A separate claim under Illinois’ Biometric Information Privacy Act (BIPA) accrues each time an entity scans or transmits an individual’s biometric identifier or biometric information, a divided Illinois Supreme Court has ruled in a long-awaited decision. Cothron v. White Castle Systems, Inc., 2023 IL 128004 (Feb. 17, 2023).

Just two weeks after the Illinois Supreme Court issued a ruling on the applicable statute of limitations for claims under BIPA in Tims v. Black Horse Carriers, the Court issued an opinion in Cothron in response to a certified question from the U.S. Court of Appeals for the Seventh Circuit. The Seventh Circuit asked the Illinois Supreme Court to decide: “Do [BIPA] section 15(b) and 15(d) claims accrue each time a private entity scans a person’s biometric identifier and each time a private entity transmits such a scan to a third party, respectively, or only upon the first scan and first transmission?”

Background

Cothron involves claims brought by plaintiff, Latrina Cothron, a manager of a White Castle restaurant, on behalf of a putative class of defendant’s employees who allegedly scanned their fingers to access their paystubs and computers.

Cothron alleged that White Castle unlawfully collected her alleged biometric information and disclosed it to its third-party vendor in violation of sections 15(b) and (d) of BIPA.

White Castle argued that Cothron’s claims were untimely because they accrued when the law went into effect in 2008, more than 10 years before her complaint was filed, and White Castle first allegedly collected her biometric data thereafter. White Castle asserted that claims under sections 15(b) and 15(d) accrue only once, when alleged biometric data is initially collected or disclosed. Cothron argued that a new claim accrued each time she scanned her finger and White Castle allegedly sent her biometric data to its third-party vendor, rendering her action timely with respect to alleged scans and transmissions that occurred within the applicable limitations period.

Court’s Opinion

The Illinois Supreme Court’s majority opinion in Cothron, drafted by the newly elected Justice Elizabeth Rochford, focused on the statutory language of BIPA, rejecting White Castle’s argument that a “collection” or “capture” of biometric data “can happen only once.” Thus, the Court stated in its opinion, “[W]e reject White Castle’s argument that we should limit a claim under section 15 to the first time that a private entity scans or transmits a party’s biometric identified or biometric information.”

Although the certified question in Cothron did not expressly relate to the issue of damages, the Court majority affirmed, “[T]he General Assembly chose to make damages discretionary rather than mandatory under the Act.” It noted that the statute describes the types of damages a “prevailing party may recover.” Further, the majority noted, “[T]here is no language in the Act suggesting legislative intent to authorize a damages award that would result in the financial destruction of a business.” The Court also stated, “[A] trial court presiding over a class action … would certainly possess the discretion to fashion a damage aware that (1) fairly compensated claiming class members and (2) included an amount designed to deter future violations, without destroying defendant’s business.” The majority further stressed that the statutory language makes clear that Illinois legislature chose to make damages discretionary, rather than mandatory, under BIPA.

The majority of the Court also invited the Illinois legislature to address any policy-based concerns about potentially excessive damages awards and “make clear its intent regarding the assessment of damages under the Act.”

The Dissent

In the dissenting opinion, Justice David Overstreet, joined by Chief Justice Mary Jane Theis and Justice Lisa Holder White, was concerned that the majority’s interpretation could not be reconciled with the plain language of the statute, “will lead to consequences that the legislature could not have intended,” and raises concerns about the undue burden placed on employers to comply with the statute.

The dissent agreed with White Castle’s argument on appeal that the plaintiff’s injury under BIPA occurred, if at all, the first time her biometric information was first allegedly collected by White Castle without her consent, not each subsequent time she scanned her finger. It reasoned that there is only “one loss of control or privacy, and this happens when the information is first obtained.”

Further, as a number of amici representing Illinois businesses forewarned, Justice Overstreet expressed concern that the majority’s interpretation of the statute “could easily lead to annihilative liability for business” and argued that “the potential imposition of crippling liability on businesses is a proper consequence to consider.” The dissent reminded that the legislature intended to “ensure the safe use of biometric information, not to discourage its use altogether.”