1

No. 123186

IN THE SUPREME COURT OF ILLINOIS

STACY ROSENBACH, as Mother and Next Friend of Alexander Rosenbach, individually and as the representative of a class of similarly situated persons Plaintiff-Appellant,

v. SIX FLAGS ENTERTAINMENT CORP. and GREAT AMERICA LLC, Defendants-Appellees.

On Appeal from the Appellate Court of Illinois, Second District, No. 2-17-317

There on Appeal from the Circuit Court of Lake County, No. 2016 CH 13, the Honorable Luis A. Berrones, Judge.

MOTION OF ADAM PEZEN, NIMESH PATEL, and CARLO LICATA FOR

LEAVE TO FILE INSTANTER BRIEF AMICI CURIAE IN SUPPORT OF PLAINTIFF-APPELLEE

Proposed amici curiae Adam Pezen, Nimesh Patel, and Carlo Licata hereby move

the Court for leave to file instanter the brief amicus curiae attached hereto as Exhibit A.

In support of their motion, proposed amici states as follows:

1. Movants are currently prosecuting an ongoing class action under the

Biometric Information Privacy Act (“BIPA”) on behalf of a certified class of Illinois

Facebook users whose biometric identifiers allegedly were collected and stored by

Facebook without their consent.

2. This Court has held that a brief amicus curiae will ordinarily be allowed

when presented by an individual or group who will be “materially affect[ed]” in related

litigation by the outcome of the appeal under review. See Order Denying Leave to File as

Amicus Curiae, at 3, Kinkel v. Cingular Wireless, No. 100925 (Ill. Jan. 11, 2006) (a

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

APPELLANT

E-FILED7/5/2018 11:33 AMCarolyn Taft GrosbollSUPREME COURT CLERK

5

2

proposed amicus filing will usually be accepted when the movant “has a direct interest in

another case” and the outcome of the case under review “may … materially affect that

interest”). That is the situation presented by this motion and brief.

3. Movants have an immediate interest in the outcome of this appeal. The

defendant in Movant’s case relied heavily on the decision of the Appellate Court in its

papers opposing class certification and seeking summary judgment. The same defendant

then cited heavily to the decision of the Appellate Court in a successful petition for

interlocutory appeal. The decision of this Court, in this matter of first impression,

undoubtedly is highly relevant to the outcome of that litigation, and likely dispositive of

at least one of the parties’ disputes.

4. Movant’s brief will assist the Court because it presents arguments that are

likely to be absent from the parties’ papers. The facts of this appeal involve, in part, the

point-of-sale collection of a fingerprint scan. By its terms, the Appellate Court’s decision

governs all claims under BIPA related to collection of biometric information or

identifiers, as those terms are defined by BIPA. Movant’s case, however, involves a

radically different method of collecting biometric information, which is not analogous to

an in-person fingerprint scan. Movants contend that the circumstances of their case help

demonstrate why the Appellate Court’s judgment is incorrect, and present that argument

in their short proposed amicus brief. In the alternative, movants argue that the

circumstances of their case help demonstrate why the Appellate Court’s judgment should

be read narrowly in order to preserve BIPA’s important privacy protections. Movants

anticipate that neither party will press these contentions.

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

3

WHEREFORE, Movants respectfully requests that the Court grant them leave to

file the attached brief instanter.

Dated: July 5, 2018 Respectfully Submitted,

ADAM PEZEN, NIMESH PATEL, and CARLO LICATA

By: s/ J. Aaron Lawson

Rafey Balabanian (ARDC No. 6285687) J. Aaron Lawson (ARDC No. 6313328) Edelson PC 123 Townsend Street, Suite 100 San Francisco, California 94107 415-212-9300 alawson@edelson.com

Attorneys for Amici Curiae

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

No. 123186

IN THE SUPREME COURT OF ILLINOIS

STACY ROSENBACH, as Mother and Next Friend of Alexander Rosenbach, individually and as the representative of a class of similarly situated persons Plaintiff-Appellant,

v. SIX FLAGS ENTERTAINMENT CORP. and GREAT AMERICA LLC, Defendants-Appellees.

