https://www.eff.org/deeplinks/2019/01/victory-illinois-supreme-court-protect... Today the Illinois Supreme Court ruled unanimously that when companies collect biometric data like fingerprints or face prints without informed opt-in consent, they can be sued. Users don't need to prove an injury like identity fraud or physical harm—just losing control of one’s biometric privacy is injury enough. In Rosenbach v. Six Flags, a 14 year old brought a challenge against an amusement park for collecting his thumbprint without his informed consent, in violation of Illinois law. The law in question, the Illinois Biometric Information Privacy Act (BIPA), prohibits companies from gathering, using, or sharing biometric information without informed opt-in consent. EFF, along with ACLU, CDT, the Chicago Alliance Against Sexual Exploitation, PIRG, and Lucy Parsons Labs, filed an amicus curiae brief urging the Illinois Supreme Court to adopt a robust interpretation of BIPA. The Illinois Supreme Court agreed with us and soundly rejected the defendants’ argument that BIPA required a person to show an injury beyond loss of statutory privacy rights. The Court rejected the company’s argument that violation of a privacy statute is a mere “technical violation of the law.” In fact, the Court ruled, it inflicts a serious harm that supports a lawsuit. The court recognized that, through BIPA, the legislature had codified an individual’s “right to privacy in and control over their biometric identifiers and biometric information.” The need to codify this right was supported by the legislature’s findings that biometrics may be used to access sensitive information, but unlike other identifiers like social security numbers, biometrics are unique to each individual and can’t be changed. As a result, the Court ruled, quoting the legislature: “once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.” [...]