On February 17, 2023, the Illinois Supreme Court decided, by a 4-3 vote, that each time a private entity scans or transmits an individual’s biometric information without complying with Illinois Biometric Information Privacy Act (BIPA), that constitutes a separate violation under BIPA. (Cothron v. White Castle System, Inc., 2023 IL 128004 (Ill. Feb. 17 2023).) The result means defendants are facing staggering damages in BIPA suits.
The case was referred to the Illinois Supreme Court by the federal appeals court (Seventh Circuit) where a question under the Illinois law arose. Consequently, Illinois state courts had not issued rulings in this lawsuit, but instead the Seventh Circuit asked the Illinois Supreme Court to construe the law based upon the information provided to it by the Seventh Circuit.
The plaintiff in this case is a manager of a White Castle restaurant in Illinois, since 2004. In 2008 (the same year BIPA went into effect), the restaurant implemented a system that required employees to scan their fingerprints in order to access their pay stubs and their computers. White Castle engaged a third party to verify each scan and the employee’s access. The plaintiff claimed that White Castle did not seek her consent for the collection of her biometric information, or its disclosure to a third party, until 2018—ten years later. The plaintiff filed a class-action lawsuit.
BIPA requires that a private entity may not collect or capture a person’s biometric information unless it first provides notice and obtains the individual’s consent. BIPA also prohibits the private entity from disclosing, redisclosing or otherwise disseminating the biometric information without individual consent. 740 ILCS 14/15(b) & 15(d). BIPA provides for statutory damages: a plaintiff may recover $1,000 for a negligent violation and $5,000 for an intentional or reckless violation. 740 ILCS 14/20.
White Castle moved to dismiss the claim based on the statute of limitations: the plaintiff’s claim arose once, in 2008. The plaintiff argued that a claim arose each time she scanned her fingerprint and White Castle disclosed it to the third party without complying with BIPA, so her claim was within the statute of limitations.
The trial court agreed with the plaintiff, but certified an immediate appeal to the Seventh Circuit, which certified the question of when a claim accrues under BIPA to the Illinois Supreme Court.
The majority found that, for purposes of BIPA, White Castle “obtained” the plaintiff’s fingerprint each time she scanned it. The majority also ruled that BIPA applies to each transmission of that biometric information.
The majority also addressed concerns raised in the amicus curie briefs that this ruling would lead to “astronomical” damages. Although the court concluded that such concerns are best addressed to the legislature, the majority in paragraph 42 pointed out:
“we generally agree with our appellate court’s recognition that “[a] trial court presiding over a class action—a creature of equity—would certainly possess the discretion to fashion a damage award that (1) fairly compensated claiming class members and (2) included an amount designed to deter future violations, without destroying defendant’s business.” It also appears that the General Assembly chose to make damages discretionary rather than mandatory under the Act.”
(Citations omitted)
The dissent took the position that a BIPA claim accrued upon the first scan or transmission.
