Rosenbach v. Six Flags Entertainment Corp. , 2019 IL 123186 ( 2019 )


Menu:
  •                                                                                Digitally signed by
    Reporter of
    Decisions
    Reason: I attest to
    Illinois Official Reports                         the accuracy and
    integrity of this
    document
    Supreme Court                              Date: 2019.09.03
    15:26:06 -05'00'
    Rosenbach v. Six Flags Entertainment Corp., 
    2019 IL 123186
    Caption in Supreme       STACY ROSENBACH, as Mother and Next Friend of Alexander
    Court:                   Rosenbach, Appellant, v. SIX FLAGS ENTERTAINMENT
    CORPORATION et al., Appellees.
    Docket No.               123186
    Filed                    January 25, 2019
    Decision Under           Appeal from the Appellate Court for the Second District; heard in that
    Review                   court on appeal from the Circuit Court of Lake County, the Hon. Luis
    A. Berrones, Judge, presiding.
    Judgment                 Certified questions answered.
    Appellate court judgment reversed.
    Cause remanded.
    Counsel on               Phillip A. Bock and David M. Oppenheim, of Bock, Hatch, Lewis &
    Appeal                   Oppenheim, LLC, of Chicago, and Ilan Chorowsky and Mark
    Bulgarelli, of Progressive Law Group, LLC, of Evanston, for
    appellant.
    Debra R. Bernard, of Perkins Coie LLP, of Chicago, and Kathleen M.
    O’Sullivan, of Perkins Coie LLP, of Seattle, Washington, for
    appellees.
    Rebecca K. Glenberg, Megan Rosenfeld, and Michael C. Landis, all
    of Chicago, Joseph Jerome, of Washington, D.C., Adam Schwartz, of
    San Francisco, California, and Nathan Freed Wessler, of New York,
    New York, for amici curiae American Civil Liberties Union et al.
    Adam J. Levitt and Amy E. Keller, of DiCello Levitt & Casey LLC,
    of Chicago, and Marc Rotenberg, Alan Butler, and Natasha
    Babazadeh, of Washington, D.C., for amicus curiae Electronic
    Privacy Information Center.
    Melissa A. Siebert and Bonnie Keane DelGobbo, of Baker Hostetler
    LLP, of Chicago, and Angelo I. Amador, of Washington, D.C., for
    amici curiae Restaurant Law Center et al.
    Gary M. Miller, of Shook, Hardy & Bacon L.L.P., of Chicago, for
    amici curiae Illinois Retail Merchants Association et al.
    Michele Odorizzi and Michael A. Scodro, of Mayer Brown LLP, of
    Chicago, and Lauren R. Goldman and Michael Rayfield, of Mayer
    Brown LLP, of New York, New York, for amicus curiae Internet
    Association.
    Noah A. Finkel and Thomas E. Ahlering, of Seyfarth Shaw LLP, of
    Chicago, for amicus curiae Illinois Chamber of Commerce.
    Justices                 CHIEF JUSTICE KARMEIER delivered the judgment of the court,
    with opinion.
    Justices Thomas, Kilbride, Garman, Burke, Theis, and Neville
    concurred in the judgment and opinion.
    OPINION
    ¶1         The Biometric Information Privacy Act (Act) (740 ILCS 14/1 et seq. (West 2016)) imposes
    numerous restrictions on how private entities collect, retain, disclose, and destroy biometric
    identifiers, including retina or iris scans, fingerprints, voiceprints, scans of hand or face
    geometry, or biometric information. Under the Act, any person “aggrieved” by a violation of
    its provisions “shall have a right of action *** against an offending party” and “may recover
    for each violation” the greater of liquidated damages or actual damages, reasonable attorney
    fees and costs, and any other relief, including an injunction, that the court deems appropriate.
    -2-
    
