In a recent decision regarding an employee’s claims for violations of Illinois’ Biometric Information Privacy Act (“BIPA”), the United States Court of Appeals for the Seventh Circuit asked the Illinois Supreme Court to provide much-needed clarification on the accrual of BIPA violations. See Cothron v. White Castle System, Inc., Case No. 20-3202, 2021 U.S. App. LEXIS 37593 (7th Cir. Dec. 20, 2021).
Enacted in 2008, BIPA regulates the use, collection, and handling of biometric identifiers including retina or iris scans, fingerprints, voiceprints, or records of hand or face geometry, by private entities including employers. Among other things, BIPA prohibits the collection of biometric identifiers without consent. BIPA provides a private right of action to individuals aggrieved by violations, which can result in liquidated damages of up to $5,000 per violation.
A former White Castle employee, Latrina Cothron, brought a class action complaint alleging White Castle unlawfully collected, used, stored and disclosed employees’ biometric data in violation of BIPA. Ms. Cothron alleged that, beginning in 2007, White Castle began capturing employees’ fingerprint data and disclosing it to third parties without employees’ consent. White Castle moved for judgment on the pleadings under Federal Rule of Civil Procedure 12(c), arguing that Ms. Cothron’s claims accrued in 2008 when BIPA was first enacted.
The United States District Court for the Northern District of Illinois denied White Castle’s motion, ruling that each post-enactment scan or disclosure of Ms. Cothron’s fingerprint constituted an independent BIPA violation. The practical effect of the District Court’s decision meant that the statute-of-limitations period restarted with each new scan or disclosure of employees’ biometric information, and thus, the BIPA claims were timely filed.
Following the District Court’s ruling, White Castle appealed the decision to the United State Court of Appeals for the Seventh Circuit, asking it to rule on the question of whether a private entity violates BIPA each time the private entity allegedly collects or discloses the individual’s biometric data. On December 20, 2021, the Seventh Circuit published an opinion staying the case and certifying the question to the Illinois Supreme Court.
In its opinion, the Seventh Circuit noted that it was “genuinely uncertain” as to how it should rule, as “there are reasons to think that the Illinois Supreme Court might side with either Cothron or White Castle.” The Seventh Circuit also reasoned that the accrual question was “likely to recur” and that “[a] wrong answer may also transcend the Act and implicate fundamental Illinois accrual principles on which only the state’s highest court can provide authoritative guidance.”
The Illinois Supreme Court’s ultimate ruling on this often-litigated accrual issue is likely to have significant implications for Illinois employers. Should the Illinois Supreme Court adopt the Northern District of Illinois’ accrual formulation, employers could be subject to immense damage awards – even the District Court opinion acknowledged the statutory damages alone would be “crippling.” On the other hand, if the Illinois Supreme Court accepts White Castle’s interpretation and rules a BIPA violation only accrues upon the initial unauthorized capture or disclosure of a person’s biometric information, employers will be able to curtail exorbitant damage awards.
PUTTING INTO PRACTICE: The Seventh Circuit’s decision to certify the accrual question to the Illinois Supreme Court means the accrual issue will remain unresolved for several more months. Illinois state and federal courts frequently granted stays of BIPA litigations while awaiting the outcome of Cothron, and those stays will likely remain in place until the Illinois Supreme Court provides definitive guidance later this year.