On Appeal from the Appellate Court of Illinois, Second District, No. 2-17-317,

There on Appeal from the Circuit Court of Lake County, No. 2016 CH 13, the Honorable Luis A. Berrones, Judge.

ORDER

The cause having come before the Court on the Motion of Adam Pezen, Nimesh

Patel, and Carlo Licata for Leave to File Instanter Brief Amicus Curiae in Support of

Plaintiff-Appellant, IT IS HEREBY ORDERED THAT:

The motion is ALLOWED / DENIED

ENTER:

________________________ Justice Robert R. Thomas

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

No. 123186

IN THE SUPREME COURT OF ILLINOIS

STACY ROSENBACH, as Mother and Next Friend of Alexander Rosenbach, individually and as the representative of a class of similarly situated persons Plaintiff-Appellant,

v. SIX FLAGS ENTERTAINMENT CORP. and GREAT AMERICA LLC, Defendants-Appellees.

On Appeal from the Appellate Court of Illinois, Second District, No. 2-17-317,

There on Appeal from the Circuit Court of Lake County, No. 2016 CH 13, the Honorable Luis A. Berrones, Judge.

NOTICE OF FILING AND CERTIFICATE OF SERVICE

PLEASE TAKE NOTICE that on July 5, 2018, I filed in the above-captioned action the Motion of Adam Pezen, Nimesh Patel, and Carlo Licata for Leave to File Instanter Brief Amicus Curiae in Support of Plaintiff-Appellant and the proposed Brief Amicus Curiae attached thereto with the Clerk of the Supreme Court of Illinois by electronic means.

I caused copies of the aforementioned documents to be served via electronic mail on July 5, 2018, upon the following persons: Debra R. Bernard dbernard@perkinscoie.com Attorney for Defendant-Appellee David M. Oppenheim david@classlawyers.com Attorney for Plaintiff-Appellant Under penalties as provided by law pursuant to Section 1-109 of the Code of Civil Procedure, the undersigned certifies that the statements set forth in this notice of filing and certificate of service are true and correct.

s / J. Aaron Lawson

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

E-FILED7/5/2018 11:33 AMCarolyn Taft GrosbollSUPREME COURT CLERK

EXHIBIT A

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

No. 123186

IN THE SUPREME COURT OF ILLINOIS

STACY ROSENBACH, as Mother and Next Friend of Alexander Rosenbach, individually and as the representative of a class of similarly situated persons,

Appellant,

v.

SIX FLAGS ENTERTAINMENT CORP. and GREAT AMERICA LLC,

Appellees.

On Leave to Appeal from the Appellate Court of Illinois, Second District, No. 2-17-317, there on appeal from the Circuit Court of Lake County, No. 2016 CH 13, the

Honorable Luis A. Berrones, Judge.

BRIEF AMICUS CURIAE OF ADAM PEZEN, NIMESH PATEL, and CARLO LICATA

Rafey Balabanian (ARDC No. 6285687) J. Aaron Lawson (ARDC No. 6313328)

EDELSON PC 123 Townsend Street, Suite 100 San Francisco, California 94107

415-212-9300 alawson@edelson.com

Attorneys for Amici Curiae

Additional Counsel Listed on Signature Page

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

i

POINTS AND AUTHORITIES

I. Statement of Interest of Amici Curiae ..................................................................1

Order Denying Leave to File a Brief Amicus Curiae, Kinkel v. Cingular Wireless (Ill. Jan. 10, 2006) ...........................................1

II. Argument ................................................................................................................1

In re Facebook Biometric Info. Privacy Litig., 185 F. Supp. 3d 1155 (N.D. Cal. 2016) ..................................................1, 2 740 ILCS 14 .........................................................................................................2, 3

