Today the Illinois Supreme Court issued a decision in Cothron v. White Castle System, Inc. 2023 IL 128004, in which the court held that the statute of limitations accrues with each scan or transmission of biometric identifiers or biometric information for claims arising under Sections 15(b) and 15(d) of the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (BIPA). Section 15(b) pertains to notice and written consent before collecting, capturing, purchasing, receiving through trade, or otherwise obtaining biometric data. Section 15(d) pertains to the disclosure, redisclosure, or dissemination of biometric data without consent.

In Cothron, the plaintiff, a manager of a White Castle System Inc. (White Castle) restaurant, filed in the Circuit Court of Cook County a putative BIPA class action, which was subsequently removed to the U.S. District Court for the Northern District of Illinois. The plaintiff alleged that in 2004, White Castle implemented a system that required employees to scan their fingerprints to access their pay stubs and computers and that a third-party vendor then verified each scan to authorize the employee’s access. In 2008, BIPA took effect. The plaintiff alleged that White Castle did not seek her consent to acquire her alleged biometric data until 2018. The plaintiff alleged that White Castle (1) failed to provide notice and to obtain her consent when collecting her alleged biometric data under Section 15(b) and (2) disclosed her biometric data to a third-party vendor without her consent under Section 15(d).

White Castle moved for judgment on the pleadings, arguing that the plaintiff’s claim accrued in 2008, when White Castle first obtained her alleged biometric data after BIPA took effect. Plaintiff argued that a new claim accrued each time she scanned her fingerprint and sent her alleged biometric data to the third-party vendor. The district court agreed with the plaintiff and denied White Castle’s motion, but it later certified for interlocutory appeal the issue of when the BIPA claims accrued. After the U.S. Court of Appeals for the Seventh Circuit Court accepted the interlocutory appeal, it certified the question to the Illinois Supreme Court given “the novelty and uncertainty of the claim-accrual question.”

The Illinois Supreme Court ruled that “we believe that the plain language of section 15(b) and 15(d) demonstrates that such violations occur with every scan or transmission.” Specifically, the court explained, “Consequently, we reject White Castle’s argument that we should limit a claim under section 15 to the first time that a private entity scans or transmits a party’s biometric identifier or biometric information. No such limitation appears in the statute. We cannot rewrite a statute to create new elements or limitations not included by the legislature.”

In response to concerns about the risk of excessive damage awards, the Illinois Supreme Court stated that “there is no language in the Act suggesting legislative intent to authorize a damages award that would result in the financial destruction of a business.” Moreover, the court expressly asked the Illinois General Assembly to review BIPA to address such concerns: “We respectfully suggest that the legislature review these policy concerns and make clear its intent regarding the assessment of damages under the Act.”

Now, after it has been asked to do so by the highest court in the state of Illinois, it is time to see whether the Illinois General Assembly is finally willing to take action.

[View source.]