Illinois Supreme Court’s Latest BIPA Decision: Violations Occur with Each Collection or Disclosure

HMB recently issued a Client Alert following the Illinois Supreme Court’s decision in Tims v. Black Horse Carrier, 2023 IL 127801, where the Court held that all Illinois Biometric Information Privacy Act (BIPA) actions would be governed by a 5-year statute of limitations period. Since then, the Illinois Supreme Court has dealt another blow to Illinois BIPA defendants.

Cothron v. White Castle System, Inc.

On February 17, 2023, the Court issued its long-awaited decision in Cothron v. White Castle System, Inc., 2023 IL 128004, answering the critical question of whether a BIPA violation occurs each time biometric information is collected or disclosed, or whether it is only the first instance of collection or disclosure that gives rise to a claim. In the case, the plaintiff, Latrina Cothron, began working for White Castle in 2004. Shortly after she began her employment, White Castle began requiring employees to scan their fingerprints to gain access to pay stubs and White Castle’s computer systems. After each scan, a third-party vendor software compared the scanned fingerprint to a prior scan to authenticate the employee’s access.

Potential violations of two sections of the BIPA statute were at issue in this case. One section makes it a violation to collect or obtain biometric information without consent, whereas the other relates to disclosure or dissemination to a third party without consent. Cothron argued that a BIPA violation occurred each time her fingerprint was collected and/or disclosed to the third-party vendor without her prior consent. White Castle argued that BIPA, if violated, was only violated the first time it scanned or disclosed an employee’s fingerprint without consent. The Court ultimately held that under the plain language of the BIPA statute, a separate BIPA violation occurred with each and every scan or transmission of an employee’s fingerprint.

The Court’s decision could be devastating to BIPA defendants. Prior to Tims and Cothron, the sizes of classes of potential plaintiffs were already worrisome. As an example, Cothron was brought as a class-action on behalf of all Illinois White Castle employees, as many as 9,500 potential plaintiffs. The Tims decision expanded the time period for potential plaintiff classes to five years. The Cothron decision further expands the number of claims that each plaintiff within a class may bring. With damages of $1,000 to $5,000 per violation per class member, these two decisions exponentially increase a BIPA class-action defendant’s potential liability. Although the Court’s decision in Cothron was primarily based on the plain meaning of  the language of the BIPA statute, the practical and critical consideration is the issue of damages. White Castle argued that the Court’s decision could potentially result in “astronomical” damage and “annihilative liability” that could force BIPA defendants of all sizes into bankruptcy. Specifically, White Castle estimated that its damages, if the Court allowed separate violations for up to 9,500 plaintiffs, could be up to $17 billion.

Although the critical question in Cothron did not directly relate to the issue of damages, the Court addressed them. The Court offered a helpful clarification that damages under BIPA are not mandatory. It explained that courts have the discretion to craft a damage award that fairly compensates class members and disincentivizes employers from violating BIPA without destroying the defendant’s business. Discretionary damages, according to the Court, are appropriate because nothing in BIPA’s language indicates the legislature intended to create damage awards that would result in the financial destruction of a business. This portion of the Court’s opinion offers a sliver of hope to BIPA defendants caught in the midst of what feels like a rapid expansion of potential BIPA liability.

Implications of Cothron

The case of Rogers v. BNSF Railway Co., 19-CV-03083, provides a helpful illustration of how these recent decisions may affect BIPA damages. In November 2022, a jury awarded $228 million in damages against BNSF Railway in a BIPA class action in the U.S. District Court for the Northern District of Illinois. The plaintiff class was made up of 45,600 employees who had their fingerprints registered without consent. The damage award of $228 million represented a $5,000 award for each class member.

Because the case was decided before Cothron, the damages were based on only one violation occurring per plaintiff, not on multiple claims per plaintiff, which is now possible in post Cothron. Even so, the damage award was still well into the nine figures—exactly the type of “annihilative liability” that White Castle urged the Illinois Supreme Court to consider in deciding Cothron. After receiving the judgment in November, BNSF filed a motion for a new trial on damages, claiming that the $228 million award was excessive, especially since any plaintiffs who had their fingerprints collected without consent suffered little to no real-world harm. Now, armed with the Cothron Court’s holding that BIPA damages are discretionary, BNSF can claim its pursuit of a more equitable damage award is directly supported by the Illinois Supreme Court.

It is uncertain whether the Northern District of Illinois will reconsider the damages entered against BNSF in light of Cothron. Further, while the Cothron decision significantly expands the number of potential BIPA violations defendants may face, the Court’s holding on discretionary damages should give hope to employers facing BIPA suits. As made clear by the Tims and Cothron decisions, the Illinois Supreme Court will continue to defer to the text of the BIPA statute. As the Cothron Court put it, “policy-based concerns… under [BIPA] are best addressed by the legislature.” In concluding its opinion, the Cothron Court included a “respectful suggestion” that the legislature review White Castle’s (and other defendants) concerns about excessive damage awards under BIPA and make the legislative intent clear. Hopefully, the Illinois General Assembly will heed the Supreme Court’s suggestion and take up legislation to clear up these uncertainties.

BIPA Compliance is Critical for Illinois Businesses

The Cothron decision underscores the importance of complying with BIPA’s requirements for companies that collect biometric information in Illinois. Illinois employers should take note of these recent BIPA developments, review their policies and practices to ensure they are in compliance with the law, and consider implementing additional safeguards to protect employees’ biometric data and limit exposure to BIPA liability.

For more information about BIPA compliance or litigation, please contact Joseph Franke and Jeri Baran or a member of HMB’s team.