Seventh Circuit Certifies Question to Illinois Supreme Court Regarding When BIPA Claim Accrues
On December 20, 2021, the Seventh Circuit Court of Appeals granted the request of the manager of an Illinois White Castle hamburger restaurant to certify to the Illinois Supreme Court the contested question of when a claim accrues under the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/1, et seq. The decision, Cothron v. White Castle System, Inc., No. 20-3202, 2021 WL 5998537 (7th Cir. Dec. 20, 2021), is a notable development to monitor for purposes of BIPA litigation, specifically on the issues of damages calculations and statute of limitations defenses.
The Illinois Biometric Information Privacy Act
In 2008, the Illinois General Assembly adopted BIPA in response to the increased use of biometric data, which are “biologically unique” personal identifiers, such as iris scans, face geometry, voiceprints, and fingerprints. 2021 WL 5998537 at *1. Unlike other sensitive personal information (e.g., social security numbers), once compromised, an individual’s biometric data cannot be changed. 740 ILCS 14/5(c). BIPA therefore regulates how private entities may collect and handle biometrics and provides a private cause of action for any person “aggrieved by” a violation. 740 ILCS 14/20. A plaintiff can recover the greater of actual damages or statutory damages of $1,000 for each negligent violation of BIPA and $5,000 for each reckless or willful violation. Id.
Relevant to the court’s decision in Cothron are two specific provisions of BIPA. Section 15(b) provides that a private entity may not “collect, capture, purchase, receive through trade, or otherwise obtain” a person’s biometric data without first providing notice to and receiving consent from that person. 740 ILCS 14/15(b). Section 15(d) provides that a private entity may not “disclose, redisclose, or otherwise disseminate” biometric data without receiving consent. 740 ILCS 14/15(d).
Cothron’s Employment with White Castle and BIPA Claim
Plaintiff Latrina Cothron had worked for White Castle since 2004. 2021 WL 5998537 at *1. Cothron alleged that shortly after beginning employment, White Castle implemented a system requiring employees to scan their fingerprints to access pay stubs and restaurant computers. Each fingerprint scan was then sent to a third-party vendor for authentication and access to the restaurant’s computer system. Cothron alleged in her lawsuit that White Castle implemented the fingerprint system without properly obtaining her consent. Id. Instead, Cothron claimed that White Castle did not attempt to obtain her consent until 2018 and therefore unlawfully collected her biometric data and unlawfully disclosed the data to a third-party vendor for a decade in violation of §§15(b) and 15(d) of BIPA. 2021 WL 5998537 at *2. Cothron sued White Castle in Illinois state court seeking to represent those White Castle employees whose BIPA rights were violated, and the case was subsequently removed to federal court. Id. (Cothron also initially sued Cross Match Technologies, Inc., the third-party vendor utilized by White Castle that received the employee fingerprint data. However, Cothron later voluntarily dismissed Cross Match from the suit.)
At the district court level, White Castle moved for judgment on the pleadings, arguing that Cothron’s suit was untimely, as her claim accrued in 2008 with her first fingerprint scan after BIPA’s effective date. (The Court noted that while the duration of the BIPA limitations period is “disputed,” all parties agree that it is no longer than five years.) Id. In response, Cothron contended that a new BIPA claim accrued each time that she scanned her fingerprint (violative of §15(b)) and each time White Castle sent it to the third-party vendor (violative of §15(d)), so her suit was timely with respect to the alleged unlawful scans and transmissions. The district court denied White Castle’s motion, but because the decision involved a controlling question of law on which there was substantial ground for disagreement, the judge certified his order for immediate appeal. Id.
