Q: Does a BIPA claim accrue each time a person’s biometrics are scanned or only with the first such scan?

A: A BIPA claim accrues with each scan.

On February 17, the Illinois Supreme Court issued its long-awaited decision in Cothron v. White Castle, holding that a claim under Illinois’ Biometric Information Privacy Act (BIPA) is triggered upon each biometric scan, rather than just the first. The court’s 4-3 decision significantly expands the exposure BIPA defendants face.

As background, the plaintiff brought suit in the Northern District of Illinois against her employer, White Castle Systems, Inc. (White Castle) alleging numerous BIPA violations. As an employee, the plaintiff was required to scan her fingerprint to access her pay stubs and work computer. The plaintiff alleged each of these scans, which began in 2008 and continued until 2018, violated BIPA.

White Castle moved for judgment on the pleadings, arguing that the plaintiff’s claim was untimely because the first scan occurred in 2008, but she did not file suit until 2018, after the limitations period had expired. While at the time, the limitations period applicable to BIPA claims was still undecided, the parties and the court agreed to limit briefing to the accrual question first.

According to White Castle, only the initial scan of the plaintiff’s fingerprint could potentially constitute a BIPA violation. While the plaintiff argued that each time she scanned her fingerprint, a new violation occurred, and therefore there were numerous violations that occurred within the limitations period. The district court denied the motion but certified the accrual question for interlocutory appeal to the Seventh Circuit. In turn, the Seventh Circuit certified the question to the Illinois Supreme Court, finding that BIPA was a unique state statute, that the accrual question was a purely legal one and likely to frequently arise, and it was “genuinely uncertain” about the answer.

The Illinois Supreme Court ruled in the plaintiff’s favor, holding that claims under BIPA sections 15(b) and 15(d) accrue each time a private entity scans or discloses a person’s biometric identifier. For purposes of their ruling, the court assumed that White Castle’s alleged collection was done in violation of BIPA. Section 15(b) prohibits the collection of biometrics without informing the person in writing and obtaining their written release. Section 15(d) prohibits the disclosure of that biometric information to a third party without consent of the individual.

In reaching its holding, the court focused on BIPA’s definition of “collect” and disagreed with White Castle’s argument that a collection can only occur once. The court also considered White Castle’s practices, which require employees to scan their fingerprints every time they wish to access their pay stub or work computer. The scan is then compared to an existing print stored in a database to verify the employee’s identity. The court remarked, “[d]efendant fails to explain how such a system could work without collecting or capturing the fingerprint every time the employee needs to access his or her computer or pay stub.”

The court also focused on the word “disclosure” in section 15(d) and found that the plain meaning of “disclose” encompasses each new revelation. The court highlighted the catchall provision under section 15(d), which states “or otherwise disseminate” to conclude that a claim accrues upon each transmission of biometric data to a third party without prior informed consent, regardless of whether the third party already possessed that data.

Our Take

Under BIPA, a plaintiff may collect damages for “each violation,” resulting in potentially astronomical damages under Cothron. While the court briefly touched on this topic, it concluded that policy-based concerns were best addressed by the legislature. While it is unclear whether the legislature will make any changes to BIPA, this holding will undoubtedly have substantial consequences for companies using biometrics within Illinois. We anticipate significant increases in litigation, as well as spikes in settlement demands and any jury awards. Given the inspiration BIPA provides for other state biometric laws, lawmakers will likely take note as well.

Troutman Pepper will continue to monitor similar rulings in biometric cases.