{"id":348,"date":"2023-02-17T13:07:04","date_gmt":"2023-02-17T17:07:04","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=348"},"modified":"2023-02-17T15:30:09","modified_gmt":"2023-02-17T19:30:09","slug":"illinois-supreme-court-holds-each-fingerprint-scan-is-a-separate-bipa-violation-thereby-creating-the-potential-for-increased-damages-in-privacy-class-actions","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2023\/02\/17\/illinois-supreme-court-holds-each-fingerprint-scan-is-a-separate-bipa-violation-thereby-creating-the-potential-for-increased-damages-in-privacy-class-actions\/","title":{"rendered":"Illinois Supreme Court Holds Each Fingerprint Scan Is A Separate BIPA Violation \u2013 Thereby Creating The Potential For Increased Damages In Privacy Class Actions"},"content":{"rendered":"

\"\"<\/a>By Gerald L. Maatman, Jr., Alex W. Karasik, Tyler Z. Zmick, and Jennifer A. Riley<\/p>\n

Duane Morris Takeaways:\u00a0 <\/em><\/strong>In the latest ruling in Illinois in the biometric privacy class action space, the Illinois Supreme Court decided<\/a> today in Cothron v. White Castle<\/em>, 2023 IL 128004 (Ill. Feb. 17, 2023), that a separate claim for damages accrues under the Biometric Information Privacy Act (\u201cBIPA\u201d) each time a private entity scans or transmits an individual\u2019s biometric identifier or information, in violation of section 15(b) or 15(d).<\/p>\n

This ruling could exponentially increase monetary damages in class actions brought under the BIPA, especially in the employment context, where employees scan in and out of work multiple times per day for several hundred days per year.<\/p>\n

Case Background<\/strong><\/p>\n

Plaintiff alleged that after she started working at White Castle in 2004, the company required her to use a fingerprint-based system to access the workplace computer she used in her position as a manager.\u00a0 Plaintiff sued White Castle several years later in 2018, alleging that the company violated Sections 15(b) and 15(d) of the BIPA in connection with the fingerprint-based system by (i) collecting her biometric data without providing her with the requisite notice and obtaining her written consent, and (ii) disclosing her biometric data without consent.<\/p>\n

After removing the complaint to the U.S. District Court for the Northern District of Illinois, White Castle moved for judgment on the pleadings on the basis that Plaintiff\u2019s claims were untimely.\u00a0 Specifically, White Castle argued that Plaintiff\u2019s BIPA claims accrued in 2008 (when her first fingerprint scan occurred after the BIPA took effect), yet she did not file her complaint until 2018.\u00a0\u00a0The District Court rejected White Castle\u2019s one-time-only theory of claim accrual, holding that the lawsuit was timely because each separate unauthorized fingerprint scan constituted an independent violation of the statute, meaning Plaintiff\u2019s BIPA claims were timely because her last<\/em> fingerprint scan occurred within five years of the filing of her complaint.\u00a0 Because the issue presented a close call, however, the District Court permitted White Castle to file an interlocutory appeal with the Seventh Circuit regarding whether Section 15(b) and 15(d) claims accrue each time a private entity scans a person\u2019s biometric identifier and each time a private entity transmits a scan to a third party, respectively, or only upon the first scan and first transmission.<\/p>\n

The U.S. Court of Appeals for the Seventh Circuit accepted the interlocutory appeal. Id.<\/em> \u00b6 9. After determining that Plaintiff had standing to bring her action in federal court under Article III of the U.S. Constitution, the Seventh Circuit addressed the parties\u2019 respective arguments on the accrual of a claim under the Act.\u00a0 Id.<\/em>\u00a0 Ultimately, the Seventh Circuit found the parties\u2019 competing interpretations of claim accrual reasonable under Illinois law, and it agreed with Plaintiff that \u201cthe novelty and uncertainty of the claim-accrual question\u201d warranted certification of the question to the Illinois Supreme Court.\u00a0 Id.<\/em> at 1165-66.\u00a0 The Seventh Circuit \u201cobserved that the answer to the claim-accrual question would determine the outcome of the parties\u2019 dispute, this court could potentially side with either party on the question, the question was likely to recur, and it involved a unique Illinois statute regularly applied by federal courts.\u201d\u00a0 Id.<\/em>.<\/p>\n

