In a unanimous ruling today, the Illinois Supreme Court upheld critical principles of Illinois’ Biometric Information Privacy Act (BIPA). The 2008 law allows individuals to control their own biometric data –fingerprints, iris scans, facial scans, and other unique biological information that can be used for identification. The law prohibits private companies from collecting a person’s biometric information unless they first inform the person of the data to be collected and how it will be stored, used, and shared. They must then obtain the person’s written consent. The case decided today comes after a family sued amusement park giant Six Flags for collecting thumbprint data (to purchase a season pass) without the notice and consent. An Illinois Appellate Court previously found this action to be only a “technical violation” and did not cause any “actual injury.” The ACLU of Illinois, which wrote and lobbied for BIPA, filed a friend of the court brief before the Illinois Supreme Court in this case. 

In response to today’s ruling, Senior Staff Counsel Rebecca Glenberg of the ACLU of Illinois issued the following statement: 

“Today’s ruling protects Illinoisans’ right to control their own fingerprints, iris scans, and other crucial information about their bodies. This is exactly what the General Assembly had in mind when it enacted BIPA. 

Your biometric information belongs to you and should not be left to corporate interests who want to collect detailed information about you for advertising and other commercial purposes. The Court recognized that individuals must have the right to sue companies that unlawfully collect their personal information; otherwise, the companies will not be held accountable.   

More than a decade after BIPA’s enactment, we constantly hear new examples of companies that have collected, shared, and misused the personal information of millions being shared without their knowledge or consent. The strong protections of Illinois’s law are more critical than ever.”