On July 18, 2023, the Illinois Supreme Court denied a rehearing on the issue of Biometric Information Privacy Act (BIPA) accrual. The request for rehearing derived from an opinion by the 7th Circuit, Cothron v. White Castle System, Inc., 20 F.4th 1156 (7th Cir. 2021), holding that “separate claims accrue under BIPA each time a private entity scans or transmits an individual’s biometric identifier or information in violation of section 15(b) or 15(d).”
In Cothron, a class of employees filed an action against their employer, White Castle, for requiring employees to scan their fingerprints to access computers without first obtaining employee consent. The 7th Circuit ruling, in conjunction with Illinois Supreme Court’s denial of rehearing, means an employer can be liable every time an employee scanned their fingerprints or such information is transmitted without their consent. The dissenting opinion of the Illinois Supreme Court criticized the majority’s interpretation as unable to “be reconciled with the plain language of the statute,” further citing the damage BIPA accrual can cause to businesses.
Enacted in 2008, Illinois’ BIPA was one of the first state laws addressing the collection of biometric data. BIPA requires private companies to develop written policies establishing guidelines and retention schedules for the collection, transmittal, and storage of biometric data. Moreover, BIPA requires companies to obtain informed consent prior to the collection. Biometric information, as defined by the Illinois legislature, includes retina or iris scans, fingerprints, voiceprints, or scans of hand or fact geometry.
Currently, Illinois, Maryland, New York (and New York City), Oregon (and Portland), Texas and Washington, each have biometric privacy laws in place. Additionally, several other states have proposed similar laws, or included biometric information regulations within comprehensive privacy laws. Notably, not all biometric privacy laws create a private right of action like BIPA or New York City.
As it becomes more common for employers to use biometric information as a tool for timekeeping and security, it is increasingly important for employers who utilize the biometric data of their employees to stay up to date on new legislative and legal developments. An easy way to stay ahead of new developments is to implement comprehensive policies and obtain employee consent, regardless of which state an employer is doing business in. As illustrated in the Illinois dissent, the 7th Circuit’s ruling on BIPA accrual has created a great deal of confusion. As such, it is likely that the area will continue to develop and change in the coming months and years.