    Id.
     § 20. The central issue in this case, which reached the appellate court by means of a
    permissive interlocutory appeal pursuant to Illinois Supreme Court Rule 308 (eff. Jan. 1, 2016),
    is whether one qualifies as an “aggrieved” person and may seek liquidated damages and
    injunctive relief pursuant to the Act if he or she has not alleged some actual injury or adverse
    effect, beyond violation of his or her rights under the statute. The appellate court answered this
    question in the negative. In its view, “a plaintiff who alleges only a technical violation of the
    statute without alleging some injury or adverse effect is not an aggrieved person” within the
    meaning of the law. (Emphasis in original.) 
    2017 IL App (2d) 170317
    , ¶ 23. We granted leave
    to appeal (Ill. S. Ct. R. 315(a) (eff. Nov. 1, 2017)) and now reverse and remand to the circuit
    court for further proceedings.
    ¶2                                        BACKGROUND
    ¶3       The question the appellate court was asked to consider in this case arose in the context of
    a motion to dismiss pursuant to section 2-615 of the Code of Civil Procedure (Code) (735 ILCS
    5/2-615 (West 2016)). We therefore take the following well-pleaded facts from the complaint
    and accept them as true for purposes of our review. Cochran v. Securitas Security Services
    USA, Inc., 
    2017 IL 121200
    , ¶ 11.
    ¶4       Six Flags Entertainment Corporation and its subsidiary Great America LLC own and
    operate the Six Flags Great America amusement park in Gurnee, Illinois. Defendants sell
    repeat-entry passes to the park. Since at least 2014, defendants have used a fingerprinting
    process when issuing those passes. As alleged by the complaint, their system “scans pass
    holders’ fingerprints; collects, records and stores ‘biometric’ identifiers and information
    gleaned from the fingerprints; and then stores that data in order to quickly verify customer
    identities upon subsequent visits by having customers scan their fingerprints to enter the theme
    park.” According to the complaint, “[t]his makes entry into the park faster and more seamless,
    maximizes the time pass holders are in the park spending money, and eliminates lost revenue
    due to fraud or park entry with someone else’s pass.”
    ¶5       In May or June 2014, while the fingerprinting system was in operation, Stacy Rosenbach’s
    14-year-old son, Alexander, visited defendants’ amusement park on a school field trip. In
    anticipation of that visit, Rosenbach had purchased a season pass for him online. Rosenbach
    paid for the pass and provided personal information about Alexander, but he had to complete
    the sign-up process in person once he arrived at the amusement park.
    ¶6       The process involved two steps. First, Alexander went to a security checkpoint, where he
    was asked to scan his thumb into defendants’ biometric data capture system. After that, he was
    directed to a nearby administrative building, where he obtained a season pass card. The card
    and his thumbprint, when used together, enabled him to gain access as a season pass holder.
    ¶7       Upon returning home from defendants’ amusement park, Alexander was asked by
    Rosenbach for the booklet or paperwork he had been given in connection with his new season
    pass. In response, Alexander advised her that defendants did “it all by fingerprint now” and
    that no paperwork had been provided.
    ¶8       The complaint alleges that this was the first time Rosenbach learned that Alexander’s
    fingerprints were used as part of defendants’ season pass system. Neither Alexander, who was
    a minor, nor Rosenbach, his mother, were informed in writing or in any other way of the
    specific purpose and length of term for which his fingerprint had been collected. Neither of
    -3-
    them signed any written release regarding taking of the fingerprint, and neither of them
    consented in writing “to the collection, storage, use, sale, lease, dissemination, disclosure,
    redisclosure, or trade of, or for [defendants] to otherwise profit from, Alexander’s thumbprint
    or associated biometric identifiers or information.”
    ¶9         The school field trip was Alexander’s last visit to the amusement park. Although he has
    not returned there since, defendants have retained his biometric identifiers and information.
    They have not publicly disclosed what was done with the information or how long it will be
    kept, nor do they have any “written policy made available to the public that discloses
    [defendants’] retention schedule or guidelines for retaining and then permanently destroying
    biometric identifiers and biometric information.”
    ¶ 10       In response to the foregoing events, Rosenbach, acting in her capacity as mother and next
    friend of Alexander (see 755 ILCS 5/11-13(d) (West 2016)), brought this action on his behalf
    in the circuit court of Lake County. 1 The action seeks redress for Alexander, individually and
    on behalf of all other similarly situated persons, under the Act (740 ILCS 14/1 et seq. (West
    2016)), which, as noted at the outset of this opinion, provides that any person “aggrieved” by
