The Illinois Supreme Court upheld cause of action provisions of a 2008 state law on Friday that requires companies who collect a person’s biometric information such as fingerprints, retina scans or face matching, to obtain consent and inform a person how it will be stored, used and shared.

The unanimous ruling stems from a mom, Rosenbach, who sued Six Flags Amusement Park when they collected thumbprint information upon season pass purchase without her son’s consent or notice.

The court of appeals initially found that there had been no “actual injury or adverse effect” beyond his or her rights under the statute violated, which the Illinois Supreme Court reversed.

The court said in its opinion:

It is clear that [Six Flags’] challenge to Rosenbach’s right to bring suit on behalf of her son is meritless… when a private entity fails to comply with one of [the Act’s] requirements, that violation constitutes an invasion, impairment, or denial of the statutory rights of any person …or customer whose biometric identifier or biometric information is subject to the breach…No additional consequences need be pleaded or proved. The violation, in itself, is sufficient to support the individual’s or customer’s statutory cause of action.