Illinois Supreme Court Holds a Violation of BIPA Occurs and Accrues with Each Scan
The Illinois Supreme Court recently held in Cothron v. White Castle System, Inc., No. 128004 that a violation of the Illinois Biometric Information Privacy Act (the “Act” or “BIPA”) occurs and accrues every time a scan of a biometric identifier takes place if no proper BIPA policy is in place and/or no proper consent form has been signed. The impact of the decision is substantial for ongoing litigation and potential BIPA claims. Damages associated with violations related to consent or disclosure under BIPA could now be astronomical.
Case Background
In December 2018, Plaintiff, Latrina Cothron, filed a class action lawsuit against her employer, White Castle System, Inc. (White Castle), and its third-party vendor, Cross Match Technologies (Cross Match). In her Complaint, Plaintiff alleged that White Castle violated Sections 15(b) and 15(d) of the Act by implementing a fingerprint biometric-collection system without first obtaining her written consent prior to collection or disclosure of her fingerprint data.
The U.S. Court of Appeals for the Seventh Circuit was asked to determine whether claims accrue under Sections 15(b) and 15(d) of the statute just once – on the first use of the biometric device or first disclosure to a third-party entity – or every single time the device was used by an employee or a disclosure was made. The Seventh Circuit held that this question was more properly decided by the Illinois Supreme Court, and the issue was transferred to that Court. The question certified to the Illinois Supreme Court was: "Do section 15(b) and 15(d) claims accrue each time a private entity scans a person's biometric identifier and each time a private entity transmits such a scan to a third party, respectively, or only upon the first scan and first transmission?"
Illinois Supreme Court Review
In analyzing when claims under Sections 15(b) and 15(d) of the Act accrue, the Illinois Supreme Court began by looking directly at the statutory language. Under Section 15(b), a private entity may only collect an individual’s biometric identifier if it first informs the individual that the biometric identifier is being collected or stored, informs the individual of the purpose of the collection, storage or use, and obtains a written release from the individual to collect the identifier. Under Section 15(d), a private entity may only disclose, redisclose or disseminate an individual’s biometric identifier if the entity has received the individual’s consent to do so.
White Castle argued that the specific language in Section 15(b) – “unless it first” – refers to a single point in time where the notice and consent required under BIPA must occur before the collection of the biometric information. Under Section 15(d), White Castle argued that the first disclosure of the information to another entity would constitute a violation, but not subsequent disclosures to that entity. In opposition, Plaintiff argued that the word “first” in Section 15(b) modifies the words “informs” and “receives” and that an entity violates Section 15(b) whenever it collects, captures of obtains a person’s biometric identifier or information without prior informed consent. Similarly, Plaintiff argued that Section 15(d) prohibits the disclosure, redisclosure, and dissemination of biometric identifiers or information “unless” the disclosing entity receives prior consent for each disclosure, redisclosure or dissemination.
The Illinois Supreme Court held that a violation of Section 15(b) occurred each time an individual’s biometric identifier or information was collected, which occurred with each finger scan. In support of its holding, the Court explained that a biometric scanner scans the individual’s fingerprint each time the individual needs to access paystubs or White Castle’s computers, and this information is then compared to the identifier previously obtained by White Castle.
Under Section 15(d), the Court concluded that a violation also occurs for every transmission of a biometric identifier or biometric information to a third party. The Court explained that the dictionary definitions of “disclosure” and “redisclosure” demonstrate that a disclosure occurs each time an identifier is disseminated, not just the first time. The Court held that “a separate claim accrues under the Act each time a private entity scans or transmits an individual’s biometric identifier or information in violation of Section 15(b) or 15(d).” The Court did attempt to take some of the sting out of its decision, explaining that the award of damages is discretionary rather than mandatory. For this reason, according to the Court, a defendant could ask the judge in the case to reduce the damages awarded to the class under Sections 15(b) and 15(d).
The three dissenting justices agreed with White Castle’s argument that the plaintiff’s injury under BIPA occurred the first time her biometric information was allegedly collected by White Castle without her consent, and expressed concern that the majority’s holding “could easily lead to annihilative liability for business.” The dissent also argued that the majority could have considered “the potential imposition of crippling liability” in its analysis of legislative intent, and that the legislature intended to “ensure the safe use of biometric information, not to discourage its use altogether.”
The Illinois Supreme Court Suggested Legislature Review
The holding in Cothron is extremely concerning when applying it to the total damages to which an entity may be exposed. BIPA allows recovery by an aggrieved individual of $1,000 for a negligent violation of the Act and $5,000 for an intentional or reckless violation of the Act. Based on the Illinois Supreme Court’s holding in Tims v. Black Horse Carriers earlier this year, the statute of limitations is five years. Scanning employee biometric identifiers (like fingerprints) could potentially result in bankruptcy-inducing damages awards for either negligent or intentional/reckless violations of the Act. The Court explicitly noted White Castle’s concern of excessive damage awards based on its holding and respectfully suggested that the Illinois legislature review the Act and make clear its intent regarding the assessment of damages under BIPA.
BIPA is Preempted by the National Labor Relations Act
Shortly after the Cothron case was decided, the Illinois Supreme Court gave some relief to employers whose employees are covered by a collectively bargained agreement. The Court held that the Labor Management Relations Act preempts BIPA. But, understand that for those employers, BIPA would still apply to employees not in the bargaining unit.
If you or your company is seeking more information on BIPA, or assistance ensuring your policies and procedures are compliant with BIPA, please contact your servicing Laner Muchin Attorney.