    a violation of the Act’s provisions “shall have a right of action *** against an offending party”
    and “may recover for each violation” the greater of liquidated damages or actual damages,
    reasonable attorney fees and costs, and any other relief, including an injunction, that the court
    deems appropriate (id. § 20).
    ¶ 11       The complaint, as amended, is in three counts. Count I seeks damages on the grounds that
    defendants violated section 15(b) of the Act (id. § 15(b)) by (1) collecting, capturing, storing,
    or obtaining biometric identifiers and biometric information from Alexander and other
    members of the proposed class without informing them or their legally authorized
    representatives in writing that the information was being collected or stored; (2) not informing
    them in writing of the specific purposes for which defendants were collecting the information
    or for how long they would keep and use it; and (3) not obtaining a written release executed
    by Alexander, his mother, or members of the class before collecting the information. Count II
    requests injunctive relief under the Act to compel defendants to make disclosures pursuant to
    the Act’s requirements and to prohibit them from violating the Act going forward. Count III
    asserts a common-law action for unjust enrichment.
    ¶ 12       Defendants sought dismissal of Rosenbach’s action under both sections 2-615 and 2-619
    of the Code (735 ILCS 5/2-615, 2-619 (West 2016)) in a combined motion filed pursuant to
    section 2-619.1 (id. § 2-619.1). As grounds for their motion, defendants asserted that one of
    the named defendants had no relation to the facts alleged, that plaintiff had suffered no actual
    or threatened injury and therefore lacked standing to sue, and that plaintiff’s complaint failed
    to state a cause of action for violation of the Act or for unjust enrichment.
    ¶ 13       Following a hearing, and proceeding only under section 2-615 of the Code, the circuit court
    denied the motion as to counts I and II, which sought damages and injunctive relief under the
    1
    Although Stacy Rosenbach has been referred to as the plaintiff in these proceedings, that is not
    technically accurate. Alexander is the plaintiff. Rosenbach is his next friend. A next friend of a minor
    is not a party to the litigation but simply represents the real party, who, as a minor, lacks capacity to
    sue in his or her own name. See Blue v. People, 
    223 Ill. App. 3d 594
    , 596 (1992). During oral argument,
    counsel for Rosenbach confirmed that she appears here solely on behalf of her son and asserts no claim
    for herself.
    -4-
    Act, but granted the motion as to count III, the unjust enrichment claim, and dismissed that
    claim with prejudice.
    ¶ 14       Defendants sought interlocutory review of the circuit court’s ruling under Illinois Supreme
    Court Rule 308 (eff. Jan. 1, 2016) on the grounds that it involved a question of law as to which
    there is substantial ground for a difference of opinion and that an immediate appeal might
    materially advance the ultimate termination of the litigation. The following two questions of
    law were identified by the circuit court:
    (1) “[w]hether an individual is an aggrieved person under §20 of the Illinois
    Biometric Information Privacy Act, 740 ILCS 14/20, and may seek statutory liquidated
    damages authorized under §20(l) of the Act when the only injury he alleges is a
    violation of §l5(b) of the Act by a private entity who collected his biometric identifiers
    and/or biometric information without providing him the required disclosures and
    obtaining his written consent as required by §15(b) of the Act,” and
    (2) “[w]hether an individual is an aggrieved person under §20 of the Illinois
    Biometric Information Privacy Act, 740 ILCS 14/20, and may seek injunctive relief
    authorized under §20(4) of the Act, when the only injury he alleges is a violation of
    §15(b) of the Act by a private entity who collected his biometric identifiers and/or
    biometric information without providing him the required disclosures and obtaining his
    written consent as required by §15(b) of the Act.”
    ¶ 15       The appellate court granted review of the circuit court’s order and answered both certified
    questions in the negative. In its view, a plaintiff is not “aggrieved” within the meaning of the
    Act and may not pursue either damages or injunctive relief under the Act based solely on a
    defendant’s violation of the statute. Additional injury or adverse effect must be alleged. The
    injury or adverse effect need not be pecuniary, the appellate court held, but it must be more
    than a “technical violation of the Act.” 
    2017 IL App (2d) 170317
    , ¶ 28.
    ¶ 16       Rosenbach petitioned this court for leave to appeal. Ill. S. Ct. R. 315 (eff. Nov. 1, 2017).
    We allowed her petition and subsequently permitted friend of the court briefs to be filed in
    support of her position by the Electronic Privacy Information Center and by a consortium of
    groups including the American Civil Liberties Union, the Center for Democracy and
