Supreme Court Upholds Biometric Privacy Law

Electronic privacy advocates are praising a ruling from the Illinois Supreme Court on Friday. The justices held that people can sue just for having biometric information collected without consent.

The case began with a class trip to Six Flags Great America, where 14-year-old Alexander Rosenbach had his thumbprint scanned.

His family sued under Illinois’ biometric privacy law. But Six Flags argued there wasn’t any actual harm.

The justices rejected that. They say because biometric information cannot be changed in the event of a data breach — like you can do with a bank account or credit card number — there is harm in merely collecting information, or at least enough harm to sustain a lawsuit.

Adam Schwartz, with the digital-privacy watchdog Electronic Frontier Foundation, echoed that assessment.

“Invasions of biometric privacy are uniquely harmful because we can’t change our biometrics, and because the ultimate consequences of biometric surveillance are not yet known, because they’re going to unfold in unpredictable ways in the future,” Schwartz said in a telephone interview.

Schwartz said Illinois has the strictest biometric privacy law in the U.S., and has been a model for other states. That's gives Friday's Illinois Supreme Court ruling national significance.

“I think this is going to really get the attention of big tech companies, and that they will do a better job of respecting the biometric privacy of people in Illinois,” Schwartz said.

Illinois Chamber of Commerce issued a statement saying it's disappointed in the decision.

“We fear that today’s decision will open the floodgates for future litigation at the expense of Illinois’ commercial health,” Todd Maisch, the chamber's CEO, said in a statement.