A. Any deprivation of BIPA’s protections causes an actionable invasion of privacy ....................................................................................4

Patel v. Facebook, Inc., 290 F. Supp. 3d 948 (N.D. Cal. 2018) .....................................4, 5, 6 Monroy v. Shutterfly, Inc., 2017WL 4099846 (N.D. Ill. Sept. 15, 2017) ...............................4, 6 740 ILCS 14 .................................................................................................4 Rosenbach v. Six Flags Entm’t. Corp., 2017 IL App (2d) 170317 ............................................................4, 7 In re Facebook Biometric Info. Privacy Litig., 2018 WL 1794295 (N.D. Cal. Apr. 16, 2018) .................................5 815 ILCS 505 ...............................................................................................5 Am. Sur. Co. v. Jones, 384 Ill. 222 (1943) ...........................................................................5

B. The Appellate Court’s decision should, at the very least, be limited to circumstances involving in-person data collection ...............7

Patel v. Facebook, Inc., 290 F. Supp. 3d 948 (N.D. Cal. 2018) .........................................7, 8 In re Facebook Biometric Info. Privacy Litig., 2018 WL 1794295 (N.D. Cal. Apr. 16, 2018) .................................7 740 ILCS 14 .................................................................................................8

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

ii

Goings v. UGN, Inc., 2018 WL 296670 (N.D. Ill. June 13, 2018) .....................................8 Dixon v. Washington & Jane Smith Cmty.—Beverly, 2018 WL 2445292 (N.D. Ill. May 31, 2018) ...............................8, 9 Rivera v. Google Inc., 238 F. Supp. 3d 1088 (N.D. Ill. 2017) .............................................8 Howe v. Speedway, 2018 WL 2445541 (N.D. Ill. May 31, 2018) .........................8, 9, 10 Relf v. Shatayeva, 2013 IL 114925 ................................................................................9 410 ILCS 210 .............................................................................................10

CONCLUSION .................................................................................................... 10

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

1

I. Statement of Interest of Amici Curiae

Amici Curiae Adam Pezen, Nimesh Patel, and Carlo Licata (the “Facebook User

Amici”) are currently prosecuting an ongoing class action under the Biometric

Information Privacy Act (“BIPA”) on behalf of a certified class of Illinois Facebook

users whose biometric identifiers allegedly were collected and stored by Facebook

without their consent. The Facebook User Amici will be directly affected by the Court’s

ruling in this case: the defendant has relied upon the decision of the Appellate Court in

this case both as a defense to liability and to class certification. See Order Denying Leave

to File a Brief Amicus Curiae, at 3, Kinkel v. Cingular Wireless (Ill. Jan 10, 2006) (noting

that an amicus brief ordinarily will be allowed “when the would-be amicus in another

case and the case in which he seeks permission to file an amicus curiae brief may …

materially affect that interest”). Amici contend, however, that the circumstances of their

case help demonstrate why the Appellate Court’s judgment is incorrect. As such,

proposed amici respectfully submit this brief in support of the Plaintiff-Appellant.

II. Argument

The class action brought by the Facebook User Amici, In re Facebook Biometric

Privacy Litigation, is the longest active litigation under BIPA in the nation. In that action

amici allege that, unbeknownst to Facebook users, when individuals upload photographs

to the platform, Facebook employs proprietary facial recognition technology to extract

the unique biometric identifiers (i.e., face geometry) associated with people’s faces in

order to determine their identity. See In re Facebook Biometric Info. Privacy Litig., 185

F. Supp. 3d 1155, 1158-59 (N.D. Cal. 2016). Using this technology, Facebook creates

and stores digital representations (which it calls “templates”) of people’s faces based on

the geometric relationship of facial features unique to each individual, like the distance

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

2

between a person’s eyes, nose, and ears. Id. Faces appearing in digital images uploaded to

Facebook are compared against this stored database of templates to determine the identity

of individuals appearing in the uploaded images. Facebook collects these templates,

which the Facebook User Amici contend qualify as “biometric identifiers,” by scanning

digital images after they have been uploaded by users, rather than via in-person scanning

devices. Id. Given that Facebook does not meaningfully disclose its collection of

biometric data, it likewise does not obtain informed and written consent. Id. at 1159.