    Technology, and the Electronic Frontier Foundation. See Ill. S. Ct. R. 345 (eff. Sept. 20, 2010).
    The court also permitted the Restaurant Law Center and Illinois Restaurant Association, the
    Internet Association, and the Illinois Chamber of Commerce to file friend of the court briefs
    in support of defendants.
    ¶ 17                                           ANALYSIS
    ¶ 18        Because this appeal concerns questions of law certified by the circuit court pursuant to
    Illinois Supreme Court Rule 308 (eff. Jan. 1, 2016), our review is de novo. Rozsavolgyi v. City
    of Aurora, 
    2017 IL 121048
    , ¶ 21. De novo review is also appropriate because the appeal arose
    in the context of an order denying a section 2-615 motion to dismiss (Marshall v. Burger King
    Corp., 
    222 Ill. 2d 422
    , 429 (2006)) and its resolution turns on a question of statutory
    interpretation (Eads v. Heritage Enterprises, Inc., 
    204 Ill. 2d 92
    , 96 (2003)).
    ¶ 19        The Biometric Privacy Information Act (740 ILCS 14/1 et seq. (West 2016)), on which
    counts I and II of Rosenbach’s complaint are founded, was enacted in 2008 to help regulate
    “the collection, use, safeguarding, handling, storage, retention, and destruction of biometric
    -5-
    identifiers and information.” 
    Id.
     § 5(g). The Act defines “biometric identifier” to mean “a retina
    or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” Id. § 10. “Biometric
    information” means “any information, regardless of how it is captured, converted, stored, or
    shared, based on an individual’s biometric identifier used to identify an individual.” Id. It is
    undisputed that the thumbprint collected by defendants from Rosenbach’s son, Alexander,
    when they processed his season pass constituted a biometric identifier subject to the Act’s
    provisions and that the electronically stored version of his thumbprint constituted biometric
    information within the meaning of the law.
    ¶ 20       Section 15 of the Act (id. § 15) imposes on private entities such as defendants various
    obligations regarding the collection, retention, disclosure, and destruction of biometric
    indentifiers and biometric information. Among these is the following:
    “(b) No private entity may collect, capture, purchase, receive through trade, or
    otherwise obtain a person’s or a customer’s biometric identifier or biometric
    information, unless it first:
    (1) informs the subject or the subject’s legally authorized representative in
    writing that a biometric identifier or biometric information is being collected or
    stored;
    (2) informs the subject or the subject’s legally authorized representative in
    writing of the specific purpose and length of term for which a biometric
    identifier or biometric information is being collected, stored, and used; and
    (3) receives a written release executed by the subject of the biometric
    identifier or biometric information or the subject’s legally authorized
    representative.” Id. § 15(b).
    ¶ 21       These provisions are enforceable through private rights of action. Specifically, section 20
    of the Act provides that “[a]ny person aggrieved by a violation of this Act shall have a right of
    action in a State circuit court or as a supplemental claim in federal district court against an
    offending party.” Id. § 20. Section 20 further provides that
    “[a] prevailing party may recover for each violation:
    (1) against a private entity that negligently violates a provision of this Act,
    liquidated damages of $1,000 or actual damages, whichever is greater;
    (2) against a private entity that intentionally or recklessly violates a provision
    of this Act, liquidated damages of $5,000 or actual damages, whichever is greater;
    (3) reasonable attorneys’ fees and costs, including expert witness fees and other
    litigation expenses; and
    (4) other relief, including an injunction, as the State or federal court may deem
    appropriate.” Id.
    ¶ 22       As noted earlier in this opinion, Rosenbach’s complaint alleges that defendants violated
    the provisions of section 15 of the Act when it collected her son’s thumbprint without first
    following the statutorily prescribed protocol. For the purposes of this appeal, the existence of
    those violations is not contested. The basis for defendants’ current challenge is that no other
    type of injury or damage to Rosenbach’s son has been alleged. Rosenbach seeks redress on her
    son’s behalf and on behalf of a class of similarly situated individuals based solely on
    defendants’ failure to comply with the statute’s requirements. In defendants’ view, that is not
    -6-
    sufficient. They contend that an individual must have sustained some actual injury or harm,
    apart from the statutory violation itself, in order to sue under the Act. According to defendants,
    violation of the statute, without more, is not actionable.
    ¶ 23        While the appellate court in this case found defendants’ argument persuasive, a different
    district of the appellate court subsequently rejected the identical argument in Sekura v. Krishna
