Chicago, Ill. (February 17, 2023) – Today, in a 4-3 decision, the Illinois Supreme Court handed down the most significant opinion interpreting the Illinois Biometric Information Privacy Act (BIPA) since Rosenbach v. Six Flags, holding in Cothron v. White Castle Systems, Inc. that a separate claim accrues under Section 15(b) and 15(d) of BIPA each and every time a private entity collects or discloses a biometric identifier or information.
The ruling came on a certified question from the United States Court of Appeals for the Seventh Circuit, which asked the court: “Do section 15(b) and 15(d) claims accrue each time a private entity scans a person's biometric identifier and each time a private entity transmits such a scan to a third party, respectively, or only upon the first scan and first transmission?” White Castle argued that claims under these sections of the Act can accrue only once – when the biometric data is initially collected or disclosed. The plaintiff argued that claims accrue every time a private entity collects or disseminates biometrics without prior informed consent.
Illinois' high court sided with the plaintiff based on the plain language of the statute, agreeing with the underlying federal district court ruling that “[a] party violates Section 15(b) when it collects, captures, or otherwise obtains a person's biometric information without prior informed consent. This is true the first time an entity scans a fingerprint or otherwise collects biometric information, but it is no less true with each subsequent scan or collection.” Similarly, the court held that Section 15(d) is violated each time a private entity discloses or otherwise disseminates a person's biometric information to a third party.
In making its ruling, the Cothron court rejected White Castle's “nontextual arguments in support of its single-accrual interpretation,” including an argument that imposing liability on Illinois businesses for hundreds or thousands of statutory violations – in which no harm occurred – “could potentially result in punitive and astronomical damages awards” to the tune of billions of dollars. Despite these potential implications, the Illinois Supreme Court affirmed its reasoning from Rosenbach v. Six Flags and McDonald v. Symphony Bronzeville, in which it “repeatedly recognized the potential for significant damages awards” because “the legislature intended to subject private entities who fail to follow [BIPA's] requirements to substantial potential liability.”
However, all hope may not be lost for Illinois businesses that have yet to resolve their potential liabilities for using biometric technology without complying with the statute. The Cothron court recognized that which appears in the plain language of the statute, writing that it “appears that the General Assembly chose to make damages discretionary rather than mandatory under [BIPA]” and noting that a “prevailing party may recover” under the Act. It also noted that the First District Appellate Court's decision in Watson v. Legacy Healthcare – binding on Cook County trial courts – came to the same conclusion. On this finding, the Illinois Supreme Court “generally agreed” that “a trial court presiding over a class action—a creation of equity—would certainly possess the discretion to fashion a damage award that (1) fairly compensated claim class members and (2) included an amount designed to deter future violations, without destroying defendant's business.” The Cothron majority's decision ended with a call to the General Assembly to “respectfully suggest” that lawmakers “review these policy concerns and make clear its intent regarding the assessment of damages under the Act.”
In a well-reasoned dissent, three justices argued that the majority decision is in error because there is only one loss of control or privacy, and this happens when the information is first obtained or disclosed by a third party, adding that “imposing punitive, crippling liability on businesses could not have been a goal of the Act, nor did the legislature intend to impose damages wildly exceeding any remotely reasonable estimate of harm.” The dissent also emphasized that the construction of a statute that leads to absurd results should be avoided, and that the decision of the majority will incentivize plaintiffs to delay bringing claims as long as possible to keep racking up damages that will lead to potentially annihilative liability.
For now, the imposition of liquidated damages appears to be within the discretion of state and federal courts in Illinois. As reported when the Tims v. Black Horse Carriers decision came down, holding that a five-year statute of limitations applies to BIPA, hundreds of BIPA class actions have been stayed at the trial court level while the Illinois Supreme Court reviews these novel issues of law under the statute. With Cothron on the books, those stays are set to be lifted as early as next week, and the flood of BIPA litigation will proceed with motion practice and discovery, with trial courts ultimately set to fashion damages awards, if any, based on the facts of individual cases before them.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