Amici submit that the holding of the Appellate Court in this case (1) ill-comports

with the language and statutory scheme of BIPA, and (2) even if the Appellate Court’s

decision is correct as it relates to the in-person collection of fingerprint scans, it should

not be extended to cover situations like those alleged in the Facebook User Amici’s case,

where the collection is not only unauthorized but not apparent to the subject because of

the method and remote nature of collection.

Companies collect and handle biometric data about customers and employers in a

variety of circumstances. BIPA requires “informed written consent” before a company

collects or uses an individual’s biometric data in any way. 740 ILCS 14/15. Appellees

contend that failure to obtain that consent isn’t necessarily harmful. But that position fails

to recognize that the unauthorized collection of a person’s biometric data without their

consent is itself precisely the kind of harm that the Illinois legislature sought to prevent

by enacting BIPA. To conclude that some showing of an unspecified additional harm is

required beyond the invasion of privacy inherent in unauthorized collection of biometric

data would be to ignore the entire purpose of BIPA, which was to give people control

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

3

over their sensitive biometric data by requiring their informed written consent before any

such collection or use takes place.

Moreover, even if one were to ignore BIPA’s explicit informed consent

requirements and construe the statute to permit collection of biometric data when notice

and consent are implied by virtue of the subject’s participation in an in-person fingerprint

scan, the undisclosed and remote collection of biometric data unquestionably is an

invasion of privacy of the type the Illinois legislature made actionable through BIPA.

Appellees’ position, like the position of Facebook, Inc. in the Facebook action, however,

would prevent Illinoisans from asserting their statutorily guaranteed privacy rights in

either circumstance.

Amici submit that this result is neither compelled by nor consistent with the

statute. The legislature was aware of the variety of ways biometric technology could be

employed. See 740 ILCS 14/5(a), (b), (f). But the legislature did not deem some uses or

abuses more or less invasive of privacy. That choice makes sense. As the legislature

found, “the full ramifications of biometric technology are not fully known.” Id. § 5(f). It

would be unwise, therefore, to distinguish some invasions of privacy from others. Any

deprivation of the opportunity to give meaningful consent to the collection or use of

biometric data is an injury that allows a lawsuit.

At the very least, however, as several federal judges have recognized, the

reasoning of the Appellate Court should not be extended beyond the context of willing

submission to an in-person fingerprint scans. In that narrow context, while a company

(like Appellees here) may well fail to comply with the law, the consumer arguably has

some notice of the collection of their biometric data by virtue of her participation in the

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

4

collection process. By contrast, an individual whose biometric information is collected

without any disclosure, like amici’s, by contrast have no such opportunity. Accordingly,

this Court should reverse the Appellate Court, or, at the least, limit the Appellate Court’s

holding to situations involving disclosed, in-person collection of biometric information

and identifiers.

A. Any deprivation of BIPA’s protections causes an actionable invasion of privacy.

In passing BIPA the Illinois General Assembly “codified a right of privacy in

personal biometric information.” Patel v. Facebook Inc., 290 F. Supp. 3d 948, 953 (N.D.

Cal. 2018). By its plain terms, the statute requires no showing of “real [world] harm”

beyond the unauthorized collection in order to invoke this right in court. Id. at 955;

Monroy v. Shutterfly, Inc., 2017 WL 4099846, at *8 (N.D. Ill. Sept. 15, 2017) (“Nothing

in BIPA makes recovery dependent upon a showing of ‘adverse effects.’”). “When [a

company] simply disregards the [BIPA] procedures, … the right of the individual to

maintain her biometric privacy vanishes into thin air. The precise harm the Illinois

legislature sought to prevent is then realized.” Patel, 290 F. Supp. 3d at 954. If the

defendant acted negligently, recklessly, or intentionally, they are liable. 740 ILCS 14/20.