Seventh Circuit’s Decision To Certify Claim Accrual Question
On appeal, Cothron asked the court to certify to the Illinois Supreme Court the question of whether a BIPA claim accrues only once or repeatedly, specifically whether a claim accrued each time Cothron scanned her fingerprint at work or just the first time. Id. White Castle argued in favor of what the court referred to as a “one-time-only” rule, citing to the single-publication rule applicable in cases involving defamation and other privacy torts. 2021 WL 5998537 at *4. Under this accrual principle, a tort claim based on a defamatory statement contained in a widely circulated publication only accrues upon the initial publication as opposed to each subsequent publication on the same statement. Id. White Castle contended that an unlawful disclosure of an individual’s biometric data is a privacy-invading “publication” to which the single-publication rule should apply, thus making Cothron’s §15(d) claim untimely. 2021 WL 5998537 at *5.
In response to White Castle’s proposed application of the single-publication principle, the court opined that there are reasons to doubt the application in the BIPA context, specifically because the illustrative list of publication media covered by the Uniform Single Publication Act may not be a “comfortable fit” with BIPA. Id. However, the court went on to note that even if the single-publication rule did not apply, the language of §15(d) is “arguably consistent” with White Castle’s proposed rule, as the meaning of the term “disclose” connotes a new revelation, and repeated transmissions of the same biometric data to the same third party are not new revelations. Id. In response, Cothron countered that the term “redisclose” as used in §15(d) of BIPA includes repeated disclosures of the same biometric data to the same third party and that applying the statute in the manner proposed by White Castle would render this term “meaningless surplusage.” 2021 WL 5998537 at *5.
White Castle also argued that consistent with the Illinois Supreme Court’s reasoning that BIPA protects a person’s right of “privacy in and control over” their biometric data, this right is fully invaded by an initial violation of §15(b) or §15(d) and thus repeated violations by the same person do not further harm the person’s privacy or control rights. 2021 WL 5998537 at *6. The court noted that White Castle’s “one-and-done” theory makes sense if it is accepted that subsequent collections or disclosures of biometric data do not create a harm that BIPA seeks to prevent. However, the court also conceded that the theory has “weak spots,” namely that repeated collections or disclosures of biometric data, even if done by or to the same entity, may increase the risk of misuse or mishandling of the biometric data, each time independently “aggrieving” an individual. Id.
In light of the novelty and uncertainty of the BIPA claim accrual question at issue, and given that the court found itself “genuinely uncertain” about the answer to the state law question, the court determined that certification to the Illinois Supreme Court was appropriate. 2021 WL 5998537 at *7. The court noted that there are reasons to think that the Illinois Supreme Court might side with either Cothron or White Castle. If §15(b) and §15(d) claims accrue repeatedly, Cothron’s lawsuit can continue; otherwise, it fails. Moreover, the court believed that the dispositive legal question here is general and likely to recur, as several federal district courts recently stayed their proceedings awaiting the court’s decision in this case. Id. As such, pending consideration of the certified question (“Do section 15(b) and 15(d) claims accrue each time a private entity scans a person’s biometric identifier and each time a private entity transmits such a scan to a third party, respectively, or only upon the first scan and first transmission?”) by the Illinois Supreme Court, the court stayed proceedings in the case. 2021 WL 5998537 at *8.
The forthcoming decision from the Illinois Supreme Court on the certified question posed will likely have a significant impact on future (and pending) litigation brought under BIPA. Considering that BIPA does not contain an express statute of limitations for an aggrieved individual to bring suit, the Illinois Supreme Court’s decision on when a claim accrues will shape future statute of limitations defenses available to private entities. Moreover, with respect to calculations of damages, whether an individual can recover for repeated violations of the same nature (e.g., same fingerprint scan remitted to same third-party vendor) or only for the first unlawful collection and/or transmission of biometric data will have significant financial ramifications for all parties. Employers utilizing employee biometric data in their workplaces should pay close attention to the Illinois Supreme Court’s review of this issue.
For more information about employment and labor law, see LABOR LAW: REPRESENTATION AND COLLECTIVE-BARGAINING MATTERS (IICLE®, 2021). Online Library subscribers can view it for free by clicking here. If you don’t currently subscribe to the Online Library, visit www.iicle.com/subscriptions.