In a landmark decision that will have widespread effects, the Illinois Supreme Court ruled that a claim accrues each time—rather than just the first time—that data is collected in violation of the Biometric Information Privacy Act (BIPA). Because BIPA provides statutory damages for each violation, this ruling exponentially increases potential damages, especially in the employment context.
BIPA requires informed consent prior to the collection of biometric information. In the employment context, we have seen many class actions relating to fingerprint timekeeping technology. In White Castle, the issue arose as to whether each employee could assert only one claim, or whether they could assert a claim for each fingerprint scan taken without consent. Given the importance of the issue, the Seventh Circuit certified the issue to the Illinois Supreme Court last year.
On February 17, the Supreme Court issued its ruling. Rejecting White Castle’s argument that only the first scan requires consent, the Court held that the plain language of the statute supports that “collection” occurred each time the plaintiff-employees’ fingerprints were scanned.
When coupled with the recent finding that there is a five year statute of limitation, this ruling will result in staggering damages. For example, if an employee clocked in using this technology five days a week for fifty weeks a year over that five year period, the statutory damages for that single employee would be $1.25 million for negligent violations and $6.25 million for intentional violations. When applying these numbers to a large workforce, it is easy to imagine damages crippling companies and insurance companies.
There may yet be some glimmer of hope for class defendants. The opinion leaves a potential opening to challenge damage awards of such magnitude: the court suggested that damages under BIPA may be “discretionary rather than mandatory” and explained that courts presiding over class actions have the discretion to fashion class awards to avoid “the financial destruction of a business.”
In any event, BIPA class actions have already flooded the courts over the last few years. The White Castle holding will likely add fuel to the fire, both for number of suits filed and settlement positions. It may also have downstream effects on insurance coverage as the market may correct in a similar fashion to what we saw with cyber premiums after rise in ransomware.
At the very least, companies need to take a very thorough look at the technology being used to properly assess and mitigate their risk.
[View source.]
