big business efforts to gut BIPA through the legislative process. Now we are proud to join our privacy allies in an amicus brief before the Illinois Supreme Court to push back against the latest effort to weaken BIPA.
