As a result of two recent appeals court decisions regarding when claims under the Illinois Biometric Information Privacy Act (“BIPA” or the “Act”) (740 ILCS 14/1 et seq.) accumulate, it seems likely that the Illinois Supreme Court needs to clarify this crucial issue. First, the Illinois Court of Appeals, First District, held in Watson v. Legacy Healthcare Financial Services, LLC, et al. that claims under Articles 15 (a) and (b) of the Law accumulate with each entry and use of a requester’s identifier or biometric information. Second, in Cothron v White Castle System, Inc. the Seventh Circuit Court of Appeals declined to directly address the issue of when a BIPA claim accumulates, and instead certified the issue for consideration by the Illinois Supreme Court. While the position in Watson provides some clarity as to when some BIPA claims accumulate, it leaves open critical questions about how to calculate: (i) the number of BIPA violations; and (ii) pecuniary damages under the Law.
The case of Watson v. Legacy Healthcare Financial Services, LLC, et al. Decision
Plaintiff Brandon Watson sued Legacy Healthcare Financial Services, LLC, Lincoln Park Skilled Nursing Facility, LLC, and South Loop Skilled Nursing Facility, LLC (collectively, the “Defendants”) in March 2019, alleging that the Defendants violated the BIPA by scanning the fingers or hands of their respective employees, including the requester, for timing purposes. The applicant alleged that the scan violated Sections 15 (a) and (b) of the law, which impose both restrictions and positive obligations on private entities regarding biometric identifiers (such as fingerprints, voiceprints , retinal scans and facial geometry) and biometric information (for example, information based on biometric identifiers as far as they are used to identify an individual):
Private entities in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for the destruction of the information. 740 ILCS 14/15 (a).
Private entities that collect, capture, purchase, receive or otherwise obtain biometric data must first inform the subject of this fact in writing, as well as the specific purpose and duration for which the information will be kept, and must obtain a written authorization executed by the subject. 740 ILCS 14/15 (b).
The plaintiff alleged that he started working for at least one of the defendants in December 2012. Since the law does not contain any provision as to when the claims accumulate or the applicable limitation period, the defendants decided to dismiss, arguing that the plaintiff’s claims accumulated on the first day the defendants allegedly collected his biometric information and the plaintiff’s claims were therefore barred. In response, the plaintiff argued that his lawsuit was not time-barred because his claims were piling up with each alleged seizure of his biometric information that the defendants had obtained without notice or consent. The trial court allowed the defendants’ motion to dismiss, finding that the plaintiff’s claims were accumulating with the initial analysis of his finger or hand in December 2012. Subsequently, the trial court granted the plaintiff’s request under Rule 304 (a) for an interlocutory appeal.
The Court of Appeal overturned and remanded, finding that a claim under the Act accumulates after “every capture and use of the fingerprint or scan of the plaintiff’s hand.” To arrive at this result, the Court of Appeal analyzed the plain language of the Act and the legislative history of the Act, and accepted as true that the defendants captured the biometric information of the plaintiff twice a day when he arrived. and was coming out of work.
The Cothron System vs. White Castle, Inc. Decision
Plaintiff Latrina Cothron sued White Castle System, Inc. (“White Castle”), alleging that White Castle violated the BIPA when it required plaintiff to scan her finger to access work computers. Further, the complainant alleged that White Castle disclosed her finger scans to her third party vendor as part of the finger scan authentication process and ultimately access to work computers. Based on these allegations, the plaintiff made claims under sections 15 (b) and (d) of the Act. In addition to the obligations of Article 15 (b), described above, Article 15 (d) prohibits a private entity from disclosing, re-disclosing or otherwise disseminating biometric information without consent. 740 ILCS 14/15 (d).
White Castle sought a judgment on the pleadings, arguing that the prosecution was not timely since the plaintiff’s claims accumulated in 2008 when the BIPA was enacted. The trial court dismissed White Castle’s petition, but certified his order for immediate appeal to the Seventh Circuit. In turn, the Seventh Circuit considered the arguments of both parties and ultimately concluded that the issue of when a claim accumulates under the BIPA is a new issue that has yet to be addressed by the Supreme Court of Illinois. As a result, the Seventh Circuit stayed the proceedings in the Cothron question and certified the question of when the claims accumulate under the BIPA in the Supreme Court of Illinois.
The impact of decisions on your business
It is likely that it will take an Illinois Supreme Court ruling to further clarify when claims under the law accumulate. In the meantime, the Watson decision will obviously have an impact on the first evaluations of BIPA cases. However, it also raises at least two unrelated questions that will likely be the subject of debate and litigation in the future.
First of all, Watson was based on the allegations contained in the complaint, without the benefit of discovery and additional information regarding the operation of the finger / hand reading device (s) used by the defendants. The key to the decision is Watson the court’s conclusion that each use of the scanning device (s) results in the capture of the applicant’s biometric information, and the court’s description of this capture as resulting in a permanent record. While this statement is likely based on allegations made in the complaint, it is possible, if not likely, that it is factually inaccurate. While variations exist, the scanning technology used in many biometric timing devices creates only one permanent record, from the very first swipe of an individual’s finger or hand. Typically, subsequent scans do not collect or store information, but only exist fleetingly as comparisons of the initial, permanent scan data. Accordingly, the applicability of the Watson decision may vary depending on the actual operation of the scanners involved in a single case.
Second, in response to the defendants’ concerns about the “ruinous” damages that could result from the decision of Watson, the Court of Appeal endeavored to note that “damages are discretionary[,] not compulsory ”under the BIPA. In so ruling, the Court of Appeal concluded that Article 20 of the BIPA provides a list of possible damages, but notes that this list constitutes what is a “preponderant part”. can recover. “740 ILCS 14/20 (emphasis added). The decision of the Court of Appeal to stress the discretionary nature of the award of damages under the BIPA contrasts sharply with the position often taken by The Plaintiffs Bar. Indeed, the Plaintiffs Bar has consistently asserted that the right to recover damages under the BIPA is absolute given the 2019 Illinois Supreme Court ruling in Rosenbach v. Six Flags Entm’t Corp. However, the Rosenbach decision simply concluded that once a claimant satisfies the basic legal requirement to be “harmed”, he or she simply has “a right to to look for recovery ”under Article 20. The Watson The Court’s insistence that pecuniary damages are discretionary under the BIPA is likely to open up new avenues of discovery and arguments regarding the calculation of damages, if any, suffered by a particular claimant. of the BIPA and whether or not such damages justify the imposition of the discretionary lump sum damages set out in the act.
Ultimately, every business should critically analyze any business practice that potentially relates to biometrics (including employee timekeeping, identification procedures, or security protocols). Failure to comply with BIPA, even where such failure does not result in any actual injury to an individual, may result in significant liability. Vedder Price attorneys are at the forefront of defending BIPA claims and advising clients on BIPA disclosure policy and language.