Illinois Supreme Court Decision in White Castle Leaves Plaintiffs’ Bar With All-You-Can-Eat Biometric Buffet

Last week, in Cothron v. White Castle System, Inc., the Illinois Supreme Court confirmed that each violation of BIPA constitutes a distinct and separately actionable violation of the statute.  This means that many plaintiffs will have a significantly longer time in which to initiate litigation (for example, an employee who clocks in daily using a fingerprint scan resets the statute of limitations each day), and statutory damages could be astronomically higher (that same employee has suffered a violation twice per day, with each scan in and out, as opposed to a single violation at first collection).  The plaintiff in Cothron, a former employee of defendant White Castle, brought claims under Sections 15(b) and 15(d) of BIPA for alleged violations arising from White Castle’s collection of her fingerprints.  The plaintiff began working at White Castle in Illinois in 2004, and during her tenure, White Castle implemented an optional, consent-based finger-scan system for employees to sign documents and access their paystubs and computers.  While the plaintiff initially consented to the collection of her biometric data in 2007, she sued in 2018—alleging that White Castle never obtained consent to collect or disclose her fingerprints under BIPA because BIPA did not exist in 2007.

Shortly after suit was filed in the circuit court of Cook County, defendant White Castle removed this action to federal court under the Class Action Fairness Act.  After the district court disagreed with White Castle’s theory as to when plaintiff’s BIPA claims accrued, White Castle sought an interlocutory appeal to the Seventh Circuit.  In response to the accrual issues presented, the Seventh Circuit certified a question to the Illinois Supreme Court— asking, “do section 15(b) and 15(d) claims accrue each time a private entity scans a person's biometric identifier and each time a private entity transmits such a scan to a third party, respectively, or only upon the first scan and first transmission?”

The Illinois Supreme Court scrutinized the plain language of Section 15(b) and disagreed with White Castle that “collection” or “capture” of biometric identifiers occurs only once—at the time an entity first obtains an individual’s fingerprint.  The court analyzed Section 15(b)’s language distinguishing collection and storage of biometric identifiers, noting Section 15(b)(2)’s requirement that an entity must notify an individual regarding how long their biometric identifiers would be collected suggested that “the legislature contemplated collection as being something that would happen more than once.”  See id. at ¶ 23.  Turning then to Section 15(d), the court held that the plain language of the provision applies to every instance in which biometric identifiers are shared with a third party.  The court relied upon dictionary definitions of terms in the statute, including “disclose” and “redisclose.”  The court also found White Castle’s non-textual arguments unavailing—noting that the case law did not address the issue of claim accrual.  The majority held that “a separate claim accrues under the Act each time a private entity scans or transmits an individual’s biometric identifier or information in violation of section 15(b) or 15(d).” See Cothron, 2023 IL 128004, ¶ 1.

In dissent, Justice Overstreet, joined by Chief Justice Theis and Justice Holder White, contended the majority’s interpretation was irreconcilable with the plain language of the statute and rendered compliance with BIPA unduly burdensome for employers.  Justice Overstreet observed that Section 15(b) “broadly applies to any way that a private entity obtains a person’s biometric identifier or information,” which “can happen only once” because “[w]ith subsequent authentication scans, the private entity is not obtaining anything it does not already have.”  See id. at ¶ 51.  The dissent applied the same analysis to Section 15(d).   Finally, Justice Overstreet cautioned that the court in construing the language of a statute should “‘assume that the legislature did not intend to produce an absurd or unjust result.’” Id. at ¶ 59 (citing State Farm Fire & Casualty Co. v. Yapejian, 152 Ill. 2d 533, 541 (1992)).  Considering the practical consequences of this decision, the dissent warned that this would (1) incentivize plaintiffs to delay bringing their claims for as long as possible; and (2) would “easily lead to annihilative liability for businesses”—pointing to the potential $17 billion in damages in the action before the court.  See id. at ¶ 61. 

The court’s decision in Cothron comes on the heels of Black Horse—a February 2nd decision that recognized a five-year (rather than two-year) statute of limitations for BIPA claims.  By both recognizing an extended statute of limitations and finding BIPA claims accrue on a scan-by-scan or transmission-by-transmission basis, Cothron and Black Horse leave the plaintiff’s bar with an all-you-can-eat biometric buffet.  We, therefore, recommend companies immediately review their policies and practices related to the collection, use, and disclosure of biometric information to ensure compliance with BIPA requirements, including any biometric collection, use, or disclosure activities in connection with employee timekeeping.

As dozens of BIPA lawsuits were stayed pending the outcome of Cothron, the court’s decision will kickstart a flurry of litigation both in Illinois and around the country. Outside of the class action context, the Cothron ruling will likely result in an influx of individual lawsuits, as individuals whose biometric information was repeatedly collected or disclosed (such as workers that had their fingerprints scanned as they clocked in and out each day) will now have claims of enough value to make non-class litigation viable.

However, there is hope for defendants in the wake of Cothron; while the majority found that “the statutory language clearly supports plaintiff’s position,” it recognized many of the concerns raised by the dissent.  In acknowledging the potential for “annihilative liability,” the court emphasized that damages under the Act are discretionary, suggesting the important role that trial courts will play in avoiding absurd damage awards that would result in the “financial destruction of a business.”  Id. at ¶ 42.  The court also makes an explicit appeal to the legislature, urging the need for review of the statute in light of its current consequences.  Id. at ¶ 43.  Companies facing liability under the Act should consider these points in assessing risk and as part of their overall litigation strategy.