After a teenage boy was fingerprinted without written consent when he purchased a season pass to Great America, his mother sued Six Flags for violation of the Illinois Biometrics Act. In January the Illinois Supreme Court unanimously found that plaintiffs can bring a private cause of action for violations of the state’s biometric privacy law’s notice and consent requirements, even if they can’t show any harm.
The court found (Rosenbach v. Six Flags Entertainment Corporation) that individuals have control of, and a right to privacy over, their biometric identifiers, such as voice samples, retina scans and facial geometry, in addition to fingerprints. Because neither the son nor the mother consented in writing nor signed a written release for the taking of the fingerprint, and because Six Flags did not provide documentation about how long they might retain the data before destroying it, the court found the theme park violated these rights.
This decision underscores the fact that biometric privacy is quickly becoming an area of the law with greater application for businesses—and that they need to start paying attention, particularly as technology ramps up to a whole new level with the advent of microchips. About the size of a grain of rice, these chips have been voluntarily implanted in the hands of employees at several companies and work like a card reader, providing the ability to open doors, get into company accounts and order from company vendors.
Chicago Business Attorney Blog
