The Illinois Supreme Court's most recent rulings have cut both ways while further clarifying the contours of litigating Illinois Biometric Information Privacy Act ("BIPA") claims. On one hand, its decision in the Cothron v. White Castle
System case seemingly continues its trend to expand theoretical BIPA liability by both greatly magnifying the scope of theoretical liquidated damages while spurring even more litigation. Yet the Court's decision in Walton v. Roosevelt University offers a reprieve to employers defending BIPA claims.
White Castle v. Cothron
Cothron's facts resemble many BIPA claims populating Illinois dockets: a plaintiff filed suit alleging that their employer's implementation of a biometrically-enabled timekeeping system violated BIPA. The plaintiff's lawsuit was premised on the employer's failure to obtain a written release prior to the employee's use of that timekeeping system. Cothron introduced a wrinkle bringing the issue of claim accrual directly into issue. The plaintiff's employment started in 2004, four years before BIPA was enacted. White Castle moved to dismiss the claims as time-barred, arguing that—since the plaintiff alleged that they were required to scan their biometrics since early in their employment—the claim itself accrued upon BIPA's enactment in 2008 making 2013 the latest it should have been filed. The plaintiff countered, arguing that a BIPA violation occurred each and every time their biometrics were scanned and transmitted to third-party data processors.
While lower courts previously found that BIPA claims accrued only on the first scan, there has been no binding decision resolving the issue for the past 15 years. That changed with Cothron. The Illinois Supreme Court held that since BIPA contained no text limiting accrual to the first scan, each subsequent scan embodied a separate violation, thus extending the limitations period and significantly increasing the possible liability.
When presented with White Castle's $17 billion damage estimate, based on a potential class size of just 9,500 individuals, the Court held that it was required to effectuate BIPA's clear statutory language, even if the result was "harsh, unjust, absurd, or unwise." The Court noted that ruinous damage awards resulting from a mechanical calculation of BIPA's liquidated damages provision could be mitigated by a trial court's discretion. Since BIPA provides a trial court with the discretionary power to tailor damage awards, a judgment could be tailored so as to provide fair compensation to class members while preserving BIPA's deterrent effect without destroying defendants with ruinous penalties. The Court looked to Illinois' legislature to address potential inequities present in BIPA's liquidated damages provision.
Cothron seems to have emboldened plaintiffs to file even more suits against companies of all sizes throughout Illinois. According to a survey of Illinois' court dockets conducted by Bloomberg Law, the number of BIPA filings has increased by 65% since December 2022, with the largest spike occurring in the month immediately after the decision. If the increase in litigation is due to Cothron, it may be an unintended—but predictable—consequence of a decision which lengthened the time period in which to bring claims.
But the Court's decision might be delayed for a while longer, and it may potentially be overruled. On March 13, 2023, White Castle timely filed a petition for rehearing. White Castle's petition laid out three points of issue which it hopes will convince the Court that a new hearing, and another chance at oral argument, are warranted: The technology underlying biometrically-enabled timekeeping and security access scanning systems generally does not create and transmit scans or copies of biometrics on each use.
Instead, the devices generate "data" on the first scan - often anonymized alphanumeric codes which do not actually identify individuals - which are stored into a central database for authentication purposes (often called the "enrollment process"). But each subsequent scan compares the previously stored codes rather than recapturing or transmitting them. Thus, the "BIPA injury" only occurs once and follow-up scans do not transmit biometric data enabling identification in the broader population such as to constitute a "new loss of secrecy."
The Court exceeded previously understood bounds of statutory interpretation by interpreting BIPA's elements in such a manner that unreasonable damages are essentially unavoidable. White Castle pointed to the Court's own statements indicating acknowledgment that "harsh, unjust, absurd, or otherwise unwise" results would flow from its mechanical application of BIPA's provisions. White Castle also noted that liquidated damages must conceptually be based on "a reasonable approximation of the plaintiff's damages" – an approximation missing from the legislative history and the current multiplicative damages scheme (also troubling since there have been no actual damages in any BIPA case to date).
Rather than clarifying how damages should be calculated under BIPA, the Court's statement that liquidated damages "appeared to be discretionary" introduced vagueness into how the lower courts and juries are supposed to assess damages. This is White Castle's last chance to change the Court's mind: no further petitions are allowed if it is denied.
Walton v. Roosevelt University
While litigants were assessing Cothron's effect on their legal strategies, the Court confirmed that at least one defense remained for employers defending employee-led class actions. Walton v. Roosevelt University presented similar facts to Cothron. The key difference: a union agreement with alternative dispute resolution procedures for employee grievances was in place. The First District Appellate Court previously found in favor of enforcing the agreement, finding that the Labor Management Relations Act (the "LMRA") preempted the employee's BIPA claims from proceeding in state court. The plaintiff appealed.
On March 23, 2023, the Court affirmed the First District's decision, finding that broad management rights clauses encompass BIPA claims even without express references to biometrics in the agreement's terms. The Court recognized the uniformity among federal courts interpreting the LMRA in the context of BIPA claims on this point. Since timekeeping procedures are "a proper subject of negotiation between unions and employers", BIPA complaints related to employers' use of biometrically-enabled timekeeping systems are "clearly covered" by collective bargaining agreements. Corollary to that point, the employers' implementation of retention and destruction schedules for biometric data are likewise subject to a collective bargaining agreement's terms.
There is no sign that plaintiff intends to appeal, but the holding presents some reminders for employers defending BIPA claims: Employers should be vigilant while re-negotiating their union agreements to include or retain broad managements-rights clauses and avoid carve-outs.
Employers currently facing BIPA class action litigation should check their union agreement's terms to confirm whether union employees in their cases constitutes a distinct sub-category of putative class members whose claims should be dismissed and subject to collective bargaining dispute resolution procedures.
Originally Published in Illinois State Bar Association's Labor & Employment Law News
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
