The Privacy Class Action Review - 2023 - Report - Page 12
litigants and attorneys as to the scope of the putative classes in their lawsuits.
On February 17, 2023, the Illinois Supreme Court issued its decision in Cothron, et al. v.
White Castle System, Inc., 2023 IL 1280004 (Ill. Feb. 17, 2023), which decided whether
each fingerprint scan is its own discrete violation. In Cothron, et al. v. White Castle
Systems, 2021 U.S. App. LEXIS 37593 (7th Cir. Dec. 20, 2021), the Seventh Circuit
asked the Illinois Supreme Court to provide much-needed clarification on the accrual of
BIPA violations – specifically whether certain BIPA claims accrue only once upon the
initial collection or disclosure of biometric information or whether a claim accrues each
time a company collects or discloses biometric information. The Illinois Supreme Court
held that a separate claim for damages accrues under the BIPA each time a private
entity scans or transmits an individual’s biometric identifier or information, in violation of
§§ 15(b) or 15(d). This ruling could exponentially increase monetary damages in BIPA
class actions, especially in the employment context, where employees scan in and out
of work multiple times per day for over 200 workdays days per year.
Sections II(A) and II(B) of the Review provide a “deep dive” analysis of the Illinois
Supreme Court’s landmark rulings in Tims and Cothron.
The Tims and Cothron rulings eviscerated two of the key BIPA defenses. However, the
well is not dry for BIPA defendants. Some of the remaining potential defenses include:
(i) whether biometric data was actually collected, used, or stored; (ii) whether
exemptions apply, such as the exemption involving healthcare workers; (iii) whether and
to what extent alleged violations occurred in Illinois for purposes of satisfying
extraterritoriality limitations; and (iv) the Constitutionality of the excessive damages that
will result from finding each separate scan is a violation; and (v) Rule 23(b)(3)
arguments regarding whether class actions are the appropriate vehicle to litigate BIPA
disputes.
While many cases were stayed during the pendency of Tims and Cothron, and those
stays of litigation will likely be lifted in the next 60 days, courts will soon have to weigh in
on the new arsenal of BIPA defenses that are on the horizon.
In the meantime, if employers have not already done so, now is time to make sure their
timekeeping procedures and consent policies are legally compliant. The Tims and
Cothron rulings are apt to increase the appetite of the plaintiffs’ class action bar for
prosecuting BIPA claims, so it is more important than ever for employers to make sure
their procedures are legally sound.
B.
Class Action Suits Alleging Wiretapping Violations
A new wave of class action lawsuits filed in California, Florida, Massachusetts, and
Pennsylvania targeted companies that use technologies to track user activity on their
websites, based on the theory that such practices violate electronic interception
provisions of various state laws when done without consent.
11
© Duane Morris LLP 2023
Duane Morris Privacy Class Action Review – 2023
