The landscape of biometric privacy just became both more settled and unsettling for companies using biometrics. On February 17, 2023, the Illinois Supreme Court held that each scan or transmission of a person’s biometric identifiers is a separate violation of Illinois' Biometric Information Privacy Act (BIPA).

BIPA provides that a party may not, without consent, “collect, capture, purchase, receive through trade, or otherwise obtain” a biometric identifier. Further, a party may not “disclose, redisclose, or otherwise disseminate” a biometric identifier or biometric information without consent. Biometric identifiers include fingerprints and face or retinal scans; biometric information is any information based on a biometric identifier.

In Cothron v. White Castle System, Inc., 2023 IL 128004, the plaintiff was an employee at a White Castle restaurant. She alleged that White Castle, without obtaining the statutorily mandated consent, required her to scan her fingerprint multiple times each day to access company systems. The plaintiff argued that each scan since BIPA’s enactment in 2008 was a separate violation. White Castle argued that if any violation occurred, it was a single violation in 2008, when it first collected her fingerprints without obtaining proper consent. Thereafter, White Castle argued, each new scan was not a new “collection” of her fingerprints. By a 4-3 majority, the court agreed with the plaintiff that each scan was a separate violation.

While the court’s decision was in the context of applying the statute of limitations, its major consequence is expanding the damages available to plaintiffs. BIPA provides $1,000 as liquidated damages for each negligent violation and $5,000 for a willful violation. If each scan is a separate violation, then damages can become astronomical. For example, if an employee scans in/out at the start and end of the workday, BIPA damages would be $2,000 per day, per employee, possibly stretching back over a five-year period. White Castle estimated that the damages awardable to the 9,000-person class would be $17 billion (yes, you read that right).

The court's majority stated that it was for the legislature to address these potentially business-annihilating penalties. They further indicated, however, that courts have some discretion to avoid imposing damages that would “result in the financial destruction of a business.” 

Employers and others using biometric identifiers in Illinois should be auditing their use of biometrics and whether they have proof of compliance with BIPA’s mandatory notice, consent and policy adoption requirements.