The Illinois Supreme Court, after receiving a certified question from the U.S. Court of Appeals for the Seventh Circuit, recently held that a separate claim accrues under the Illinois Biometric Information Privacy Act each time a private entity improperly scans or transmits an individual’s biometric identifier or information.
A copy of the opinion in Cothron v. White Castle System, Inc. is available at: Link to Opinion.
A restaurant employee in Illinois filed a putative class action on behalf of all of the restaurant’s Illinois employees. The restaurant required its employees to scan their fingerprints to access their pay stubs and computers. A third-party vendor verified each scan and authorized the employee’s access.
The complaint alleged that the restaurant implemented this biometric-collection system in violation of the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/15(b) and (d), because the restaurant did not seek the employee’s consent to acquire her fingerprint biometric data until 14 years after she began her employment.
The restaurant argued that the action was untimely, stating that the employee’s claim accrued in 2008 when it first obtained her biometric data after BIPA’s effective date. The employee responded that a new claim accrued each time she scanned her fingerprints and the restaurant sent her biometric data to its third-party authenticator.
The trial court ultimately agreed with the employee. The restaurant timely appealed, and the Seventh Circuit certified the following question to the Illinois Supreme Court:
“Do section 15(b) and 15(d) claims accrue each time a private entity scans a person’s biometric identifier and each time a private entity transmits such a scan to a third party, respectively, or only upon the first scan and first transmission?”
When answering this question, the Illinois Supreme Court assumed that the restaurant’s alleged collection of the employees’ fingerprints and transmission to a third party was done in violation of BIPA.
Section 15(b) of the Act states that a private entity may not “collect, capture, purchase, receive through trade, or otherwise obtain” a person’s biometric data without first providing notice to and receiving consent from the person. Furthermore, section 15(d) instructs that a private entity may not “disclose, redisclose, or otherwise disseminate” biometric data without consent.
The Illinois Supreme Court agreed with the employee that the plain language of section 15(b) supports her interpretation that a new claim accrued every time she scanned her fingerprint.
According to the Court, “collect” means “to receive, gather, or exact from a number of persons or other sources.” Webster’s Third New International Dictionary 444 (1993). Furthermore, “capture” means “to take, seize, or catch.” Id. at 334.
The Court disagreed with the restaurant that these are things that can happen only once because it noted that the record showed that the restaurant obtained an employee’s fingerprint and stored it in its database. The employee was then required to use his or her fingerprint to access pay stubs or company computers. With the subsequent scans, the fingerprint was compared to the stored copy of the fingerprint. The Court reasoned that the restaurant failed to explain how such a system could work without collecting or capturing the fingerprint every time the employee needed to access his or her computer or pay stub.
Similarly, the Illinois Supreme Court held that the plain language of section 15(d) applied to every transmission to a third party.
The Court determined that the principal meaning of “redisclose” is “[t]o disclose again.” See WordSense Dictionary, https://www.wordsense.eu/redisclose/ (last visited Jan. 7, 2023) [https://perma.cc/ 63VU-RRTK]. Nevertheless, the Court concluded that it did not need to specifically determine the meaning of “redisclose” in section 15(d) because the other terms in that section are broad enough to include repeated transmissions to the same party. In the Court’s view, “disclose” also means to “expose to view” (Webster’s Third New International Dictionary 645 (1993)), and Webster’s gives as an example something happening more than once: “the curtain rises to [disclose] once again the lobby” (id.).
As the Court pointed out, a fingerprint scan system requires a person to expose his or her fingerprint to the system in order that the print may be compared with the stored copy, and this happens each time a person uses the system. Moreover, the Court observed that section 15(d) has a catchall provision that broadly applies to any way that an entity may “otherwise disseminate” a person’s biometric data. “Disseminate” means “to spread or send out freely or widely.” Id. at 656. The restaurant asserted that this is something that can only happen once, but the Court found that it offered no definitional support for that assertion.
Accordingly, the Illinois Supreme Court concluded that the plain language of section 15(b) and 15(d) demonstrates that a claim accrues under BIPA with every scan or transmission of biometric identifiers or biometric information without prior informed consent. Accordingly, the Court answered the certified question in favor of the employee.
