Separate Claim for Each Unlawful Transmission of Biometric Info, Illinois Supreme Ct. Rules
The Illinois Supreme Court ruled Friday that a separate claim accrues each time a business unlawfully scans or transmits an individual’s biometric identifier or information, a decision that could drive up class action settlements against repeated Biometric Information Privacy Act (BIPA) violators.
In a 4-3 opinion, the Supreme Court said that a plain reading of the Act shows that a claim accrues with every violation, rather than just the first time.
The high court delivered the judgment in the case of Cothron v. White Castle System, Inc. Latrina Cothron, a manager of a White Castle restaurant in Illinois, alleged the company required its employees to scan their fingerprints to access their pay stubs and computers, and then a third-party vendor verified each scan and authorized the employee’s access.
White Castle implemented this biometric-collection system without obtaining her consent in violation of BIPA, alleged Cothron. BIPA went into effect in 2008, four years after Cothron was hired. BIPA states that a private entity may not “collect, capture, purchase, receive through trade, or otherwise obtain” a person’s biometric data without first providing notice to and receiving consent from the person.
The U.S. Court of Appeals for the Seventh Circuit had certified to the Supreme Court the question of whether claims accrue for each violation or only upon the first scan and first transmission.
“I am not surprised by the ruling, given that every BIPA case that’s come before the Illinois Supreme Court so far has gone in the plaintiff’s direction,” said Josh Kantrow, a partner in the Chicago office of Lewis Brisbois and co-chair of the firm’s BIPA Practice. “The court has not seemed willing to do anything to curtail the scope and reach of the statute, as it continues to decimate and impair Illinois businesses’ ability to operate.”
BIPA allows for a $1,000 fine per negligent violation and a $5,000 fine per intentional or reckless violation. The Act states that a prevailing party shall have a right of action in a state circuit court or as a supplemental claim in federal district court.
White Castle said that allowing multiple or repeated accruals of claims by one individual could potentially result in “annihilative liability.” White Castle estimates that if Cothron is successful and allowed to bring her claims on behalf of as many as 9,500 current and former White Castle employees, class- wide damages in her action may exceed $17 billion.
The high court said the Illinois General Assembly chose to make damages discretionary rather than mandatory under the Act.
“[We] continue to believe that policy-based concerns about potentially excessive damage awards under the Act are best addressed by the legislature,” Justice Elizabeth Rochford wrote in the majority’s opinion.
Mary Smigielski, head of the labor & employment practice in Lewis Brisbois’ Chicago office, and co-chair of the firm’s BIPA practice, said the court’s decision could motivate lawmakers to amend BIPA.
“It’s pretty unusual for a court to say something like this and respectfully suggest a legislature review these concerns,” said Smigielski. “We have heard that the legislature was poised to act depending on what the court did in this decision. Now, what’s going to transpire from that? It’s anyone’s guess. But it is my hope and my hope for the businesses in Illinois that this will in fact cause the legislature to act and to bring some common sense back into the statute, because there are ways to protect biometric information for the citizens of Illinois that will not lead to the absurd results.”
The dissenting opinion put forth by Justice David Overstreet said that the majority’s interpretation will lead to consequences that the legislature could not have intended.
“They completely disagreed with the majority and said that imposing punitive, crippling liability on businesses could not have been the goal of BIPA,” said Smigielski.
The dissenting justices emphasized that the construction of a statute that leads to absurd results should be avoided. The decision of the majority will incentivize future plaintiffs to delay bringing any claims and delay as long as possible so that they can keep racking up damages, the dissenting opinion argued.
The dissenting justices’ view was that BIPA’s scope should be narrowed, as any potential damage to an individual occurs on the first scan only.”
Kantrow noted that the dissent basically said that “once your biometric information is out there, it’s out there and, therefore, the majority’s conclusion that each successive scan accrues a whole new set of potential liabilities and causes of action makes no sense.”
Mounting Litigation
The Supreme Court 5-0 earlier this month ruled that plaintiffs have five years to file claims to allege violations of the Act.
In Tims v. Black Horse Carriers, the high court reversed a Court of Appeals ruling that held a one-year statute of limitations applies to portions of BIPA that deal with “publication of matter violating the right of privacy,” but the standard five-year limit applies to other types of violations.
“Perhaps the good news for businesses that came out of the Tims decision is that with a five-year reachback, some more insurance policies are potentially available to them, assuming that BIPA would be covered under those policies,” said Smigielski.
Kantrow said he expects the Supreme Court’s recent two decisions to drive up litigation.
“I think there’s just going be more and more of these cases now as the statute of limitations has been extended and the accrual date issue been resolved,” said Kantrow. “Even though the statute is 15 years old, and a lot of companies have already been sued and have settled their BIPA liabilities, BIPA litigation shows no signs of abating.”