An individual suing under Illinois’ Biometric Privacy Act (BIPA) does not need to allege an actual injury beyond a violation of rights under BIPA to pursue an action for liquidated damages and injunctive relief, the Illinois Supreme Court held in its most recent BIPA decision, Rosenbach v. Six Flags Entertainment Corp. In this article, with insight from legal experts, we discuss the expansive view of statutory standing this decision takes, the implications of the decision and what companies can do to mitigate risk when using biometric information. See also “Biometric Data Protection Laws and Litigation Strategies (Part One of Two)” (Jan. 31, 2018); Part Two (Feb. 14, 2018).