Slashdot Mirror
Illinois Supreme Court Rules Against Six Flags in Lawsuit Over Fingerprint Scans, Says Actual Harm Unnecessary For Biometric Case (chicagotribune.com)
The family of a teenager whose fingerprint data was collected in 2014 when he bought a season pass to Six Flags Great America had the right to sue the amusement park company under an Illinois privacy law, the state Supreme Court ruled Friday. Chicago Tribune reports: The case is being closely watched by tech giants such as Facebook, who have pushed back against the Illinois Biometric Information Privacy Act (BIPA). The law requires companies collecting information such as facial, fingerprint and iris scans to obtain prior consent from consumers or employees, detailing how they'll use the data and how long the records will be kept. It also allows private citizens to sue, while other states let only the attorney general bring a lawsuit.
The opinion, which overturns an appeals court ruling in favor of Six Flags, has the potential to effect biometrics lawsuits playing out in courtrooms across the country. The Illinois law is one of the strictest of its kind in the nation and has turned the state into a hotbed of lawsuits over alleged misuses of biometric data. Privacy experts say protecting that type of information is critical because, unlike a credit card or bank account number, it's permanent. The National Law Review adds: In short, individuals need not allege actual injury or adverse effect, beyond a violation of his/her rights under BIPA, in order to qualify as an "aggrieved" person and be entitled to seek liquidated damages, attorneys fees and costs, and injunctive relief under the Act. Potential damages are substantial as the BIPA provides for statutory damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation of the Act. To date, no Illinois court has interpreted the meaning of "per violation," but the majority of BIPA suits have been brought as class actions seeking statutory damages on behalf of each individual affected.
The opinion, which overturns an appeals court ruling in favor of Six Flags, has the potential to effect biometrics lawsuits playing out in courtrooms across the country. The Illinois law is one of the strictest of its kind in the nation and has turned the state into a hotbed of lawsuits over alleged misuses of biometric data. Privacy experts say protecting that type of information is critical because, unlike a credit card or bank account number, it's permanent. The National Law Review adds: In short, individuals need not allege actual injury or adverse effect, beyond a violation of his/her rights under BIPA, in order to qualify as an "aggrieved" person and be entitled to seek liquidated damages, attorneys fees and costs, and injunctive relief under the Act. Potential damages are substantial as the BIPA provides for statutory damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation of the Act. To date, no Illinois court has interpreted the meaning of "per violation," but the majority of BIPA suits have been brought as class actions seeking statutory damages on behalf of each individual affected.
Good.
A law saying it's illegal to collect such information without consent would be completely worthless you were not allowed to sue the company for violating it.
http://www.geoffreylandis.com
I have a pass at that very Six Flags, and I have to fight almost every time to not do the fingerprint scan. This ruling may change that.
A hair and saliva sample later.
Seriously, why would anyone have thought this was a good idea?
What constitutional grounds would justify SCOTUS hearing such a case regarding Illinois state law?
That article sure left lots of questions unanswered, anyhow here are the details
The mother of the kid purchased season pass, for the kid, at Six Flags.
The kid, age 14, went to six flags and picked up his ticket and at that time was fingerprinted, per standard policy for season tickets.
Mother sued six flags since she had not given premission and him being a minor.
Various courts have tossed it back and forth on the bases that the mother could show no type of injury.
This time the Illinois Supreme Court ruled against six flags. The reason being that the state law does not require them to sure injury.
Supremacy clause and the 10th Amendment being basically ignored.
The 10th Amendment says exactly that the States can do this.
Supremacy clause always has let States make stricter rules, additional rules. There has to be a Federal Statute that directly contradicts the State law in the first place, you can't just wave your hands and say that something isn't allowed in Federal courts and have that mean it isn't allowed in State courts. Supremacy clause resolves conflicts between State and Federal law, it doesn't contradict the 10th Amendment.
Highly unlikely: I don't think they have a direct line to the FBI fingerprint database, and their fingerprint hash doesn't allow for reconstruction of the print. For this to work, they'd have to use the same hashing system that the FBI uses to make their prints searchable.
Besides, people can still buy a day pass without being fingerprinted, so this doesn't actually help in this respect. Even if they were doing this, privacy should trump absolute safety -- the worst things are often done for the cheeeeeldren.
Can i someone in Illinois sue google for allowing google photo to identify there face in a picture they didn't upload?
âoeTolerance applies only to persons, but never to truth. Intolerance applies only to truth, but never to persons.
Purchasing the passes is you granting them consent
reminds me of that game we'd play in jr high on friends/little brothers.... we'd barely whisper something like "say 'huh'/'what' if you want me to punch you in the arm"
of course, being barely audible, the little brother would say "huh?" and we'd then proceed to punch him in the arm stating that he asked for it cuz he said 'huh'
it was an 'agreement' done in bad faith then and it's the same thing here
Scott McNealy: You have zero privacy anyway. Get over it.
If Privacy is really dead, then Scott should publish his Name, Address, Account Numbers and passwords, location schedule, and DNA profile and always keep them all current. Until then, it's NOT.
It's one thing to lose my credit card number. Annoying, but I can get another. Same for my throw-away online accounts.
It's slightly harder for more important accounts, like my slashdot account -- I'd lose all my Karma standing and have to start over! Other accounts are the same: VERY annoying but not Earth shattering.
Getting doxed - the info used to be in the physical phone book, but now it's easy to tie "a fact" to "someone" and "know where they live." Now bother becomes heightened senses if not outright fear, and possibly having to actually uproot and move. Across the street, across town, across the country.