Respondents contend, as have many companies in defending against actions

concerning their violations of BIPA, that the General Assembly in fact sought to guard

only against consequential harms, insisting that individuals must show injury in addition

to a privacy violation in order to demonstrate that they were “aggrieved” under the

statute. See generally Rosenbach v. Six Flags Entm’t Corp., 2017 IL App (2d) 170317.

But that position is incompatible with the legislature’s decision to define and codify a

right of biometric privacy and provide a liquidated damages remedy for its invasion.

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

5

What’s more, “the Illinois legislature clearly knows how to condition a cause of action on

actual injury simply by saying so in the statute.” In re Facebook Biometric Info. Privacy

Litig., 2018 WL 1794295, at *7 (N.D. Cal. Apr. 16, 2018) (citing the Illinois Consumer

Fraud Act, 815 ILCS 505/10a). And this Court has previously held that “an individual is

‘aggrieved’ when ‘a legal right is invaded by the act complained of,’” id. (quoting Am.

Sur. Co. v. Jones, 384 Ill. 222, 229-30 (1943)), without any showing of accompanying,

consequential harm.

This broader definition, besides being faithful to the statutory language and this

Court’s precedents, is a better fit with the legislative findings codified in BIPA and with

the realities of the use of biometric technology than is the Appellate Court’s more narrow

rule. BIPA protects “the right of the individual to maintain her biometric privacy.” Patel,

290 F. Supp. 3d at 954. “BIPA vested in Illinois residents the right to control their

biometric information by requiring notice before collection and giving residents the

power to say no by withholding consent.” Id. at 953-54. When a company “simply

disregards the Illinois procedures … the right of the individual to maintain her biometric

privacy vanishes into thin air.” Id. at 954.

Appellees concede that a person would have standing to sue under BIPA if their

data is “disseminated to a third party.” See Answer to PLA at 16; see also id. at 2-3

(conceding that Rosenbach would be “aggrieved” under BIPA if his “fingerscan was

disseminated or disclosed to anyone outside of Six Flags”). But why is the initial

unauthorized collection of the biometric data necessarily any less harmful than the

transfer of that data to some other equally unauthorized entity? Indeed, the subsequent

unauthorized recipient may easily be less culpable than the first (perhaps being ignorant

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

6

of the fact that the data was collected or transmitted without consent), and may even store

and handle that data more securely than the original unauthorized collector. There is no

logical reason, and certainly none presented in the text or history of BIPA, why the law

should give a free pass to those that violate the law in the first instance by collecting data

without obtaining consent and instead only target secondary abuses.

Indeed, that is precisely the opposite of BIPA’s expressed intent. “BIPA, unlike

[other statutes], targets the unauthorized collection of information in the first instance.”

Patel, 290 F. Supp. 3d at 956. There is simply no support in the text of BIPA for the

notion that the legislature intended to provide a remedy only for some undefined future

event, rather than the immediate harm caused by the initial unauthorized collection that is

the statute’s focus. The Appellate Court’s decision fails to recognize what the Illinois

legislature clearly understood and expressed—that the unauthorized harvesting of a

person’s biometric data without their consent is itself an invasion of privacy, regardless

of whether there is subsequent additional dissemination or misuse of that information.

While the Appellate Court was concerned only with Six Flags’ in-person

fingerprint scan, other technology permits the collection of biometric identifiers in ways

that may not be apparent to the subject of the collection. The Facebook User Amici’s

case, for instance, involves undisclosed, remote collection that is hidden from the subject.

