On February 17, 2023, two weeks after finding that the statute of limitations for Illinois Biometric Information Privacy Act (BIPA) claims is five years, the Illinois Supreme Court clarified when this statute of limitations starts to run, or “accrues.” In a 4-3 decision, the Illinois Supreme Court held in Cothron v. White Castle System, Inc., 2023 IL 128004, that the statute of limitations for filing a BIPA lawsuit begins to run each time a private entity scans or transmits an individual’s biometrics in violation of BIPA, rather than at the first such scan or transmission. This decision is yet another pro-plaintiff finding from the Illinois Supreme Court that could expose employers and other companies to substantial damages in BIPA suits.

Background

BIPA regulates the collection, storage, disclosure and other aspects of using biometrics in Illinois, generally requiring that companies follow certain notice and consent procedures before collecting or transmitting biometrics. BIPA does not contain its own statute of limitations. The Illinois Supreme Court held in Tims et al. v. Black Horse Carries Inc., 2023 IL 127801, that a five-year limitations period, under the Illinois “catchall” limitations period, applies for any BIPA claim. But left unanswered was when the statute of limitations begins to run for a plaintiff to file suit: the first time someone’s biometrics were collected or transmitted, or each time that occurs.

In Cothron, the plaintiff, who worked at a White Castle restaurant, filed a proposed class action lawsuit under BIPA alleging that White Castle improperly collected and disclosed employees’ fingerprints in connection with its timekeeping system. White Castle sought to dismiss the complaint as barred by the statute of limitations, on the grounds that the clock to bring suit started running in 2008, when White Castle first obtained plaintiff’s biometric data allegedly in violation of BIPA. Plaintiff argued that her suit was timely because a new claim accrued – or started the statute of limitations – with each new scan or disclosure, at least one of which occurred within the applicable limitations period.

The United States District Court for the Northern District of Illinois agreed with plaintiff, finding that her claims were timely. On White Castle’s subsequent appeal, the U.S. Court of Appeals for the Seventh Circuit sought clarification on this claim accrual issue from the Illinois Supreme Court. The Illinois Supreme Court thereafter accepted this request for clarification.

The Illinois Supreme Court Finds BIPA Claims Accrue at Each Unlawful Scan or Transmission

The Illinois Supreme Court concluded that a claim accrues with each new scan or transmission, rather than only the first such scan or transmission. The Court reasoned the plain language of BIPA supports this position by requiring consent before any collection, “disagree[ing] with defendant that these are things that can happen only once.”  Likewise, according to the Court, an unlawful transmission can happen more than once. The Court also explained that this approach was consistent with its previous conclusion (in Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186), that any BIPA violation itself constitutes an “injury” under the statute.

The upshot of this decision is that potential plaintiffs have more leeway to claim BIPA violations. For example, in the context of alleged biometric timekeeping systems, an individual can bring a BIPA claim if he or she can allege an unlawful scan or transmission within five years of last using the machine – even if the first use was more than five years earlier. This means more potential plaintiffs and larger potential class sizes in BIPA class actions.

What about Damages?

In its decision, the Illinois Supreme Court recognized the potential for “astronomical” awards or “annihilative liability” if damages could be recovered for every alleged unlawful scan or transmission. Indeed, White Castle estimated that this approach could amount to more than $17 billion in class-wide damages. However, the Court stated it was constrained to follow clear statutory language and that large potential damages awards incentivize companies to comply with BIPA.

Nonetheless, the Court did not expressly endorse this approach to damages. Rather, in what could be a silver lining for defendants, the Court made clear that judges in class actions possess discretion to fashion damages as appropriate. Moreover, the Court noted that BIPA “appears” to make damages “discretionary rather than mandatory,” since it provides that a prevailing party “may recover” (rather than “shall recover”) damages. The Court also warned against damages awards “that would result in the financial destruction of a business.” The Court invited the Illinois legislature to make clear how damages should be addressed.

Next Steps for Companies Using Biometrics in Illinois

The Cothron decision provides helpful clarity by establishing when the statute of limitations starts to run in a BIPA lawsuit. Companies defending against BIPA suits also now can point to the Illinois Supreme Court’s recognition that courts should exercise discretion to avoid unreasonable damages awards. But another employee- and consumer-friendly result from this Court again should alert those deploying alleged biometric devices in Illinois to ensure they are complying with BIPA’s requirements.

This Client Alert has been prepared by Tucker Ellis LLP for the use of our clients. Although prepared by professionals, it should not be used as a substitute for legal counseling in specific situations. Readers should not act upon the information contained herein without professional guidance.