    Schaumburg Tan, Inc., 
    2018 IL App (1st) 180175
    . We reject it as well, as a recent federal
    district court decision correctly reasoned we might do. In re Facebook Biometric Information
    Privacy Litigation, 
    326 F.R.D. 535
    , 545-47 (N.D. Cal. 2018).
    ¶ 24        We begin our analysis with basic principles of statutory construction. When construing a
    statute, our primary objective is to ascertain and give effect to the legislature’s intent. That
    intent is best determined from the plain and ordinary meaning of the language used in the
    statute. When the statutory language is plain and unambiguous, we may not depart from the
    law’s terms by reading into it exceptions, limitations, or conditions the legislature did not
    express, nor may we add provisions not found in the law. Acme Markets, Inc. v. Callanan, 
    236 Ill. 2d 29
    , 37-38 (2009).
    ¶ 25        Defendants read the Act as evincing an intention by the legislature to limit a plaintiff’s
    right to bring a cause of action to circumstances where he or she has sustained some actual
    damage, beyond violation of the rights conferred by the statute, as the result of the defendant’s
    conduct. This construction is untenable. When the General Assembly has wanted to impose
    such a requirement in other situations, it has made that intention clear. Section 10a(a) of the
    Consumer Fraud and Deceptive Business Practices Act (815 ILCS 505/10a(a) (West 2016)) is
    an example. To bring a private cause of action under that law, actual damage to the plaintiff
    must be alleged. Oliveira v. Amoco Oil Co., 
    201 Ill. 2d 134
    , 149 (2002); Haywood v. Massage
    Envy Franchising, LLC, 
    887 F.3d 329
    , 333 (7th Cir. 2018).
    ¶ 26        In contrast is the AIDS Confidentiality Act (410 ILCS 305/1 et seq. (West 2016)). There,
    the legislature authorized private rights of action for monetary relief, attorney fees, and such
    other relief as the court may deem appropriate, including an injunction, by any person
    “aggrieved” by a violation of the statute or a regulation promulgated under the statute. 
    Id.
     § 13.
    Proof of actual damages is not required in order to recover. Doe v. Chand, 
    335 Ill. App. 3d 809
    , 822 (2002).
    ¶ 27        Section 20 of the Act (740 ILCS 14/20 (West 2016)), the provision that creates the private
    right of action on which Rosenbach’s cause of action is premised, clearly follows the latter
    model. In terms that parallel the AIDS Confidentiality Act, it provides simply that “[a]ny
    person aggrieved by a violation of this Act shall have a right of action in a State circuit court
    or as a supplemental claim in federal district court against an offending party.” 
    Id.
    ¶ 28        Admittedly, this parallel, while instructive (Hartney Fuel Oil Co. v. Hamer, 
    2013 IL 115130
    , ¶ 25), is not dispositive. Separate acts with separate purposes need not, after all, define
    similar terms in the same way. Rather, “ ‘the same word may mean one thing in one statute
    and something different in another, dependent upon the connection in which the word is used,
    the object or purpose of the statute, and the consequences which probably will result from the
    proposed construction. [Citations.]’ ” People v. Ligon, 
    2016 IL 118023
    , ¶ 26 (quoting Mack v.
    Seaman, 
    113 Ill. App. 3d 151
    , 154 (1983)). Accepted principles of statutory construction,
    however, compel the conclusion that a person need not have sustained actual damage beyond
    violation of his or her rights under the Act in order to bring an action under it.
    -7-
    ¶ 29       As with the AIDS Confidentiality Act, the Act does not contain its own definition of what
    it means to be “aggrieved” by a violation of the law. Where, as here, a statutory term is not
    defined, we assume the legislature intended for it to have its popularly understood meaning.
    Likewise, if a term has a settled legal meaning, the courts will normally infer that the legislature
    intended to incorporate that established meaning into the law. People v. Johnson, 
    2013 IL 114639
    , ¶ 9. Applying these canons of construction, it is clear that defendants’ challenge to
    Rosenbach’s right to bring suit on behalf of her son is meritless.
    ¶ 30       More than a century ago, our court held that to be aggrieved simply “means having a
    substantial grievance; a denial of some personal or property right.” Glos v. People, 
    259 Ill. 332
    , 340 (1913). A person who suffers actual damages as the result of the violation of his or
    her rights would meet this definition of course, but sustaining such damages is not necessary
    to qualify as “aggrieved.” Rather, “[a] person is prejudiced or aggrieved, in the legal sense,
    when a legal right is invaded by the act complained of or his pecuniary interest is directly
    affected by the decree or judgment.” (Emphasis added.) 
    Id.
    ¶ 31       This understanding of the term has been repeated frequently by Illinois courts and was
    embedded in our jurisprudence when the Act was adopted. See American Surety Co. v. Jones,
    
