privacy

Subscribe to privacy

The Illinois Supreme Court has ruled that separate claims under the state’s Biometric Information Privacy Act (BIPA) accrue “with every scan or transmission” of a person’s biometric information—rejecting the idea that only a single claim accrues at the start of a series of similar scans or disclosures.

The decision, Cothron v. White Castle, substantially increases potential damages exposure for BIPA defendants.  The potential for large monetary awards is likely to spur more BIPA lawsuits in Illinois—and potentially beyond, as several other States have similar privacy laws taking effect in 2023.  At the same time, however, Cothron establishes that trial courts have discretion to determine the appropriate amount of statutory damages (subject to a $5,000-per-violation cap), and suggests that it would be an abuse of discretion for a trial court to permit such a sizeable award that a company’s financial viability would be threatened. …

Continue Reading New BIPA Claims Accrue “With Every Scan or Transmission” of Biometric Information, Says the Illinois Supreme Court  

The Illinois Supreme Court recently held that all claims brought under the Biometric Information Privacy Act (“BIPA”) are subject to a five-year statute of limitations, partly overturning a lower court decision that had applied a one-year limitations period to some claims brought under the law.  See Tims v. Black Horse Carriers, Inc., 2023 IL 127801 (Feb. 2, 2023).

The plaintiff, Jorome Tims, filed a putative class action against his former employer, alleging that the trucking and logistics company violated BIPA by requiring its employees to use a time clock with a fingerprint scanner without (i) implementing a publicly available data retention and destruction policy; (ii) notifying employees and obtaining their consent when collecting their biometrics; and (iii) obtaining employee consent before disclosing their biometric information to third parties.  The defendant moved to dismiss the complaint, arguing that the plaintiff’s claims were barred by the one-year statute of limitations under the Illinois Code of Civil Procedure that governs actions for the “publication of matter[s] violating the right of privacy.”…

Continue Reading Illinois Supreme Court Holds Five-Year Statute of Limitations Applies to All Claims under BIPA

A U.S. District Court Judge in California dismissed a putative class action asserting claims under section 637.7 of the California Invasion of Privacy Act (CIPA) in a case that could have useful implications for automotive and other device manufacturers whose products have the ability to track location.  Plaintiff claimed that a third-party company, Otonomo Inc., partnered with automobile manufacturers to use the telematics control units (TCUs) installed in their vehicles to track a driver’s location via GPS without the driver’s knowledge.  The Court rejected the claim, holding that because the TCU devices were built-in, rather than devices added to a vehicle, they were not “attached” to the car and thus did not fall within the statute’s definition of “electronic tracking device.”…

Continue Reading Class Action Suit Brought Under CIPA Section 637.7 for Alleged Location-Based Tracking of Vehicles Is Dismissed

The Ninth Circuit recently held that the Children’s Online Privacy Protection Act, which gives the Federal Trade Commission  authority to regulate the online collection of personal information from children under the age of 13, does not preempt consistent state law, potentially increasing the risk of class action litigation based on alleged COPPA violations.  See Jones …

An Alabama district court recently granted dismissal of a class action asserting Illinois Biometric Information Privacy Act (“BIPA”) claims brought by Illinois residents against ProctorU, Inc. in Thakkar v. ProctorU Inc., No. 2:21-cv-01565 (N.D. Ala.).  The district court concluded that a choice-of-law provision contained in the terms of service and which required the application of Alabama law precluded the application of BIPA to the conduct alleged.…

Continue Reading Alabama Federal Court Finds Choice-of-Law Provision Bars BIPA Privacy Lawsuit Against Online Examination Company

Following a week-long trial, a jury in Illinois awarded a plaintiff class of truck drivers a $228 million verdict against BNSF Railways for violations of the Illinois Biometric Information Privacy Act (“BIPA”).  The large verdict, arising from the first case to go to trial under the 2008 law, highlights the potential impact of class actions brought under this statute.…

Continue Reading Illinois BIPA jury verdict highlights rising prominence of class actions based on state privacy statutes

The Eleventh Circuit, sitting en banc, recently applied TransUnion to hold that a plaintiff lacked Article III standing to bring claims under the Fair Debt Collection Practices Act.  Hunstein v. Preferred Collection & Mgmt. Servs., Inc., No. 19-14434, 2022 WL 4102824 (11th Cir. Sept. 8, 2022)(en banc).  The en banc decision reversed a controversial panel decision allowing a plaintiff to sue a collection agency for disclosing information about his debt to the agency’s mail vendor.…

Continue Reading Eleventh Circuit, Sitting En Banc, Reverses Panel Decision And Holds FDCPA Plaintiff Lacks Standing

Last week the Third Circuit reversed a summary judgment ruling in favor of Harriet Carter Gifts and NaviStone for alleged violations of Pennsylvania’s Wiretapping and Electronic Surveillance Control Act, or WESCA.  See Popa v. Harriet Carter Gifts, Inc., Case No. 21-2203, 2022 WL 3366425 (3rd Cir. Aug. 16, 2022). This lawsuit is one of many recent putative class actions attempting to apply decades-old wiretapping laws against websites and their service providers.  The named plaintiff is a consumer that allegedly shopped on Harriet Carter Gifts’ website while NaviStone’s marketing software was installed on the website.  Plaintiff argued that defendants violated WESCA by simultaneously sending her interactions with Harriet Carter’s website to NaviStone.…

Continue Reading Third Circuit Revives Wiretapping Claims Against Marketing Software Company

The Northern District of California denied class certification in a data breach suit against Zoosk, an online dating service, concluding that the lead plaintiff had waived any right to represent a class by agreeing to a class-action waiver.  See Order Denying Class Certification, Flores-Mendez v. Zoosk, Inc., No. 3:20-04929-WHA (N.D. Cal. July 27, 2022).…

Continue Reading Class Certification Denied in Data Breach Class Action Based on Class-Action Waiver in Terms of Service

On July 21, the federal district court denied remand of a proposed class action against Build-A-Bear Workshop, Inc., rejecting the plaintiff’s attempt to remand based merely on Build-A-Bear raising lack of standing as an affirmative defense in its answer.  See Order Denying Motion to Remand, Ruby v. Build-A-Bear Workshop, Inc., No. 4:21-cv-01152-JAR (E.D. Mo. July 21, 2022).…

Continue Reading Court Denies Motion to Remand Build-A-Bear TCPA Suit When Standing Raised as an Affirmative Defense