Rosenbach v. Six Flags Entm't Corp.

• Decision Date: 25 January 2019
• Docket Number: Docket No. 123186
• Citation: 432 Ill.Dec. 654,129 N.E.3d 1197,2019 IL 123186
• Parties: Stacy ROSENBACH, as Mother and Next Friend of Alexander Rosenbach, Appellant, v. SIX FLAGS ENTERTAINMENT CORPORATION et al., Appellees.
• Court: Illinois Supreme Court

2019 IL 123186
129 N.E.3d 1197
432 Ill.Dec. 654

Stacy ROSENBACH, as Mother and Next Friend of Alexander Rosenbach, Appellant,
v.
SIX FLAGS ENTERTAINMENT CORPORATION et al., Appellees.

Docket No. 123186

Supreme Court of Illinois.

Opinion filed January 25, 2019

129 N.E.3d 1199

Phillip A. Bock and David M. Oppenheim, of Bock, Hatch, Lewis & Oppenheim, LLC, of Chicago, and Ilan Chorowsky and Mark Bulgarelli, of Progressive Law Group, LLC, of Evanston, for appellant.

Debra R. Bernard, of Perkins Coie LLP, of Chicago, and Kathleen M. O’Sullivan, of Perkins Coie LLP, of Seattle, Washington, for appellees.

Rebecca K. Glenberg, Megan Rosenfeld, and Michael C. Landis, all of Chicago, Joseph Jerome, of Washington, D.C., Adam Schwartz, of San Francisco, California, and Nathan Freed Wessler, of New York, New York, for amici curiae American Civil Liberties Union et al.

Adam J. Levitt and Amy E. Keller, of DiCello Levitt & Casey LLC, of Chicago, and Marc Rotenberg, Alan Butler, and Natasha Babazadeh, of Washington, D.C., for amicus curiae Electronic Privacy Information Center.

Melissa A. Siebert and Bonnie Keane DelGobbo, of Baker Hostetler LLP, of Chicago, and Angelo I. Amador, of Washington, D.C., for amici curiae Restaurant Law Center et al.

Gary M. Miller, of Shook, Hardy & Bacon L.L.P., of Chicago, for amici curiae Illinois Retail Merchants Association et al.

Michele Odorizzi and Michael A. Scodro, of Mayer Brown LLP, of Chicago, and Lauren R. Goldman and Michael Rayfield, of Mayer Brown LLP, of New York, New York, for amicus curiae Internet Association.

Noah A. Finkel and Thomas E. Ahlering, of Seyfarth Shaw LLP, of Chicago, for amicus curiae Illinois Chamber of Commerce.

CHIEF JUSTICE KARMEIER delivered the judgment of the court, with opinion.

432 Ill.Dec. 656

¶ 1 The Biometric Information Privacy Act (Act) ( 740 ILCS 14/1 et seq. (West 2016) ) imposes numerous restrictions on how private entities collect, retain, disclose and destroy biometric identifiers, including retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, or biometric information. Under the Act, any person "aggrieved" by a violation of its provisions "shall have a right of action * * * against an offending party" and "may recover for each violation" the greater of liquidated damages or actual damages,

129 N.E.3d 1200

432 Ill.Dec. 657

reasonable attorney fees and costs, and any other relief, including an injunction, that the court deems appropriate. Id. § 20. The central issue in this case, which reached the appellate court by means of a permissive interlocutory appeal pursuant to Illinois Supreme Court Rule 308 (eff. Jan. 1, 2016), is whether one qualifies as an "aggrieved" person and may seek liquidated damages and injunctive relief pursuant to the Act if he or she has not alleged some actual injury or adverse effect, beyond violation of his or her rights under the statute. The appellate court answered this question in the negative. In its view, "a plaintiff who alleges only a technical violation of the statute without alleging some injury or adverse effect is not an aggrieved person" within the meaning of the law. (Emphasis in original.) 2017 IL App (2d) 170317, ¶ 23, ––– Ill.Dec. ––––, ––– N.E.3d ––––. We granted leave to appeal ( Ill. S. Ct. R. 315(a) (eff. Nov. 1, 2017) ) and now reverse and remand to the circuit court for further proceedings.

¶ 2 BACKGROUND

¶ 3 The question the appellate court was asked to consider in this case arose in the context of a motion to dismiss pursuant to section 2-615 of the Code of Civil Procedure (Code) ( 735 ILCS 5/2-615 (West 2016) ). We therefore take the following well-pleaded facts from the complaint and accept them as true for purposes of our review. Cochran v. Securitas Security Services USA, Inc. , 2017 IL 121200, ¶ 11, 419 Ill.Dec. 374, 93 N.E.3d 493.