    384 Ill. 222
    , 229-30 (1943); In re Estate of Hinshaw, 
    19 Ill. App. 2d 239
    , 255 (1958); In re
    Estate of Harmston, 
    10 Ill. App. 3d 882
    , 885 (1973); Greeling v. Abendroth, 
    351 Ill. App. 3d 658
    , 662 (2004). We must presume that the legislature was aware of that precedent and acted
    accordingly. See People v. Cole, 
    2017 IL 120997
    , ¶ 30.
    ¶ 32       The foregoing understanding of the term is also consistent with standard definitions of
    “aggrieved” found in dictionaries, which we may consult when attempting to ascertain the
    plain and ordinary meaning of a statutory term where, as here, the term has not been
    specifically defined by the legislature. In re M.I., 
    2016 IL 120232
    , ¶ 26. Merriam-Webster’s
    Collegiate Dictionary, for example, defines aggrieved as “suffering from an infringement or
    denial of legal rights.” Merriam-Webster’s Collegiate Dictionary 25 (11th ed. 2006). Similarly,
    the leading definition given in Black’s Law Dictionary is “having legal rights that are adversely
    affected.” Black’s Law Dictionary 77 (9th ed. 2009). This is therefore the meaning we believe
    the legislature intended here.
    ¶ 33       Based upon this construction, the appellate court’s response to the certified questions was
    incorrect. Through the Act, our General Assembly has codified that individuals possess a right
    to privacy in and control over their biometric identifiers and biometric information. See Patel
    v. Facebook Inc., 
    290 F. Supp. 3d 948
    , 953 (N.D. Cal. 2018). The duties imposed on private
    entities by section 15 of the Act (740 ILCS 14/15 (West 2016)) regarding the collection,
    retention, disclosure, and destruction of a person’s or customer’s biometric identifiers or
    biometric information define the contours of that statutory right. Accordingly, when a private
    entity fails to comply with one of section 15’s requirements, that violation constitutes an
    invasion, impairment, or denial of the statutory rights of any person or customer whose
    biometric identifier or biometric information is subject to the breach. Consistent with the
    authority cited above, such a person or customer would clearly be “aggrieved” within the
    meaning of section 20 of the Act (id. § 20) and entitled to seek recovery under that provision.
    No additional consequences need be pleaded or proved. The violation, in itself, is sufficient to
    support the individual’s or customer’s statutory cause of action.
    -8-
    ¶ 34       In reaching a contrary conclusion, the appellate court characterized violations of the law,
    standing alone, as merely “technical” in nature. 
    2017 IL App (2d) 170317
    , ¶ 23. Such a
    characterization, however, misapprehends the nature of the harm our legislature is attempting
    to combat through this legislation. The Act vests in individuals and customers the right to
    control their biometric information by requiring notice before collection and giving them the
    power to say no by withholding consent. Patel, 290 F. Supp. 3d at 953. These procedural
    protections “are particularly crucial in our digital world because technology now permits the
    wholesale collection and storage of an individual’s unique biometric identifiers—identifiers
    that cannot be changed if compromised or misused.” Id. at 954. When a private entity fails to
    adhere to the statutory procedures, as defendants are alleged to have done here, “the right of
    the individual to maintain [his or] her biometric privacy vanishes into thin air. The precise
    harm the Illinois legislature sought to prevent is then realized.” Id. This is no mere
    “technicality.” The injury is real and significant.
    ¶ 35       This construction of the law is supported by the General Assembly’s stated assessment of
    the risks posed by the growing use of biometrics by businesses and the difficulty in providing
    meaningful recourse once a person’s biometric identifiers or biometric information has been
    compromised. In enacting the law, the General Assembly expressly noted that
    “[b]iometrics are unlike other unique identifiers that are used to access finances or other
    sensitive information. For example, social security numbers, when compromised, can
