IRPA Claims – A Troubling New Trend?

What is IRPA?

IRPA was enacted in 1999, replacing the prior common law right of publicity in Illinois. The main thrust of the statute is that a business may not use an individual's “identity” for “commercial purposes” without prior written consent. “Identity” is defined broadly as “any attribute of an individual that serves to identify that individual to an ordinary, reasonable viewer or listener,” which can include a person’s name, signature, image, voice, or other identifying information. “Commercial purpose” is likewise defined broadly as “the public use or holding out of an individual’s identity (i) on or in connection with the offering for sale or sale of a product, merchandise, goods, or services; (ii) for purposes of advertising or promoting products, merchandise, goods, or services; or (iii) for the purpose of fundraising.”  IRPA marked a departure from the prior common law right of publicity, which required that the plaintiff’s identity had commercial or intrinsic value. IRPA expressly provides plaintiffs a private right of action and does not require plaintiffs to prove any actual damages. Plaintiffs may obtain the greater of actual damages plus profits derived from an unauthorized use or $1000, as well as attorney fees, costs, and expenses. In other words, if a business uses anyone’s identity to sell a product or service without written consent, it violates IRPA regardless of any actual harm to the plaintiff.

What are the new cases about?     

The new IRPA class actions target companies that sell access to online directories or databases – for example, websites that allow users to obtain background checks by searching for a person’s name. A search may yield the person’s name plus some additional information like location or links to social media accounts so that the user can tell that they have the right person. But to see the full report, the user must either pay a fee or buy a subscription to the website. Plaintiffs’ theory is that this – the offer to see more in exchange for payment – is an advertisement using an individual’s identity without written consent and thus violates IRPA.

How can this violate Illinois law?

It is not clear that it does. These cases are an effort to expand the scope of IRPA, similar to the expansive way that Illinois’s Biometric Information Privacy Act (“BIPA”) has been used. Some of the new IRPA class actions were filed by a firm that was very active in BIPA litigation, including the $650 million Facebook BIPA settlement. Unfortunately, there are some striking similarities between IRPA and BIPA:

• Both provide a private right of action
• Both allow plaintiffs to recover $1000 even in the absence of actual damages
• Both allow successful plaintiffs to recover attorney fees.
• Both allow damages to be recovered without any proof of harm or damage to the plaintiff

Under both IRPA and BIPA, all a plaintiff needs to do to recover is prove a violation of the statute – there is no requirement to show malice, intent to harm, or even any harm at all. Given the striking resemblance to BIPA, IRPA is a new pathway for seemingly innocuous, everyday activity to subject companies to potential class action liability. Many companies – indeed, many industries – did not anticipate that the use of fingerprint-based timeclock systems would result in a flood of lawsuits and significant class action liability under BIPA. While IRPA does not yet have the reach and impact of BIPA, IRPA is another under-the-radar statute that could result in significant and unexpected exposure.

What will happen next?

All of these class actions are in the early stages. Benesch attorneys are closely monitoring developments. Meanwhile, clients are encouraged to review their marketing practices for potential IRPA concerns. The Benesch team stands ready to assist with compliance concerns or other questions about IRPA.

For more information, contact Craig Sanders at csanders@beneschlaw.com or 312.624.6332.