Are theme parks breaking the law when they ask you to scan your finger when entering a park? Some readers are asking that question after a popular tech website ran a post yesterday with the alarming headline, Six Flags Biometric Case Could Turn One of the Toughest Privacy Laws in the U.S. Upside Down.
Before anyone starts counting their imaginary money from suing Disney World or Universal Studios... chill. One of Robert's rules of the Internet is that the actual importance of a story is inversely proportional to how alarmed you feel by reading the headline. (For another example, the most crap-your-pants terrifying thing posted online in the past week was published under snooze-inducing headline, Fourth National Climate Assessment.)
Here are the facts of the Six Flags case: A 14-year-old got his finger scanned when picking up a Six Flags Great America pass. His mother is now suing, because she said she did not consent to the finger scan. An Illinois law requires that companies collecting biometric information get written approval from the person whose information they collect. The Illinois law does not allow the state to prosecute violations, but instead leaves it to aggrieved parties to sue.
Right off the bat, I question whether the Illinois law can be called "One of the Toughest Privacy Laws in the U.S." if it doesn't allow the state to prosecute violations. That's pretty weak, isn't it? And this case won't have any effect upon Disney, Universal, SeaWorld, Cedar Fair, or any other theme park company that does not operate a property inside the state of Illinois, since it turns on a state law rather than a federal one. Nor will this case affect any adults who give their written permission for Six Flags to scan their finger when picking up a theme park ticket or pass.
The legal question here is whether the mom needs to show that she personally has suffered any harm from her son getting his finger scanned or not. Six Flags says she does have to prove that. The mom says she does not — that the mere fact that Six Flags did not obtain her consent as the guardian of her minor child is a violation of the state law. (Law School 101 here, in case you are wondering: Children cannot sign contracts or give legal consent for anything. Their parents or guardians must do so on their behalf.)
As legal questions go, this is about as narrow as a Six Flags switchback queue. If the woman wins in the Illinois Supreme Court, Six Flags is going to lose some money and require kids to get their parents' written permission to buy tickets in the future. If Six Flags wins, it might be harder for other people to sue over data privacy issues in Illinois, since there would now be a precedent that they have to show that they suffered some harm because a company collected their information without their explicit written consent.
But this case is not going to keep anyone from getting their finger scanned when going to Disney World or other popular theme parks. And its not going to lead to a big payday for theme park fans who have had their finger scanned in the past. But it is keeping Six Flags' lawyers billable hours up, so hey, win for them, right?
Tweet
A wild guess ...... Vortex at Kings Island with the Racer in the background ??
Googling photos now... and I think you are right!
As the resident SFGA person here, I can say that coaster picture is wrong. Too bad as Great America has some pretty good looking coasters.
Strangely enough, I have not heard of this story until now. Robert is right that the headline is a bit more dramatic than the actual (mostly boring) story. I’m not saying the mom’s case has no merit, but I’m not sure if the privacy laws have been tested like this. FWIW, SFGA does give you a fingerprint disclaimer, but it’s more like an Apple user agreement than a closely read document. It will be interesting to see what happens, but I will continue to roll my eyes and do my fingerprint there (and at Disney and Universal).
To think that Great America has some nefarious plot is also a little too flattering to them. It’s an ok park, but they usually sweat the much smaller things than this
Who bought the child’s pass? Six Flags should’ve had it in the info when the pass was bought by the mother that she was giving permission for finger scanning! I’m surprised theatre hadn’t done this already.
KI is my home park and I am pretty sure that that photo isn't the Vortex. The train cars are different and Vortex doesn't have a catwalk like that. Also the track supports of the Vortex are navy blue. Keep looking...
I've always assumed there was something in the terms and conditions you agree to when purchasing the pass regarding the fingerprint scanners. If so, it seems that the mother should have no grounds unless the pass was purchased through a third party, in which case the third party should be the one liable. If not, it's probably an oversight that needs to be corrected by Six Flags, and would likely wind up getting settled out of court. It's not something that should be a big issue, but then again some parents complain about everything (I was once stuck behind a family who argued with Disneyland staff for five minutes over their kid getting their picture taken for a multi-day ticket).
As for the coaster, I'm pretty sure that's Flashback at Six Flags New England under its old color scheme. If not that, it's definitely a Vekoma boomerang and not any coaster at Six Flags Great America (or Kings Island).
I think you nailed it AJ ... great detective work ... :)
In practice, privacy is dead in the US.
Ironically, Disney is GDPR and also operates in Europe. EU citizens could refuse to provide the information or withdraw consent as the finger info is not strictly necessary to provide the theme park experience. Disney cannot decline to provide the service based on refusal to give Disney the finger info.
That said, it really could turn into a decade long fight for millions of dollars to accomplish anything. But, it would be interesting if somebody from Europe here exercised their right to find out what information is collected, how it is processed, and who it is shared with. I am sure Disney would give as bland a response as possible, if they didn’t ignore the request completely.
>>>The legal question here is whether the mom needs to show that she personally has suffered any harm from her son getting his finger scanned or not. Six Flags says she does have to prove that. The mom says she does not — that the mere fact that Six Flags did not obtain her consent as the guardian of her minor child is a violation of the state law. (Law School 101 here, in case you are wondering: Children cannot sign contracts or give legal consent for anything. Their parents or guardians must do so on their behalf.)
Just a bit more in the 101. Typically in a civil suit you to have to prove damages, so unless the statute establishes some statutory damages, the most I would expect a court to do is simply provide injunctive relief (ie - delete the image)
At Universal Orlando, I provide the fingerprint for my 6 y/o's annual pass. Problem solved.
As I understand it, the finger scan by Disney is NOT a fingerprint. It samples about three points as a means to determine if your pass belongs to you. If you stole a pass from someone else, you shouldn't be able to use it. The Magic Bands can provide a lot more information about you than that finger scan. I like both.
mmm, @ 50.90.34.159
November 27, 2018 at 9:57 PM
.....
Disney is, in Europe, not taking fingerprints etc etc.
GDPR breaches would cost them fortunes. Plus, GDPR in the EC is criminal matter.
I thought the fingerprint scanning was to ensure that I am the pass holder. I would think this is a good thing...They do this when I get my driver's license too.
This article has been archived and is no longer accepting comments.
By the way, can anyone identify the coaster in the stock photo on the Gizmodo story? It doesn't look like a SFGrAm coaster to me, but that's not exactly my home park.