Justin Kay Discusses Key Ruling on Biometric Information for Tech Publications

Chicago partner Justin Kay commented on the Illinois Supreme Court ruling in Rosenbach v. Six Flags and its impact on companies’ use of biometric information moving forward. He was quoted in a number of tech-focused publications including SC Magazine, Infosecurity Magazine, Global Data Review, and Information Week.

In his remarks, Justin outlined the primary issue in play, which was “whether the Illinois Biometric Information Privacy Act would be a ‘gotcha’ statute, based on the failure of businesses to use magic words when using technology that incorporates biometrics.” He also considered the potential impact the decision will have on businesses and their use of biometric information, and how legislatures—both in Illinois and across the country—might respond.

In SC Magazine, he explained that the court’s decision indicated that if “a company that tells you verbally they are going to take your fingerprint for access control or security purposes – or that doesn’t tell you, but you know, based on the context – but that fails to inform you in writing that they are doing exactly what it is obvious they are doing, is still on the hook for thousands of dollars in statutory damages,” even if it uses “military-level encryption and security protocols to safeguard your fingerprint information”

As for the impact on legislation, in Infosecurity Magazine, he noted that “[e]fforts were made several years ago to amend the statute after the first spate of lawsuits against tech companies like Facebook related to facial recognition software, but those efforts failed. Last February, bills were again introduced in both the Illinois House and Senate to rein in the scope of the Illinois law, but they did not advance,” and that the Supreme Court’s interpretation is likely to impact how forthcoming legislation is drafted.

He also discussed with Information Week the companies that will likely face challenges as a result of the ruling: “It’s not always huge businesses that get hurt by this and get sued.” Though the first wave of suits were directed at top tier companies, “there are a number of Illinois businesses that could [go] out of business all because they didn’t hand someone a piece of paper [stating] what was actually clear from context and what had been communicated verbally.” Though some may tout the decision as a win for consumers, Justin believes otherwise, as he noted in his comments to Global Data Review, saying that, “[i]t [BIPA] doesn’t really advance consumer interest – they’ve taken a shotgun approach.”

Read Justin’s comments in the articles below:

• SC Magazine: “Illinois Supreme Court: Six Flags Violated State’s Biometric Information Privacy Act”
• Infosecurity Magazine: “Illinois Supreme Court Upholds Consumer Privacy Rights”
• Global Data Review: “No Harm Needed for Standing in Biometrics Case, Illinois Court Says” (log in required)
• Information Week: “Don’t Collect Biometric Data Without Providing Notice”