Now you lose my name and reputation with Identity Theft. Inverse doxing, I'm still me but so is someone ELSE. I _COULD_ change my name, but I don't want to. And it's Hell trying to prove what's actually you and what isn't.
FINALLY, you lose my biometrics? Movie hacker: "Computer: 'Override.' We're in." I _CAN'T_ change those, period. At all.
Just because I have nothing to hide doesn't mean that I want you to see.
If the universe is someone's simulation -- does that mean the stars are just stuck pixels?
hopefully that trend will start to reverse as we get more Justices who actually believe that words have meanings at the time they are spoken and the meaning of a sentence doesn't change over time because it means what it was intended to mean, not what you want it to mean today.
Of course the SCOTUS has always picked cases based on the perception that the case actually has a valid constitutional issue that is important and unresolved. So it might not help much in which cases they decide to pick up. It should help in the consistency of their decisions however.
âoeTolerance applies only to persons, but never to truth. Intolerance applies only to truth, but never to persons.
This assertion is being challenged and you can go right around it if state law touches interstate commerce. Sorry, you don't understand how this works. The 10th is not the only law and you didn't interpret it properly.
The fact that 6-flags is a multi-state company alone probably is enough to get around this notion of yours that states can do whatever they want.
well, if you don't want to be identified, reasonably they don't want to do business with you. Basically the reason they collect this info is because they don't accept you r possession of the ticket as proof you are who you claim to be. It is an anti counterfeit, anti scam measure that they wouldn't implement unless they thought it saved them money. I'm all for a law saying they have to tell you what they collect and what they do with it so you can consent, however, there is no reason to expect them to sell things to people who don't consent. ( is that part of this law?)
âoeTolerance applies only to persons, but never to truth. Intolerance applies only to truth, but never to persons.
The 10th Amendment says exactly that the States can do this.
The 10th Amendment is routinely ignored by justices on both the left and right.
If the 10th Amendment were interpreted literally, most of the federal government would have to be dismantled.
Photography is protected by the first amendment as affirmed by federal courts.
Photography in public, where there is no expectation of privacy, for noncommercial purposes is protected. Most people would not consider a fingerprint scanner to be collecting public information.
The collection of facial biometrics can be defended based on that.
Quite likely. But they didn't scan the kid's face. They scanned his fingerprints. Most people would consider that a greater impingement on privacy.
Furthermore, the collection of fingerprints can be argued to be a form of photography.
Maybe. But that is the point of this ruling: they have to make that argument in court. They can't just have the case dismissed with a lack of standing argument. The court didn't say the plaintiff win, just that the case can proceed.
Six Flags may also argue that they didn't store the fingerprint, but only a hash. Since there are many ways to generate a hash, and not every hash is unique, they could argue a hash is not "personally identifying information". Not sure if the court would agree.
The US is a litigious society. If it's for the cheeeeeeldreen, parks will start doing it just to avoid liability. The idea of a law or court judgement is that, if they're actively forbidden from doing so, violating people's privacy won't become an "industry best practice," and they can't be sued for failing to fingerprint.
I'd suspect that most "sharing" happens between family members. I also suspect that it's not permitted unless you pay up for a family pass.
In our State Constitution.
As does the entire nation of Canada.
And most of the EU.
Ooh, going to be a lot of suits.
-- Tigger warning: This post may contain tiggers! --
I understand your larger point, and I quite agree that anyone who claims they don't care about privacy is lying, but you'll understand if I don't want someone else's choices determining the value of my privacy. I say privacy matters to us all even if someone claims otherwise (as glib sycophants on /. sometimes claim without challenge or evidence).
Actually, everyone has something to hide. And that's not even the strongest reason why we all need privacy.
Glenn Greenwald was discussing privacy with Noam Chomsky and Ed Snowden and Greenwald brought up his email account just to put the lie to people who argue that they have nothing to hide (around 29m37s). He tells them to email him the credentials of every account they have—not just the nice accounts like work, email, bank, and phone, he said—all of the accounts including the accounts people keep secret from their spouses and significant others. He tells them he intends to snoop around on those accounts to see what they've been doing, and so that he can become their impostor. After all, if they have nothing to hide then they have nothing to fear by telling him what they're really up to.
The result? Greenwald said:
This also gets into why privacy matters most—a far stronger reason to value privacy both in the abstract and in one's own life is that "Privacy protects us from abuses by those in power, even if we're doing nothing wrong at the time of surveillance." as Bruce Schneier points out in an essay he posted:
Digital Citizen
As it is commonly pointed out on Slashdot, fingerprints are usernames, not passwords.
So what if an amusement park uses them? They are less privacy invading than a simple picture, and very convenient.
The ones who should be sued are not companies who collect them but the ones who use them for reasons others than checking your physical presence. The way Six Flags uses them is exactly how they are meant to be used.
Of course, they are still personal data but why focus specifically on fingerprints when they are not too different from your full name or birth date.
No, that's if the 10th Amendment was interpreted in an insane and inconsistent manner, as explained to you on AM radio.
If it is just, the thing that has existed for 250+ years, then no, it would literally just be the status quo.
The 10th Amendment is why California has stricter air standards than the Federal government. It has always been this way.
Belief that the 10th Amendment contradicts the existence of the Federal Government is just stupid-sauce that defeats itself; surely the founding fathers didn't think those few words invalidated the rest of the words, so why do you think so? Stupid sauce.