What is IRPA?

IRPA was enacted in 1999, replacing the prior common law right of publicity in Illinois.  The main thrust of the statutes is that a person may not use an individual's “identity” for “commercial purposes” during the individual's lifetime without having obtained previous written consent.  “Identity” is defined broadly to mean “any attribute of an individual that serves to identify that individual to an ordinary, reasonable viewer or listener,” which can include a person’s name, signature, image, voice, or other identifying information.  “Commercial purpose” is likewise defined broadly as “the public use of holding out of an individual’s identity (i) on or in connection with the offering for sale of or sale of a product, merchandise, goods, or services; (ii) for purposes of advertising or promoting products, merchandise, goods, or services; or (iii) for the purpose of fundraising.  IRPA marked a departure from the prior common law right of publicity, which required that the plaintiff’s identity had commercial or intrinsic value.  IRPA expressly provides plaintiffs a private right of action, and does not require plaintiffs to prove any actual damages.  Plaintiffs may obtain the greater of actual damages plus profits derived from an unauthorized use or $1,000, as well as attorney fees, costs, and expenses.   

What are the new cases about?     

The new IRPA cases are targeting companies who sell access to online databases of individual names, phone numbers, email addresses, background checks, and similar information.  Plaintiffs’ theory is that when someone searches one of these databases, the search returns a small amount of information plus an offer to gain access to more by making a purchase.  According to the plaintiffs, this is a “commercial use” of an individual’s “identity” under IRPA, and thus requires the plaintiff’s written consent. 

How can this violate Illinois law?

It’s not clear that it does.  These cases are an effort to expand the scope of IRPA, similar to the expansive way that Illinois’s Biometric Information Privacy Act (“BIPA”) has been used.  Some of the new IRPA class actions were filed by a firm that was very active in BIPA litigation, including the $650 million Facebook BIPA settlement.  Unfortunately, there are some striking similarities between IRPA and BIPA:

• Both provide a private right of action
• Both allow plaintiffs to recover $1000 even in the absence of actual damages
• Both allow successful plaintiffs to recover attorney fees
• Both allow damages to be recovered without any proof of harm or damage to the plaintiff

Under both IRPA and BIPA, all a plaintiff needs to do to recover is to prove a violation of the statute – there is no requirement to show malice, intent to harm, or even any harm at all.  Given the striking resemblance to BIPA, IRPA is potentially a new pathway for seemingly innocuous, everyday activity to subject companies to potential class action liability.  Many companies – indeed, many industries – did not anticipate that the use of fingerprint-based timeclock systems would result in a flood of lawsuits and significant class action liability.  While IRPA does not yet have the reach and impact of BIPA, IRPA is another under-the-radar statute that could result in significant and unexpected exposure. 

What will happen next?

All of these class actions are in the very early stages.  Benesch attorneys are closely monitoring developments.  Meanwhile, clients are encouraged to review their marketing practices for potential IRPA concerns.