* A preview from earlier this morning in anticipation of an Illinois Supreme Court ruling on Cothron v. White Castle, a Biometric Information Privacy Act case. This was prepared by Locke Lord senior counsel Ken Suh…

• This will be the second major Illinois Supreme Court decision in this month to define the scope of BIPA liability and damages.
• Earlier this month, the Court decided in Tims v. Black Horse Motor Carriers that BIPA claims were subject to a five-year statute of limitations.
• At issue in the case is when a claim under BIPA accrues. The Court’s answer will determine whether a violation of BIPA occurs every time a person’s biometric data is scanned without the proper consent or disclosure, or a violation of BIPA occurs once per individual regardless of the number of times that person’s biometric data is scanned without the proper consent or disclosure.
• The decision will have huge consequences because BIPA provides for statutory damages per violation.

o A victory for the plaintiff, could mean that businesses are liable for a statutory damages amount every time an employee’s biometric data was scanned without the proper consent or disclosure for the preceding five years.
o In contrast, a victory for defendant White Castle, will establish that every employee whose biometric data was scanned without consent or disclosure, would be entitled to a single statutory damages award regardless of the number of times their biometric data was scanned.

* Four of the seven Supreme Court justices handed down their majority opinion at about 9 this morning…

We hold that a separate claim accrues under the Act each time a private entity scans or transmits an individual’s biometric identifier or information in violation of section 15(b) or 15(d).

* The violations started in 2008, when the BIPA law took effect…

According to her complaint, plaintiff is a manager of a White Castle restaurant in Illinois, where she has been employed since 2004. Shortly after her employment began, White Castle introduced a system that required its employees to scan their fingerprints to access their pay stubs and computers. A third-party vendor then verified each scan and authorized the employee’s access. […]

In relevant part, White Castle moved for judgment on the pleadings, arguing that plaintiff’s action was untimely because her claim accrued in 2008, when White Castle first obtained her biometric data after the Act’s effective date. Plaintiff responded that a new claim accrued each time she scanned her fingerprints and White Castle sent her biometric data to its third-party authenticator, rendering her action timely with respect to the unlawful scans and transmissions that occurred within the applicable limitations period.

* More…

As with section 15(b), we conclude that the plain language of section 15(d) applies to every transmission to a third party. White Castle argues that a disclosure is something that can happen only once. The Seventh Circuit asserted that the plain meaning of “disclose” connotes a new revelation. […]

This court has repeatedly recognized the potential for significant damages awards under the Act. This court explained that the legislature intended to subject private entities who fail to follow the statute’s requirements to substantial potential liability. The purpose in doing so was to give private entities “the strongest possible incentive to conform to the law and prevent problems before they occur.” As the Seventh Circuit noted, private entities would have “little incentive to course correct and comply if subsequent violations carry no legal consequences.” […]

While we explained in Rosenbach that “subjecting private entities who fail to follow the statute’s requirements to substantial potential liability, including liquidated damages, injunctions, attorney fees, and litigation expenses ‘for each violation’ of the law” is one of the principal means that the Illinois legislature adopted to achieve the Act’s objectives of protecting biometric information, there is no language in the Act suggesting legislative intent to authorize a damages award that would result in the financial destruction of a business.

Ultimately, however, we continue to believe that policy-based concerns about potentially excessive damage awards under the Act are best addressed by the legislature. See McDonald, 2022 IL 126511, ¶¶ 48-49 (observing that violations of the Act have the potential for “substantial consequences” and large damage awards but concluding that “whether a different balance should be struck *** is a question more appropriately addressed to the legislature”). We respectfully suggest that the legislature review these policy concerns and make clear its intent regarding the assessment of damages under the Act.

* From Justice Overstreet’s dissent, joined by Justices Thiess and Holder White…

The majority’s interpretation cannot be reconciled with the plain language of the statute, the purposes behind the Biometric Information Privacy Act (Act) (740 ILCS 14/1 et seq. (West 2018)), or this court’s case law, and it will lead to consequences that the legislature could not have intended. Moreover, the majority’s interpretation renders compliance with the Act especially burdensome for employers. This court should answer the certified question by saying that a claim accrues under section 15(b) or 15(d) of the Act (id. § 15(b), (d)) only upon the first scan or transmission.

…Adding… Tribune…

In a statement, White Castle said it was “deeply disappointed with the court’s decision and the significant business disruption that will be caused to Illinois businesses, which now face potentially huge damages.” The company said it was reviewing its options to seek further judicial review, pointing to the dissent in the ruling.

Matthew Kugler, a professor at Northwestern University’s Pritzker School of Law whose research includes biometric privacy issues, said the ruling sends a clear to signal to lower courts that companies should not be required to pay out such massive damages in privacy cases.

“We will continue to see a large damages awards, but the court is signaling to the lower courts that those awards should not be larger than they were previously,” Kugler said.

*** UPDATE *** I didn’t see this my first time through, but wow…

White Castle estimates that if plaintiff is successful and allowed to bring her claims on behalf of as many as 9500 current and former White Castle employees, class- wide damages in her action may exceed $17 billion. We have found, however, that the statutory language clearly supports plaintiff’s position.

And from the dissent…

The majority acknowledges White Castle’s estimate that, if plaintiff is successful in her claims on behalf of as many as 9500 current and former White Castle employees, damages in this action may exceed $17 billion. Supra  40. Nevertheless, the majority brushes this concern aside by stating that “policy-based concerns about potentially excessive damage awards under the Act are best addressed by the legislature.”

Yikes.