    be changed. Biometrics, however, are biologically unique to the individual; therefore,
    once compromised, the individual has no recourse, is at heightened risk for identity
    theft, and is likely to withdraw from biometric-facilitated transactions.” 740 ILCS
    14/5(c) (West 2016).
    The situation is particularly concerning, in the legislature’s judgment, because “[t]he full
    ramifications of biometric technology are not fully known.” Id. § 5(f).
    ¶ 36       The strategy adopted by the General Assembly through enactment of the Act is to try to
    head off such problems before they occur. It does this in two ways. The first is by imposing
    safeguards to insure that individuals’ and customers’ privacy rights in their biometric
    identifiers and biometric information are properly honored and protected to begin with, before
    they are or can be compromised. The second is by subjecting private entities who fail to follow
    the statute’s requirements to substantial potential liability, including liquidated damages,
    injunctions, attorney fees, and litigation expenses “for each violation” of the law (id. § 20)
    whether or not actual damages, beyond violation of the law’s provisions, can be shown.
    ¶ 37       The second of these two aspects of the law is as integral to implementation of the
    legislature’s objectives as the first. Other than the private right of action authorized in section
    20 of the Act, no other enforcement mechanism is available. It is clear that the legislature
    intended for this provision to have substantial force. When private entities face liability for
    failure to comply with the law’s requirements without requiring affected individuals or
    customers to show some injury beyond violation of their statutory rights, those entities have
    the strongest possible incentive to conform to the law and prevent problems before they occur
    and cannot be undone. Compliance should not be difficult; whatever expenses a business might
    incur to meet the law’s requirements are likely to be insignificant compared to the substantial
    and irreversible harm that could result if biometric identifiers and information are not properly
    safeguarded; and the public welfare, security, and safety will be advanced. That is the point of
    -9-
    the law. To require individuals to wait until they have sustained some compensable injury
    beyond violation of their statutory rights before they may seek recourse, as defendants urge,
    would be completely antithetical to the Act’s preventative and deterrent purposes.
    ¶ 38        In sum, defendants’ contention that redress under the Act should be limited to those who
    can plead and prove that they sustained some actual injury or damage beyond infringement of
    the rights afforded them under the law would require that we disregard the commonly
    understood and accepted meaning of the term “aggrieved,” depart from the plain and, we
    believe, unambiguous language of the law, read into the statute conditions or limitations the
    legislature did not express, and interpret the law in a way that is inconsistent with the objectives
    and purposes the legislature sought to achieve. That, of course, is something we may not and
    will not do. Solich v. George & Anna Portes Cancer Prevention Center of Chicago, Inc., 
    158 Ill. 2d 76
    , 83 (1994); Exelon Corp. v. Department of Revenue, 
    234 Ill. 2d 266
    , 275 (2009).
    ¶ 39                                        CONCLUSION
    ¶ 40       For the foregoing reasons, we hold that the questions of law certified by the circuit court
    must be answered in the affirmative. Contrary to the appellate court’s view, an individual need
    not allege some actual injury or adverse effect, beyond violation of his or her rights under the
    Act, in order to qualify as an “aggrieved” person and be entitled to seek liquidated damages
    and injunctive relief pursuant to the Act. The judgment of the appellate court is therefore
    reversed, and the cause is remanded to the circuit court for further proceedings.
    ¶ 41      Certified questions answered.
    ¶ 42      Appellate court judgment reversed.
    ¶ 43      Cause remanded.
    - 10 -
    

