The Privacy Class Action Review - 2023 - Report - Page 22
B.
Illinois Supreme Court Holds Each Scan Is A Separate BIPA Violation
The Illinois Supreme Court decided in Cothron v. White Castle, 2023 IL 128004 (Ill. Feb.
17, 2023), that a separate claim for damages accrues under the Biometric Information
Privacy Act (“BIPA”) each time a private entity scans or transmits an individual’s
biometric identifier or information, in violation of § 15(b) or 15(d).
This ruling could exponentially increase monetary damages in class actions brought
under the BIPA, especially in the employment context, where employees scan in and
out of work multiple times per day for several hundred days per year.
The plaintiff alleged that after she started working at White Castle in 2004, the company
required her to use a fingerprint-based system to access the workplace computer she
used in her position as a manager. The plaintiff sued White Castle several years later in
2018, alleging that the company violated §§ 15(b) and 15(d) of the BIPA in connection
with the fingerprint-based system by (i) collecting her biometric data without providing
her with the requisite notice and obtaining her written consent, and (ii) disclosing her
biometric data without consent.
After removing the complaint to the district court, White Castle moved for judgment on
the pleadings on the basis that the plaintiff’s claims were untimely. Specifically, White
Castle argued that the plaintiff’s BIPA claims accrued in 2008 (when her first fingerprint
scan occurred after the BIPA took effect), yet she did not file her complaint until
2018. The district court rejected White Castle’s one-time-only theory of claim accrual,
holding that the lawsuit was timely because each separate unauthorized fingerprint scan
constituted an independent violation of the statute, meaning the plaintiff’s BIPA claims
were timely because her last fingerprint scan occurred within five years of the filing of
her complaint. Because the issue presented a close call, however, the District Court
permitted White Castle to file an interlocutory appeal with the Seventh Circuit regarding
whether §§ 15(b) and 15(d) claims accrue each time a private entity scans a person’s
biometric identifier and each time a private entity transmits a scan to a third party,
respectively, or only upon the first scan and first transmission.
The Seventh Circuit accepted the interlocutory appeal. Id. ¶ 9. After determining that the
plaintiff had standing to bring her action in federal court under Article III of the U.S.
Constitution, the Seventh Circuit addressed the parties’ respective arguments on the
accrual of a claim under the Act. Id. Ultimately, the Seventh Circuit found the parties’
competing interpretations of claim accrual reasonable under Illinois law, and it agreed
with the plaintiff that “the novelty and uncertainty of the claim-accrual question”
warranted certification of the question to the Illinois Supreme Court. Id. at 1165-66. The
Seventh Circuit “observed that the answer to the claim-accrual question would
determine the outcome of the parties’ dispute, this court could potentially side with
either party on the question, the question was likely to recur, and it involved a unique
Illinois statute regularly applied by federal courts.” Id.
In a 4-3 split ruling, the Illinois Supreme Court held that that a separate claim accrues
21
© Duane Morris LLP 2023
Duane Morris Privacy Class Action Review – 2023