The Illinois Supreme Court\u2019s Decision<\/strong><\/p>\n

In a 4-3 split ruling, the Illinois Supreme Court held today that that a separate claim accrues under the BIPA each time a private entity scans or transmits an individual\u2019s biometric identifier or information, in violation of section 15(b) or 15(d).\u00a0 First, the Illinois Supreme Court analyzed the certified question with respect to Section 15(b), which provides that no private entity \u201cmay collect, capture, purchase, receive through trade, or otherwise obtain\u201d a person\u2019s biometric data unless it first provides notice and receives written consent.\u00a0 740 ILCS 14\/15(b).\u00a0 Relying on the plain language of the statute and the fact that the actions of \u201ccollecting\u201d and \u201ccapturing\u201d biometric data can occur more than once, the Supreme Court agreed with Plaintiff\u2019s interpretation \u2013 namely, that Section 15(b) \u201capplies to every instance when a private entity collects biometric information without prior consent.\u201d\u00a0 Id.<\/em> \u00b6\u00b6 19, 23.\u00a0 As interpreted in the context of the facts of the case, the Supreme Court further observed that White Castle obtains an employee\u2019s fingerprint, stores it in its database, and then compares the fingerprint taken during subsequent scans to verify the identity of the employee.\u00a0 In the Supreme Court\u2019s words, White Castle \u201cfails to explain how such a system could work without collecting or capturing the fingerprint every time the employee needs to access his or her computer or pay stub.\u201d\u00a0 Id. \u00b6 23.\u00a0 Accordingly, \u00a0consistent with the District Court\u2019s decision in Cothron<\/em> and the Illinois Appellate Court\u2019s conclusion in Watson<\/em>, 2021 IL App (1st) 210279, \u00b6 46, the Illinois Supreme Court held that an entity violates Section 15(b) the first time it collects biometric data without having provided the requisite notice and obtaining consent, in addition to \u201ceach subsequent scan or collection.\u201d\u00a0 Id.<\/em> \u00b6 24.<\/p>\n

Next, closely tracking its analysis of Section 15(b), the Supreme Court similarly held that BIPA Section 15(d) \u2013 which prohibits the disclosure, redisclosure, or dissemination of biometric data without consent \u2013 \u201capplies to every transmission to a third party.\u201d\u00a0 Id.<\/em> \u00b6 28. Like the verbs \u201ccollect\u201d and \u201ccapture\u201d in Section 15(b), the acts of disclosing and redisclosing biometric data occur upon the initial disclosure in addition to<\/em><\/strong> any subsequent disclosure or redisclosure of the data.\u00a0 See id.<\/em> \u00b6 29 (\u201cA fingerprint scan system requires a person to expose his or her fingerprint to the system so that the print may be compared with the stored copy, and this happens each time a person uses the system.\u201d).<\/p>\n

The majority opinion also rejected White Castle\u2019s remaining \u201cnontextual\u201d arguments supporting its single-accrual interpretation.\u00a0 White Castle argued that a BIPA claim accrued only upon the initial collection or disclosure of a person\u2019s biometric data because an individual loses the right to control his or her biometric data as soon as the data is collected and\/or disclosed.\u00a0 In rejecting the argument, the Supreme Court again relied on the statute\u2019s plain language, stating: \u201c[n]o such limitation appears in the statute.\u00a0 We cannot rewrite a statute to create new elements or limitations not included by the legislature.\u201d\u00a0 Id<\/em>. \u00b6 39.<\/p>\n

Next, the Supreme Court turned to White Castle\u2019s argument that in light of the BIPA\u2019s liquidated damages provision, interpreting the statute to mean an entity violates Sections 15(b) and 15(d) every time it collects or discloses biometric data means \u201ca party may recover for \u201ceach violation,\u201d allowing multiple or repeated accruals of claims by one individual could potentially result in punitive and \u201castronomical\u201d damage awards that would constitute \u201cannihilative liability\u201d not contemplated by the legislature and possibly be unconstitutional.\u201d\u00a0 Id. \u00b6 41. \u00a0For example, White Castle estimated that if Plaintiff was successful and allowed to bring her claims on behalf of as many as 9,500 current and former White Castle employees, classwide damages in her action may exceed $17 billion.\u00a0 Once again, the Supreme Court rejected White Castle\u2019s argument because the statutory language is clear and supports plaintiff\u2019s position.\u00a0 See id<\/em>. \u00b6 40 (\u201cAs the district court observed, this court has repeatedly held that, where statutory language is clear, it must be given effect, \u201c \u2018even though the consequences may be harsh, unjust, absurd or unwise.\u2019 \u201d (Emphasis omitted.) Cothron<\/em>, 477 F. Supp. 3d at 734 (quoting Peterson v. Wallach<\/em>, 198 Ill. 2d 439, 447 (2002)).\u201d).<\/p>\n

