Six Flags to Pay $36M Over Collection of Fingerprints

[silversurfer]

Theme park operator Six Flags has agreed to pay $36 million to settle a class-action lawsuit over its acquisition of the fingerprint data of visitors to its theme parks.
 
The Illinois Supreme Court ruled in the case Rosenbach v. Six Flags that collecting biometric data at premises’ gates by scanning fingerprints of people who enter the company’s theme park violates Illinois Biometric Information Privacy Act (BIPA).
 
Passed in 2008, the BIPA regulates how companies collect and use someone’s biometric data, such as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. The law mandates that a company must obtain a person’s written consent before acquiring and storing this type of data.
 
The case involved a mother, Stacy Rosenbach, who in 2016 sued Six Flags Entertainment Corp. after the Gurnee, Illinois, branch of the theme park scanned the fingerprint of her 14-year-old son Alex without obtaining written consent and without properly disclosing the company’s business practices as to how they would use the data.
 
After passing through lower courts, the case made it to the Illinois Supreme Court, where Six Flags filed a motion to dismiss the case, claiming that Rosenbach was not an “aggrieved party” according to the BIPA because she had not proven an actual injury under the law.
 
However, the court denied the motion, ruling that someone “need not allege some actual injury or adverse effect, beyond violation of his or her rights” to qualify as an “aggrieved” person under the law, according to its decision.
 
Mediation between the parties occurred, after which they agreed to a settlement that entitles anyone who first had their finger scanned by Six Flags Great America when entering the  park between October 1, 2013, and April 30, 2016, to receive up to $200. People who first had their finger scanned when entering the park between May 1, 2016, and December 31, 2018, could receive up to $60.

Read more: Six Flags to Pay $36M Over Collection of Fingerprints | Threatpost