The Illinois Supreme Court has ruled that separate claims under the state’s Biometric Information Privacy Act (BIPA) accrue “with every scan or transmission” of a person’s biometric information—rejecting the idea that only a single claim accrues at the start of a series of similar scans or disclosures.
The decision, Cothron v. White Castle, substantially increases potential damages exposure for BIPA defendants. The potential for large monetary awards is likely to spur more BIPA lawsuits in Illinois—and potentially beyond, as several other States have similar privacy laws taking effect in 2023. At the same time, however, Cothron establishes that trial courts have discretion to determine the appropriate amount of statutory damages (subject to a $5,000-per-violation cap), and suggests that it would be an abuse of discretion for a trial court to permit such a sizeable award that a company’s financial viability would be threatened.
The Cothron plaintiff, a manager of a White Castle restaurant in Illinois, alleged that White Castle required her to scan her fingerprint to access her work computer and pay stubs between 2008 and 2018. The fingerprint scans were allegedly sent to a third-party authenticator, which compared the fingerprint scan to an existing print in a database for identity-verification purposes.
Plaintiff sued White Castle in the Northern District of Illinois, alleging that each fingerprint scan over this ten-year period violated BIPA, and sought to represent a class comprised of all similarly situated White Castle employees in Illinois.
BIPA’s Section 15(b) generally prohibits private entities from collecting a person’s biometric information without informed written consent. Section 15(d) similarly prohibits nonconsensual transmission of biometric information to third parties. Significantly, BIPA authorizes liquidated damages awards of up to $5,000 for “each violation” of the statute—although the precise amount a particular plaintiff class may be entitled to, Cothron explains, is a matter of judicial discretion.
White Castle moved for judgment on the pleadings, arguing that plaintiff had a single claim for a BIPA violation that accrued upon the first fingerprint scan in 2008—meaning the five-year limitations period had long since run. Plaintiff responded that she in fact had numerous BIPA claims—as every fingerprint scan, including those occurring as late as 2018, constituted a separate BIPA violation, many of which remained timely.
The district court sided with plaintiff, but certified the accrual question for interlocutory appeal to the Seventh Circuit. The Seventh Circuit, in turn, certified the issue to the Illinois Supreme Court, which chose to answer the question.
The Illinois Supreme Court ruled that BIPA claims under Sections 15(b) and 15(d) accrue each time—not just the first time—a private entity scans or transmits a person’s biometric information. Focused on the statutory text, the Court rejected White Castle’s suggestion that “collection” for purposes of Section 15(b) “can happen only once”; if a similar mechanism is used to repeatedly scan a person’s biometric information over time, that person’s biometric information is “collected” after each scan. The Court similarly reasoned that a separate “transmission” under Section 15(d) occurs each time biometric data is disclosed to a third party.
The dissent criticized this reading of BIPA as likely to lead to absurd results—namely, outsized damages awards potentially totaling billions of dollars against defendants with serialized biometric collection practices and thousands of employees. The majority acknowledged the concern, but explained that trial courts have discretion under BIPA to fashion total damages awards that are less than the maximum permitted by statute, and cautioned that it would be contrary to “legislative intent to authorize a damages award that would result in the financial destruction of a business.” The Court also invited the Illinois legislature “to review” the dissent’s concerns about large monetary awards and to amend BIPA if the Court’s reading of the statutory text did not align with legislative intent.
The Illinois Supreme Court’s opinion is available here.