One judge in the Northern District of Illinois likewise has observed that technology

allows companies to collect fingerprints and retinal scans “from images and

photographs.” Monroy, 2017 WL 4099846, at *4. And “it would be rash, given the pace

of technological development,” to rule out other surreptitious ways biometric information

and identifiers might be collected without the subject even being aware of the collection.

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

7

Id. In the context of such collection methods, to describe a plaintiff’s injury as “a

violation of the notice and consent requirements,” Rosenbach, 2017 IL App (2d) 170317,

¶ 18, unreasonably minimizes the serious invasion of privacy a company’s failure to

follow the law causes. When collection is unknown to the subject or is otherwise

unapparent, an individual loses his or her ability to make a choice about whether to

permit the collection in the first place. A rule that forecloses a claim based on “a violation

of the notice and consent requirements” detracts from both the statutory language and the

privacy-protecting purposes of the statute. This Court should therefore reverse the

Appellate Court’s judgment.

B. The Appellate Court’s decision should, at the very least, be limited to circumstances involving in-person data collection.

But should the Court conclude that the Appellate Court’s judgment was correct,

the Court should limit the result to instances, like a fingerprint scan, in which the nature

of the collection itself makes it clear that biometric information or identifiers are being

collected. Cases involving the collection of fingerprints at the point of sale are materially

distinguishable from cases involving the undisclosed collection of biometric data because

“the plaintiffs [in the fingerprint cases] indisputably knew that their biometric data would

be collected before they accepted the services offered by the business involved.” Patel,

290 F. Supp. 3d at 955. Arguably, the Appellate Court already has done this work.

Indeed, the judge in the Facebook action concluded that a “fair reading [of the Appellate

Court’s decision] suggests that the Rosenbach court would have reached the opposite

conclusion had the allegations [of undisclosed collection] in [the Facebook] case been

before it.” In re Facebook, 2018 WL 1794295, at *6.

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

8

Courts generally agree that the purpose of the BIPA is to give individuals control

over their biometric data by ensuring that it is provided to companies only if the

individual provides informed, written consent. See 740 ILCS 14/15(a); Goings v. UGN,

Inc., 2018 WL 296670, at *1 (N.D. Ill. June 13, 2018); Dixon v. Washington & Jane

Smith Cmty.—Beverly, 2018 WL 2445292, at *8 (N.D. Ill. May 31, 2018); Rivera v.

Google Inc., 238 F. Supp. 3d 1088, 1093, 1097 (N.D. Ill. 2017). When collection is made

at the point-of-sale, an individual “ha[s] sufficient notice to make a meaningful decision

about whether to permit the data collection.” Patel, 290 F. Supp. 3d at 955. Thus, even

though a defendant may not have followed the letter of the BIPA, a plaintiff’s privacy

rights arguably are protected. But the same is not true when collection or other use of

biometric data isn’t disclosed or even apparent from the nature of the collection itself.

Indeed, several federal judges in Illinois recently have emphasized this

distinction. See Howe v. Speedway, 2018 WL 2445541 (N.D. Ill. May 31, 2018); Dixon,

2018 WL 2445292. Dixon involved, in addition to several wage and hour claims, a claim

under the BIPA related to an employer’s use of fingerprint scans to clock in and out.

2018 WL 2445292, at *1. The plaintiff there alleges that the employer neither received

proper authorization to collect fingerprint scans nor ever disclosed that it was transmitting

those scans to a third-party vendor. Id. The court concluded that the defendant’s conduct

was actionable because “obtaining or disclosing a person’s biometric identifiers or

information without her consent or knowledge necessarily violates that person’s right to

privacy in her biometric information.” Id. at *9 (emphasis added). The Dixon court

specifically distinguished the decision of the Appellate Court in this case, noting both that

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

9

the plaintiff specifically alleged violation of a privacy right, and her biometric

information was handled in a way that was not disclosed. Id. at *12.