Document Info

Docket Number: 123186

Citation Numbers: 2019 IL 123186

Filed Date: 9/4/2019

Precedential Status: Precedential

Modified Date: 3/3/2020

Cited By (38)

West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, ... , 2021 IL 125978 ( 2021 )

Coutant v. Durell , 2021 IL App (3d) 210255 ( 2021 )

Watson v. Legacy Healthcare Financial Services, LLC , 2021 IL App (1st) 210279 ( 2021 )

Image Media Advertising, Inc. v. Illinois Department of ... , 2021 IL App (1st) 200830-U ( 2021 )

Soucek v. Breath of Life Professional Services, NFP , 2021 IL App (1st) 180937 ( 2021 )

Rosenbach v. Six Flags Entertainment Corp. , 432 Ill. Dec. 654 ( 2019 )

Enriquez v. Navy Pier, Inc , 2022 IL App (1st) 211414-U ( 2022 )

Cothron v. White Castle System, Inc. , 2023 IL 128004 ( 2023 )

Westberg v. Barcroft , 2022 IL App (2d) 210543 ( 2022 )

Glynn v. Department of Corrections , 2023 IL App (1st) 211657 ( 2023 )

Tims v. Black Horse Carriers, Inc. , 2023 IL 127801 ( 2023 )

Westberg v. Barcroft , 2022 IL App (2d) 210543 ( 2022 )

Mosby v. Ingalls Memorial Hospital , 2022 IL App (1st) 200822 ( 2022 )

Mora v. J&M Plating, Inc. , 2022 IL App (2d) 210692 ( 2022 )

McDonald v. Symphony Bronzeville Park, LLC , 2022 IL 126511 ( 2022 )

People v. Kastman , 2022 IL 127681 ( 2022 )

Dynak v. Board of Education of Wood Dale School District 7 , 2019 IL App (2d) 180551 ( 2019 )

Nimesh Patel v. Facebook, Inc. , 932 F.3d 1264 ( 2019 )

Rojas v. Martell , 2020 IL App (2d) 190215 ( 2021 )

People v. Grant , 2022 IL 126824 ( 2022 )

View All Citing Opinions »