Sliding Your Fingerprints at White Castle

The Illinois Supreme Court recently ruled that a claim under the Biometric Information Privacy Act (“BIPA”) accrues each time a private entity scans or transmits an individual’s biometric identifier or information and not just upon the first scan and first transmission. Cothron v White Castle System, Inc., 2023 IL 128004, 2023 Ill. LEXIS 156 (2023). In this case, White Castle employees were required to scan their fingerprints to access their pay stubs and computers. A third-party vendor would verify the employee’s fingerprint and authorize access. The plaintiff alleged that, for a significant period of time, White Castle did not obtain her consent to collect her data and consequently, it violated BIPA.  White Castle argued that, even if it had violated BIPA, the violation accrued only once, when the biometric data was initially collected or disclosed and not, as the plaintiff argued, each time an employee scanned their prints.

The stakes could not have been higher.  BIPA provides for statutory damages of $1,000 or $5,000 for “each” violation. Consequently, if the Court found one violation (occurring upon the first scan and first transmission) damages would be rather limited.  However, with each scan representing a separate violation with a separate award, the damages could be “staggering”.  In the dissent, Justice Overstreet noted that such an outcome could easily lead to “annihilative liability” for businesses and noted that White Castle could potentially face damages in excess of $17 billion.  Nevertheless, the majority found that the statutory language was clear and must be given effect even though the consequences may be harsh or absurd.

The Illinois Supreme Court’s ruling will have an interesting effect on the application of insurance coverage for BIPA claims. For policies covering these types of claims, issues such as the number of occurrences or wrongful acts, the application of deductibles and limits, the timing of when the occurrence or wrongful act took place, to name a few, will likely be the next battles to slide their way into the courts.

The case is Cothron v. White Castle System, Inc., Case No. 2023 L 128004, in the Supreme Court of The State of Illinois.