Importantly, however, the Supreme Court acknowledged that trial courts could exercise their discretion to reduce the amount of statutory damages that plaintiffs can recover. Id<\/em>. \u00b6 42.\u00a0 In closing, the Supreme Court reiterated the position that White Castle\u2019s \u201cpolicy-based concerns about potentially excessive damage awards under the Act are best addressed by the legislature,\u201d and it \u201csuggest[ed] that the legislature review these policy concerns and make clear its intent regarding the assessment of damages under the Act.\u201d\u00a0 Id<\/em>. \u00b6 43.\u00a0 Accordingly, the Illinois Supreme Court concluded that the plain language of section 15(b) and 15(d) shows that a claim accrues under the BIPA with every scan or transmission of biometric identifiers or biometric information without prior informed consent.<\/p>\n

The Dissent<\/strong><\/p>\n

Notably, three Illinois Supreme Court Justices, inclusive Chief Justice Theis, joined the Dissenting Opinion.\u00a0 Of note, the Dissent opined that two significant consequences militate against the majority\u2019s construction.\u00a0 Id<\/em>. \u00b6 60.\u00a0 First, under the majority\u2019s rule, plaintiffs would be incentivized to delay bringing their claims as long as possible, since \u201cIf every scan is a separate, actionable violation, qualifying for an award of liquidated damages, then it is in a plaintiff\u2019s interest to delay bringing suit as long as possible to keep racking up damages.\u201d\u00a0 Id. <\/em>\u00a0Second, the Dissent noted that, \u201cthe majority\u2019s construction of the Act could easily lead to annihilative liability for businesses.\u201d\u00a0 Id. <\/em>at \u00b6 61.<\/p>\n

In sum, the Dissent commented that, \u201cImposing punitive, crippling liability on businesses could not have been a goal of the Act, nor did the legislature intend to impose damages wildly exceeding any remotely reasonable estimate of harm.\u00a0 Id<\/em>. \u00b6 63. \u00a0To this point, the Dissent opined that, \u201cnothing in the Act indicating that the legislature intended to impose cumbersome requirements or punitive, crippling liability on corporations for multiple authentication scans of the same biometric identifier. The legislature\u2019s intent was to ensure the safe use of biometric information, not to discourage its use altogether.\u201d<\/p>\n

Implications For Employers<\/strong><\/p>\n

Following the Illinois Supreme Court\u2019s similar pro-plaintiff ruling in Tims v. Black Horse Carriers<\/em>, 2023 IL 127801 (Ill. Feb. 2, 2023), which applied a five-year statute of limitations to the BIPA instead of a one-year statute of limitations, the well is beginning to dry for businesses in terms of potential BIPA class action defenses. While employers can still explore novel exemptions, such as information captured from a patient in a health care setting, most companies caught in the crosshairs of BIPA class actions will be facing monumental amounts of potential damages.<\/p>\n

Businesses confronted with BIPA class actions may need to explore alternative potential defenses, such as the constitutionality of the overbearing damages thresholds.\u00a0 Companies will also likely push for legislative changes.\u00a0 Nonetheless, given the bleak outlook of the law as it stands, it is imperative for businesses to immediately ensure they are compliant with the BIPA.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr., Alex W. Karasik, Tyler Z. Zmick, and Jennifer A. Riley Duane Morris Takeaways:\u00a0 In the latest ruling in Illinois in the biometric privacy class action space, the Illinois Supreme Court decided today in Cothron v. White Castle, 2023 IL 128004 (Ill. Feb. 17, 2023), that a separate claim for damages … <\/p>\n

Continue reading “Illinois Supreme Court Holds Each Fingerprint Scan Is A Separate BIPA Violation \u2013 Thereby Creating The Potential For Increased Damages In Privacy Class Actions”<\/span><\/a><\/p>\n","protected":false},"author":575,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[59],"tags":[],"ppma_author":[7,22,12,9],"class_list":["post-348","post","type-post","status-publish","format-standard","hentry","category-privacy-class-actions"],"authors":[{"term_id":7,"user_id":575,"is_guest":0,"slug":"gmaatman","display_name":"Gerald L. Maatman, Jr.","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/maatmangerald-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":22,"user_id":582,"is_guest":0,"slug":"awkarasik","display_name":"Alex W. Karasik","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2023\/08\/karasikalex-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":12,"user_id":578,"is_guest":0,"slug":"tzzmick","display_name":"Tyler Z. Zmick","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/zmicktyler-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":9,"user_id":576,"is_guest":0,"slug":"jariley","display_name":"Jennifer A. Riley","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2023\/08\/rileyjennifer-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/348","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/575"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=348"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/348\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=348"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=348"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=348"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=348"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}