## Facts

- Six Flags Great America used a fingerprint-based system to issue and validate season passes.
- In May 2014, Alexander Rosenbach (a minor) obtained a season pass during a school trip, allegedly requiring collection of his fingerprint.
- His mother, Stacy Rosenbach, alleged Six Flags collected and retained his fingerprint without meeting the Illinois Biometric Information Privacy Act (BIPA) requirements.
- The complaint alleged Six Flags did not: (1) provide written notice that a fingerprint was being collected or stored; (2) provide written notice of the specific purpose and duration of collection, storage, and use; or (3) obtain a written release signed by the subject or legally authorized representative.
- The complaint did not allege a data breach, misuse, identity theft, economic loss, or other consequential harm beyond the statutory violations.

## Issues

1. Whether a person is “aggrieved” under BIPA § 20, and thus may sue, when the person alleges only violations of BIPA’s notice-and-consent requirements without alleging additional actual injury or adverse effects.

## Decision

- The Illinois Supreme Court reversed the appellate court and answered the certified question in the affirmative.
- The court held that a person qualifies as “aggrieved” under BIPA when a private entity violates BIPA’s statutory duties, even if no further harm is alleged.
- The case was remanded for further proceedings.

## Legal Principles

- BIPA creates individual, substantive rights to receive specified disclosures and to control whether a private entity may collect, store, and use biometric identifiers and information.
- A failure to provide required written notice and obtain a written release under BIPA § 15(b) is an invasion of the statutory right to biometric privacy that itself makes the person “aggrieved” under BIPA § 20.
- BIPA’s private right of action does not require allegations of consequential damages or downstream harms (e.g., identity theft, economic loss) beyond the statutory violation.
- The statute’s preventive purpose supports allowing suits at the point of noncompliant collection, rather than only after misuse or compromise occurs.
- Policy concerns about increased litigation exposure are for the legislature to address through statutory amendment, not for courts to impose by adding an injury requirement.

## Conclusion

The Illinois Supreme Court held that a violation of BIPA’s notice-and-consent requirements, standing alone, is sufficient to render a person “aggrieved” and entitled to seek statutory remedies, without pleading additional actual injury.


Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197 (Ill. 2019)