The decision of the Howe court also is instructive. The claim there is similar to

Rosenbach’s claim: the plaintiff’s fingerprint was scanned without any BIPA-mandated

disclosures or informed, written consent. 2018 WL 2445541, at *1. The district court,

however, concluded that Howe had not suffered any cognizable harm because his

“fingerprints were collected in circumstances under which any reasonable person should

have known that his biometric data was being collected.” Id. at *6. The court concluded

that “proper compliance with BIPA’s disclosure and written authorization requirements

would only have made explicit what should have already been obvious.” Id. But the court

held that things would be different if collection weren’t obvious: “the purpose of BIPA’s

disclosure requirements [is to] support BIPA’s data protection interest by preventing

individuals from unwittingly sharing their biometric identifiers and information. Thus, a

person uploading a photo to Facebook should be provided fair notice that by doing so

their faces will be mapped and stored; otherwise, the person might not be aware of the

biometric data collection. On the other hand, where individuals are obviously sharing

biometric data—whether holding their fingerprint to a scanner or their face to a camera—

the procedural violation from disclosure omissions causes negligible harm.” Id.

This factual distinction lacks a clear textual hook: BIPA’s express requirement of

informed, written consent should preclude any construction of the law that permits

implied consent to suffice. See Relf v. Shatayeva, 2013 IL 114925, ¶ 29 (a court should

not read “exceptions, limitations, or conditions” into a law “that the legislature did not

express”). But should the Court conclude that the Appellate Court’s judgment was correct

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

10

on these facts, it should embrace the distinction elucidated in Facebook, Howe, and

Dixon: When collection of biometric information is done in a way that is obvious, and

thus allows the subject of collection the opportunity to make a choice about whether to

permit the collection of biometric information, technical noncompliance with BIPA may

be excused. In other circumstances, however, violation of BIPA is itself an actionable

invasion of privacy.

The Facebook User Amici note, however, that even under this framework it is not

clear that the appeal should be resolved in Appellees’ favor. The subject of the biometric

collection here was a minor child, who is generally capable of providing informed

consent only in limited circumstances. See 410 ILCS 210/1. Whether or not the collection

is “obvious,” Howe, 2018 WL 2445541, at *6, it isn’t clear that the law recognizes

Alexander’s ability to make a meaningful decision in these circumstances.

CONCLUSION

In sum, the Illinois legislature already articulated the harm necessary to bring a

cause of action for violation of the BIPA: invasion of privacy through a deprivation of the

ability to make a meaningful decision about whether to disclose biometric information to

a third party. This Court should reject efforts to turn BIPA on its head by reading into it a

requirement that some additional harm beyond the invasion of privacy that is expressly

articulated in, and protected by, the statute be alleged before a plaintiff can enforce his or

her privacy rights.

Respectfully Submitted,

s/ J. Aaron Lawson

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

11

Rafey Balabanian (ARDC No. 6285687) J. Aaron Lawson (ARDC No. 6313328) EDELSON PC 123 Townsend Street, Suite 100 San Francisco, California 94107 415-212-9300 alawson@edelson.com

Suzi K. Alexander Shawn Williams John George ROBBINS GELLER RUDMAN

& DOWD LLP 1 Montgomery Street, Suite 1800 San Francisco, California 94104

Michael P. Canty Corban Rhodes LABATON SUCHAROW LLP 140 Broadway New York, New York 1005

JULY 5, 2018

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186

12

CERTIFICATE OF COMPLIANCE

I certify that this brief conforms to the requirements of Rules 341(a), 315(f), and

345(b). The length of this brief, excluding the pages or words contained in the Rule

341(d) cover, the Rule 341(h)(1) statement of points and authorities, the Rule 341(c)

certificate of compliance, the certificate of service, and those matters to be appended to

the brief under Rule 342(a), is 10 pages.

Dated: July 5, 2018 s/ J. Aaron Lawson

SUBMITTED - 1378274 - John Lawson - 7/5/2018 11:33 AM

123186