Cybersecurity Policy Report, Ill. Supreme Court: BIPA Claims Accrue After Every Violation, (Feb 22, 2023)

By WK Editorial Staff

Separate claims accrue every time a private entity collects or discloses an individual’s biometric identifier or information without consent in violation of the Illinois Biometric Information Privacy Act (BIPA), the Illinois Supreme Court has ruled.

In an opinion issued Friday in Latrina Cothron v. White Castle System, Inc. (no. 128004), the state’s high court addressed a question originating in a pending federal lawsuit brought by the manager of a White Castle restaurant. The plaintiff, who is seeking class-action status, alleges that the employer introduced a system requiring employees to scan their fingerprints for accessing pay stubs and computers. As part of the system, a third-party vendor verified each scan and authorized the employee’s access.

The plaintiff alleged that White Castle implemented the biometric-collection system without her consent in violation of BIPA, which provides that a private entity may not “collect, capture, purchase, receive through trade, or otherwise obtain” a person’s biometric data without first providing notice to and receiving consent from the person. The law also provides that a private entity may not “disclose, redisclose, or otherwise disseminate” biometric data without consent.

At issue is when claims for a BIPA violation accrue. White Castle argued that the suit was untimely on the basis that the plaintiff’s claim accrued in 2008, when the company first obtained the biometric information.

The plaintiff, however, alleged that each time the company collected her biometric data and disclosed that data to its third-party vendor was a separate and distinct claim, which would render her action timely. The district court agreed with the plaintiff and certified an order for interlocutory appeal, concluding that the issue involved a controlling question of law on which there was substantial ground for disagreement.

The U.S. Court of Appeals for the Seventh Circuit (Chicago) subsequently accepted certification and, upon finding that the parties’ competing interpretations were reasonable under Illinois law, certified the question to the Illinois Supreme Court. The certified question asked: “Do section 15(b) and 15(d) claims accrue each time a private entity scans a person’s biometric identifier and each time a private entity transmits such a scan to a third party, respectively, or only upon the first scan and first transmission?”

A majority of justices on the Illinois Supreme Court found that “the plain language of section 15(b) and 15(d) shows that a claim accrues under the Act with every scan or transmission of biometric identifiers or biometric information without prior informed consent.” The majority said the statute contained no language limiting claims to the first time a private entity collected or transmitted biometric data.

News: StateLegislation LitigationEnforcement DataPrivacy