Six Flags Great America has settled a class-action lawsuit by agreeing to pay $36 million over the use of fingerprint scanners at its Illinois theme park.  The settlement indicates that pass holders who visited the Gurnee, Illinois, park in the five-year span between October 2013 and the end of December 2018 could get up to $200 each.  Six Flags, itself, is based in Texas.The lawsuit was first brought by 14-year-old Alexander Rosenbach after he was fingerprinted during a spring 2014 school field trip.  The eighth grader’s mom, Stacy Rosenbach, had purchased a season pass, and when he arrived, he had to give a thumbprint in order to claim it.Stacy Rosenbach sued the theme park under Illinois’ Biometric Information Privacy Act of 2008.  The law imposes requirements on companies that collect or otherwise obtain biometric information, including fingerprints, retina scans, and facial geometry scans.  It sets ground rules for how personal data should be collected and handled.

Photo by Min An from Pexels

The case made it all the way to the Illinois Supreme Court after the theme park was accused of soliciting the print without asking for permission.  In January 25, 2019, the Illinois Supreme Court held that “private individuals may bring suit even if the only harm was a violation of their legal rights.”The company denied it was collecting biometric identifiers that would compromise privacy and insisted visitors had given consent.  The decision by the high court only focused on whether a thumbprint made the teen an “aggrieved” person.“Six Flags was wrong to get the print without first getting releases or flagging that such a scan would be necessary,” Rosenbach’s attorneys claimed.“We have seen over and over again how private companies collect this information and store and use it for purposes that the owner of the information has no clue about,” Rebecca Glenberg, senior staff attorney, American Civil Liberties Union of Illinois (ACLU), said.  She had called the ruling “a victory for privacy rights in Illinois.”Among other requirements, businesses must receive written consent from individuals before obtaining their biometric data, and they must disclose their policies for usage and retention.  Glenberg added, “If business models didn’t take (informed consent) into consideration, it seems that business model needs a closer look.  This statute is all about giving individuals control over their biometric information.  We have seen over and over again how private companies collect this information and store and use it for purposes that the owner of the information has no clue about.”Robert Cattanach, a partner at Minneapolis-based Dorsey & Whitney, called the ruling “a break with the traditional notion that you really have to have something go wrong” to have grounds to sue. “This is a pretty big departure.”  While he believes security is important, he said it’s costly.  Cattanach explained, “For consumers, while it may be in the short term ‘Oh wait, this is great,’ the costs just get passed on for defending these suits.”

Sources:

Six Flags park settles lawsuit over fingerprint scanners for $36 millionFingerprint taken for Six Flags season pass could clear way for class-action lawsuitIllinois Supreme Court Holds That Biometric Privacy Law Does Not Require Actual Harm for Private Suits