The latest decision related to Illinois’ Biometric Information Protection Act (“BIPA”) was issued by the Illinois Court of Appeals on June 16, 2020, in a matter entitled Cothron v. White Castle System, Inc, 2020 WL 3250706 (June 16, 2020). Latrina Cothron (“Cothron”) began working at White Castle in 2004 and was still a manager at the time she filed suit. As a side note, the Cothron matter differs from many BIPA suits to the extent the plaintiff remains an employee before and after filing suit. Many BIPA cases involve claims by former employees that were terminated prior to bringing suit. As with most BIPA cases, Cothron claims White Castle violated BIPA when it installed a “fingerprint-based computer system that required Cothron, as a condition of continued employment, to scan and register her fingerprints in order ‘to access the computer as a manager and access her paystubs as an hourly employee.’”
This decision provides a snapshot of where the courts are on this body of law. In short, the Court held Cothron had standing to bring this action and her Complaint had allegations that at least allow a portion of her BIPA claims to survive White Castle’s motion to dismiss. It is important at this stage to remember that the Court did not find that Cothron is entitled to damages. Rather, the Court merely held Cothron should be given the opportunity to demonstrate she was injured by White Castle’s biometric information-gathering equipment.
The Court held Cothron could push forward with her claim on the following basis:
- Cothron Did Not Have Standing To Bring A Claim Under Section 15(a) Of BIPA.
Section 15(a) requires that a private entity “in possession of” biometric data (1) develop a written, publicly available policy that includes a retention schedule and destruction guidelines and (2) permanently destroy data upon the satisfaction of the “initial purpose for collecting or obtaining” it or “within 3 years” of the entity’s last interaction with the person, whichever comes first.
As for standing to bring this litigation, the Court first held that Cothron’s Complaint did not have allegations to support a violation of Section 15(a) of BIPA. In particular, the Court opined that “the failure to make available a written retention and destruction policy was a harm to the public, not a harm particular to Ms. Cothron.” Therefore, there was no violation under 15(a). The Court also found that Cothron could not allege a violation under 15(a) when she alleges that she continues to work at White Castle as a manager and, therefore, White Castle is not obligated to destroy her data. Therefore, the Court held Cothron lacked Article III standing to bring a claim under Section 15 (a) of BIPA.
- Cothron Has Standing And Can Bring A Claim Under Section 15(b) and 15(d) Of BIPA.
Section 15(b) provides that, prior to collecting biometric data, entities must first (1) inform the person in writing that the information is being collected or stored; (2) state the “specific purpose and length of term for which” the data “is being collected, stored, and used”; and (3) receive a written release from the person.
As for standing to bring this litigation, the Court found Cothron had standing to bring this action under Section 15(b) of BIPA. Specifically, the Court opined that “Cothron’s alleged Section 15(b) injury is concrete and particularized for the reasons summarized above: White Castle failed to provide her with substantive, personal information about the collection, storage and use of her fingerprint data and armed with this information, Ms. Cothron may well have chosen to forgo the automated system.” Therefore, the Court held Cothron had standing to bring a claim under Section 15(b) of BIPA.
Section 15(d) states that entities in possession of biometric data may only disclose or “otherwise disseminate” a person’s data upon obtaining the person’s consent or in limited other circumstances inapplicable here.
As for standing to bring this litigation, the Court held that “Section 15(d) forms a piece of the ‘informed-consent regime’ at the heart of BIPA.” Under this reasoning, the Court held Cothron had standing to bring an action under 15(d) because her “informational injury” was concrete and particularized. The Court held Cothron should have been provided the right “to object to the way her data was being handled or to opt-out of the system entirely.” Therefore, the Court held Cothron had standing to bring a claim under Section 15(d) of BIPA.
White Castle also argued that Cothron’s Complaint should be dismissed because it did not contain any allegations that White Castle “acted with the mental state required for statutory damages.” Here, the Court held “even absent specific allegations about White Castle’s mental state,” Cothron has stated a claim seeking litigation expenses and injunction relief under BIPA. That is, the Court did not require Cothron to specifically allege she is entitled to damages based on negligent, reckless or intentional conduct. Therefore, Cothron’s Complaint survived White Castle’s motion to dismiss based on the assertion that White Castle lacked the proper mental state for a viable BIPA violation.
White Castle also sought dismissal of Cothron’s Complaint by arguing BIPA is preempted by the Illinois Workers’ Compensation Act (“IWCA”). The IWCA provides the exclusive remedy for injuries sustained by employees in the course of their employment. Here, the Court opined the test to determine if an employee suffered a “compensable injury” is “whether there was a harmful change in the human organism—not just its bones and muscles, but its brain and nerves as well.” The Court held the IWCA did not preempt BIPA claims to the extent it did not find BIPA violations caused physical or psychological injuries which would be typically covered under the IWCA.
It is important that data collectors do not get discouraged by these decisions when a court denies a motion to dismiss. As stated by the Cothron Court, “the question at this stage is simply whether the complaint includes factual allegations that state a plausible claim for relief.” The analysis takes plaintiff’s allegations as plead. For example, in this case, the parties will now start litigating issues that may involve statute of limitations, class certification and the technical aspects of whether a template of a small portion of a fingerprint/thumbprint constitutes biometric information.
The post White Castle’s Motion To Dismiss Denied In BIPA Litigation appeared first on Privacy Risk Report.