In a highly anticipated decision issued in February 2023, the Illinois Supreme Court held that a separate claim accrues under the Illinois Biometric Information Privacy Act (“BIPA” or the “Act”) (740 ILCS 14/1 et seq.) each and every time biometric data or information is collected, scanned and/or disclosed.  Defendant White Castle System, Inc. (“White Castle”) filed a petition for rehearing, seeking to overturn the Cothron decision.  On July 18, 2023, the Illinois Supreme Court denied White Castle’s petition and left in place a standard that is likely to have a profound impact on the valuation of BIPA claims.   

While the Illinois Supreme Court’s most recent decision in Cothron is not surprising, it further emphasizes the potential crippling effect that BIPA judgments may have on companies doing business in Illinois.  In that respect, the Cothron decision reverts to a pattern of decisions that favor BIPA plaintiffs, with an outsized focus now on the new jury trial in the Rogers v. BNSF Railway Co. case.  Earlier article available here.

The Cothron v. White Castle Decision  

Following a circuitous path through various Illinois state and federal courts, the Illinois Supreme Court ultimately agreed to address the following certified question in the Cothron case:

• “Do Section 15(b) and 15(d) claims accrue each time a private entity scans a person’s biometric identifier and each time a private entity transmits such a scan to a third party, respectively, or only upon the first scan and first transmission?”

Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1167 (7th Cir. 2021).  In a 4-3 decision, the Illinois Supreme Court found “that a separate claim accrues under the Act each time a private entity scans or transmits an individual’s biometric identifier or information in violation of section 15(b) or 15(d).”  Cothron v. White Castle Sys., Inc., 2023 IL 128004, ¶ 1.    

For a detailed analysis of the Cothron case, please see our earlier article.

The Denial of the Petition for Rehearing

On July 18, 2023, the court denied White Castle’s petition for rehearing and upheld the standard that BIPA claims accrue upon each scan or transmission.  In rejecting White Castle’s petition, the majority did not offer any new analysis and instead rested on the court’s prior ruling. 

However, in a fiery dissent by Justice Overstreet (joined by Chief Justice Theis and Justice White), the minority opined that the per-scan interpretation of accrual under BIPA “subverted the intent of the Illinois General Assembly, threatens the survival of businesses in Illinois and consequently raises significant constitutional due process concerns.”  Turning first to the intent of the General Assembly, the dissent stated that the Act was intended “to be a remedial statute that implemented prophylactic measures[.]”  As such, the dissent seriously questioned the ruling of the majority which, according to the dissent, necessitates a finding that the “legislature intended for Illinois businesses to be subject to cataclysmic, job-killing damages, potentially up to billions of dollars, for violations of the Act.” 

The dissent further noted that the possibility of “exorbitant damages awards” raise significant Constitutional due process concerns due to a possible lack of “any connection between potential damages and actual monetary injury sustained.”  Finally, the dissent raised practical concerns regarding the lack of guidance provided to trial courts as to how to interpret the Cothron decision’s statement that it “appears” the General Assembly made “damages discretionary rather than mandatory under the Act.”  Cothron, 2023 IL 128004, ¶ 42.  As noted by the Dissent, “[w]ithout any guidance regarding the standard for setting damages, defendants, in class actions especially, remain unable to assess their realistic potential exposure.”                           

How the Most Recent Cothron Decision Impacts Your Business

The denial of the petition in Cothron is likely to have at least one immediate consequence—it will likely trigger the resumption of numerous BIPA cases throughout Illinois which were stayed while the Illinois Supreme Court considered the petition.  Looking beyond this procedural consequence, the possibility of constitutional challenges to the unclear damages scheme under BIPA create additional uncertainty for BIPA defendants attempting to evaluate their exposure under the Act.  Moreover, it remains unclear how trial courts will exercise their “discretion” in awarding damages in future BIPA cases.  As noted in our earlier article, the court in Rogers recently vacated its damages award in favor of a damages-only retrial and discretionary finding by the jury as to the amount of damages for 45,600 reckless or intentional BIPA violations. 

The Cothron decision highlights the need for every business to analyze its practices and procedures—including employee timekeeping, identification procedures or security protocols—in order to assess potential exposure under the Act.  Despite the existing uncertainty, significant potential exposure remains a possibility for any business which faces accusations of non-compliance with BIPA.