¶ 4 Six Flags Entertainment Corporation and its subsidiary Great America LLC own and operate the Six Flags Great America amusement park in Gurnee, Illinois. Defendants sell repeat-entry passes to the park. Since at least 2014, defendants have used a fingerprinting process when issuing those passes. As alleged by the complaint, their system "scans pass holders' fingerprints; collects, records and stores ‘biometric’ identifiers and information gleaned from the fingerprints; and then stores that data in order to quickly verify customer identities upon subsequent visits by having customers scan their fingerprints to enter the theme park." According to the complaint, "[t]his makes entry into the park faster and more seamless, maximizes the time pass holders are in the park spending money, and eliminates lost revenue due to fraud or park entry with someone else's pass."

¶ 5 In May or June 2014, while the fingerprinting system was in operation, Stacy Rosenbach's 14-year-old son, Alexander, visited defendants' amusement park on a school field trip. In anticipation of that visit, Rosenbach had purchased a season pass for him online. Rosenbach paid for the pass and provided personal information about Alexander, but he had to complete the sign-up process in person once he arrived at the amusement park.

¶ 6 The process involved two steps. First, Alexander went to a security checkpoint, where he was asked to scan his thumb into defendants' biometric data capture system. After that, he was directed to a nearby administrative building, where he obtained a season pass card. The card and his thumbprint, when used together, enabled him to gain access as a season pass holder.

¶ 7 Upon returning home from defendants' amusement park, Alexander was asked by Rosenbach for the booklet or paperwork he had been given in connection with his new season pass. In response, Alexander advised her that defendants did "it all by fingerprint now" and that no paperwork had been provided.

¶ 8 The complaint alleges that this was the first time Rosenbach learned that Alexander's fingerprints were used as part of

432 Ill.Dec. 658

129 N.E.3d 1201

defendants' season pass system. Neither Alexander, who was a minor, nor Rosenbach, his mother, were informed in writing or in any other way of the specific purpose and length of term for which his fingerprint had been collected. Neither of them signed any written release regarding taking of the fingerprint, and neither of them consented in writing "to the collection, storage, use sale, lease, dissemination, disclosure, redisclosure, or trade of, or for [defendants] to otherwise profit from, Alexander's thumbprint or associated biometric identifiers or information."

¶ 9 The school field trip was Alexander's last visit to the amusement park. Although he has not returned there since, defendants have retained his biometric identifiers and information. They have not publicly disclosed what was done with the information or how long it will be kept, nor do they have any "written policy made available to the public that discloses [defendants'] retention schedule or guidelines for retaining and then permanently destroying biometric identifiers and biometric information."

¶ 10 In response to the foregoing events, Rosenbach, acting in her capacity as mother and next friend of Alexander (see 755 ILCS 5/11-13(d) (West 2016) ), brought this action on his behalf in the circuit court of Lake County.¹ The action seeks redress for Alexander, individually and on behalf of all other similarly situated persons, under the Act ( 740 ILCS 14/1 et seq. (West 2016) ), which, as noted at the outset of this opinion, provides that any person "aggrieved" by a violation of the Act's provisions "shall have a right of action * * * against an offending party" and "may recover for each violation" the greater of liquidated damages or actual damages, reasonable attorney fees and costs, and any other relief, including an injunction, that the court deems appropriate (id. § 20).

¶ 11 The complaint, as amended, is in three counts. Count I seeks damages on the grounds that defendants violated section 15(b) of the Act (id. § 15(b) ) by (1) collecting, capturing, storing, or obtaining biometric identifiers and biometric information from Alexander and other members of the proposed class without informing them or their legally authorized representatives in writing that the information was being collected or stored; (2) not informing them in writing of the specific purposes for which defendants were collecting the information or for how long they would keep and use it; and (3) not obtaining a written release executed by Alexander, his mother, or members of the class before collecting the information. Count II requests injunctive relief under the Act to compel defendants to make disclosures pursuant to the Act's requirements and to prohibit them from violating the Act going forward. Count III asserts a common-law action for unjust enrichment.

¶ 12 Defendants sought dismissal of Rosenbach's action under both sections 2-615 and 2-619 of the Code ( 735 ILCS 5/2-615, 2-619 (West 2016) ) in a combined motion filed pursuant to section 2-619.1 (id. § 2-619.1). As grounds for their...