Cothron v. White Castle System, Inc.
2023 IL 128004 (2023)
Rule of Law:
Under Illinois's Biometric Information Privacy Act (BIPA), a separate claim accrues each time a private entity collects or discloses an individual's biometric information in violation of the Act's notice and consent requirements, rather than only upon the initial violation.
Facts:
- Latrina Cothron has been an employee at a White Castle restaurant in Illinois since 2004.
- Shortly after Cothron's employment began, White Castle implemented a system requiring employees to scan their fingerprints to access pay stubs and computers.
- Each time an employee scanned their fingerprint, the data was transmitted to a third-party vendor for verification and to authorize access.
- The Illinois Biometric Information Privacy Act (BIPA), which requires informed written consent before collecting biometric data, became effective in 2008.
- White Castle continued to require Cothron to scan her fingerprint regularly after BIPA's effective date without first obtaining her informed written consent.
- White Castle did not seek Cothron's consent to collect and disclose her fingerprint data until 2018.
Procedural Posture:
- Latrina Cothron filed a proposed class action lawsuit against White Castle System, Inc. in the Circuit Court of Cook County, Illinois (a state trial court).
- The case was removed to the United States District Court for the Northern District of Illinois (a federal trial court).
- White Castle filed a motion for judgment on the pleadings, arguing Cothron's claim was untimely because it accrued with the first scan after BIPA's 2008 effective date.
- The U.S. District Court denied White Castle's motion, ruling that a new claim accrued with each scan.
- The District Court certified its order for an immediate interlocutory appeal to the U.S. Court of Appeals for the Seventh Circuit (an intermediate federal appellate court).
- The Seventh Circuit accepted the appeal and certified the question of law regarding when a claim accrues under BIPA to the Supreme Court of Illinois.
Premium Content
Subscribe to Lexplug to view the complete brief
You're viewing a preview with Rule of Law, Facts, and Procedural Posture
Issue:
Do claims under sections 15(b) and 15(d) of the Illinois Biometric Information Privacy Act accrue each time a private entity scans or transmits an individual's biometric information, or do they accrue only upon the first scan and first transmission?
Opinions:
Majority - Justice Rochford
Yes, a separate claim accrues each time a private entity scans or transmits an individual’s biometric identifier or information in violation of section 15(b) or 15(d) of the Act. The plain language of the statute supports this interpretation. Section 15(b)'s prohibition on 'collect[ing]' or 'capture[ing]' data applies to each instance an employee's fingerprint is scanned for authentication, not just the initial enrollment. Similarly, the broad language of section 15(d), which prohibits entities from 'disclos[ing], redisclos[ing], or otherwise disseminat[ing]' data, covers every transmission to a third party. The court rejected the argument that the legal injury—the loss of control—can only happen once; instead, citing Rosenbach, it held that the statutory violation itself is the injury, and a violation occurs with each unlawful scan or transmission. While acknowledging policy concerns about potentially 'annihilative' damages, the court concluded that such concerns are best addressed by the legislature and that trial courts possess discretion in fashioning damage awards.
Dissenting - Justice Overstreet
No, a claim accrues under section 15(b) or 15(d) of the Act only upon the first scan or transmission. The 'precise harm' the Act seeks to prevent is the loss of privacy and control over one's biometric data, which occurs only once at the first unlawful collection or disclosure. Subsequent scans for authentication do not constitute a new collection because the entity already possesses the data, nor do they cause an additional loss of privacy. This interpretation aligns with legal principles that a claim accrues from a single overt act. The majority's holding creates absurd results, incentivizes plaintiffs to delay lawsuits to maximize damages, and threatens businesses with 'annihilative liability' that the legislature never intended.
Dissenting upon denial of rehearing - Justice Overstreet
No, the court should grant rehearing because its opinion subverts the remedial intent of the Act, turning it into a punitive statute that threatens the survival of Illinois businesses. The majority's per-scan accrual rule allows for 'cataclysmic' damages that are wholly disproportional to the offense, raising significant constitutional due process concerns. The decision has created a 'statutory landmine' and has already led to a surge in litigation. The majority's suggestion that damages are discretionary is insufficient without providing clear standards, leaving businesses exposed to arbitrary and crippling liability. The court should have interpreted the statute to avoid these absurd and unconstitutional results.
Analysis:
This decision solidifies a plaintiff-friendly interpretation of BIPA, significantly increasing the potential liability for businesses using biometric technology in Illinois. By establishing a per-scan/per-transmission accrual rule, the court ensures that the statute of limitations will not bar claims for recent violations, even if the initial non-compliant collection occurred years earlier. The ruling creates immense financial pressure on defendants to settle and will likely spur an even greater volume of BIPA class action litigation. While the court suggests damages are discretionary, its refusal to set clear limits on liability leaves the issue for future legislative action or further litigation, creating significant uncertainty for businesses operating in the state.
Gunnerbot
AI-powered case assistant
Loaded: Cothron v. White Castle System, Inc. (2023)
Try: "What was the holding?" or "Explain the dissent"