On May 23, an Illinois resident sued Universal Parks & Resorts in Orlando for violating the Illinois Biometric Information Privacy Act (“BIPA”). That's right, an Illinois resident flew about 900 miles to sunny Florida, enjoyed the activities at world-renowned Universal Studios in Orlando, then sued because Universal allegedly did not comply with Illinois law. Really?
A Refresher on BIPA
BIPA is an Illinois law that regulates the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and biometric information by private entities. I don't think anyone thought it would impact private entities outside of Illinois, but it has.
BIPA defines a “biometric identifier” as any personal feature that is unique to an individual, including handprints, fingerprints and palm scans. “Biometric information” is any information based on a biometric identifier, regardless of how it is converted or stored.
BIPA requires private entities to obtain written consent from individuals before acquiring their biometric information. Specifically, BIPA makes it unlawful to
“collect, capture, purchase, receive through trade, or otherwise obtain a person’s or customer’s biometric identifiers or biometric information unless [the entity] first: (1) informs the subject . . . in writing that a biometric identifier or biometric information is being collected or stored; (2) informs the subject . . . in writing of the specific purpose and length of for which a biometric identifier or biometric information is being captured, collected, stored, and used; and (3) receives a written release executed by the subject of the biometric identifier or biometric information . . . . "
BIPA provides for statutory damages of $5,000 for each willful and/or reckless violation and, alternatively, damages of $1,000 for each negligent violation.
Allegations in Complaint
Before getting into the specifics, remember that "allegations" are statements made without proof - they are not necessarily accurate or arise to a wrongful act. That is why we have judges and juries to decide liability.
According to the complaint, the plaintiff is an Illinois resident who visited Universal Orlando.
When he arrived at Universal Orlando, he received a physical, non-refundable and non-transferrable hard copy of his admission ticket. He was informed, for the first time, that his entry was subject to a biometric scan of his fingerprint. He was required to display his Illinois state identification, which was then associated with his biometrics.
The plaintiff alleges that Universal Orlando did not comply with the requirements of BIPA.
Florida Company Sued in Chicago
Some may ask how can a Chicago court have jurisdiction over operations conducted in Florida. The plaintiff addresses this issue in the complaint. The plaintiff alleges that the court may assert personal jurisdiction in accordance with the Illinois Constitution and the Constitution of the United States, because Universal knowingly captured, collected, stored, and used the biometric information of Illinois residents seeking access to the Universal Orlando Resort.
The plaintiff further alleges that Universal specifically targets advertisements and marketing efforts to induce Illinois residents into visiting Universal Orlando where they are required to provide their respective biometrics.
Apparently, Universal uses biometrics to regulate access to the parks for the purpose of reducing ticket fraud and increase profitability. The plaintiff claims that by using biometrics in violation of BIPA, Universal profited.
Do the Math
According to BIPA, the most that the plaintiff can receive for Universal's alleged violation is $5,000 if Universal's actions were willful or reckless. If Universal was just negligent, then the plaintiff is entitled to $1,000.
But, this is a class action, which means that this case is not about one individual. There are thousands of potential class members.
It is highly possible that through the scanning of identification cards, Universal Orlando has a readily accessible database that shows the number of attendees from each state. The plaintiff's attorneys are hoping to use Universal's database to easily identify Illinois residents who visited the amusement parks.
Now, consider this, Universal Orlando receives millions of patrons on an annual basis. My limited investigation shows that the number is close to $10 million. If just one percent are from Illinois and if each claimant receives the minimum amount allowed under BIPA (which is $1000), Universal is looking to pay $100,000,000 in fines. Then there are the attorneys' fees.
Nationwide Implications
So, Illinois law is having a nationwide impact. No matter the location, every Illinois resident can claim protection under BIPA. This is a bit unsettling. If this keeps up, I can see companies arguing that the law has federal implications and therefore the federal government should step in.
But, in the meantime, let's see how Universal defends this lawsuit.
~ Florida Cyber Lawyer, Robert Stines, Esq., CIPP
