State supreme court: Mom can sue Six Flags over fingerprinting and privacy
In a ruling hailed by privacy rights groups, Illinois Supreme Court justices issued an opinion Friday that allows a suburban mom to continue a lawsuit against Six Flags Great America over its use of fingerprints for season pass holders' entry.
Citing the Illinois Biometric Information Privacy Act, Stacy Rosenbach sued the Gurnee theme park in 2016 about two years after her son, Alexander, then a minor, was required to be electronically fingerprinted to receive a season pass. The state law is considered by privacy groups to be the nation's strongest for safeguarding identifiers such as facial features, fingerprints and iris scans.
An appellate court in 2017 found Rosenbach never demonstrated a direct injury or adverse effect and couldn't cite the state law for her suit, but that decision was overturned Friday by the supreme court. The opinion issued Friday means Rosenbach may proceed with her Lake County lawsuit that claims Great America violated the biometric privacy law.
Adam Schwartz, a senior staff attorney on the civil liberties team at the San Francisco-based Electronic Frontier Foundation, called the unanimous supreme court ruling a "victory." The American Civil Liberties Union of Illinois also praised the opinion.
Illinois Chamber of Commerce President and CEO Todd Maisch expressed disappointment.
"We fear that today's decision will open the floodgates for future litigation at the expense of Illinois' commercial health," Maisch said in a statement.
Great America spokeswoman Tess Claussen declined to comment, citing the pending litigation.
Under the 2008 law, businesses and other private entities must obtain consent from people before collecting or disclosing biometric identifiers such as photographs and fingerprints.
There must be secure storage of the biometric identifiers and parties may file lawsuits to hold businesses accountable if they believe they were harmed by violations of the law.
Rosenbach's lawsuit says her son was 14 and that she purchased a season pass for him online before he went to Great America for a school field trip in May or June 2014. Rosenbach knew her son had to complete the signup process in person.
But the suit contends Rosenbach was unaware her son would need to visit a security checkpoint where his thumb was scanned into Great America's biometric data capture system. The lawsuit says Alexander received a season pass card, then had to use it with his thumbprint to gain entry.
"Upon returning home from (Great America), Alexander was asked by Rosenbach for the booklet or paperwork he had been given in connection with his new season pass. In response, Alexander advised her that defendants did 'it all by fingerprint now' and that no paperwork had been provided," according to the supreme court opinion.
Chicago attorney Phillip Bock, who represented Rosenbach and argued the case before the Illinois Supreme Court in November, said there is a reason the biometric law requires much from businesses to keep information secure.
"The problem with this stuff is if somebody figures out how to take your fingerprint and then someday uses whatever information the person (provided) and put it together and misrepresent that they're you," Bock said.
Illinois Chamber of Commerce officials say the privacy law has led to at least 110 lawsuits against businesses in the state since 2008. The organization's research shows the vast majority of the suits are against businesses that use fingerprints to track employees' time worked.