Thought Leadership

Illinois Supreme Court Decision Exposes Employers to Significant Damages for Biometric Information Privacy Act Claims

March 10, 2023 Advisory

On Feb. 17, 2023, the Supreme Court of Illinois held that claims brought pursuant to the Illinois Biometric Information Privacy Act (BIPA) accrue with every scan or transmission of biometric information without prior informed consent. This decision is likely to lead to additional BIPA litigation in Illinois, and potentially exposes employers to astronomical damages for violations of the Act.

The Biometric Information Privacy Act, enacted in 2008, regulates the collection, use, storage and dissemination of biometric identifiers and information, including retina or iris scans, fingerprints, voiceprints, or scans of hand or face geometry. Section 15(b) of the Act provides that a private entity may not collect a person’s biometric data without first providing written notice to, and receiving written consent from, that person. Section 15(d) of the Act prohibits a private entity from disclosing or disseminating a person’s biometric data without consent or other legal authorization. The Act provides for damages of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation (in addition to attorneys’ fees and costs).

Regional restaurant chain White Castle utilized a system which required employees to scan their fingerprints to access pay stubs and computers, and a third-party vendor then verified each scan and authorized the employee’s access. In Cothron v. White Castle System, Inc., the plaintiff sought to bring a class action alleging that White Castle implemented this biometric data collection system without obtaining consent as required by the Act.

On a certified question from the U.S. Court of Appeals for the Seventh Circuit, the Supreme Court of Illinois was asked to answer whether BIPA claims accrue each time an entity scans a person’s biometric identifier and each time an entity transmits such a scan to a third party, or if such claims accrue only upon the first scan and first transmission. White Castle argued that such claims can accrue only once – when the biometric data is initially collected or disclosed. The court rejected this argument, ruling 4-3 that a separate claim accrues under the Act each time a private entity scans or transmits an individual’s biometric data in violation of the Act. (The dissent took the opposite view, stating that claims under sections 15(b) and 15(d) of the Act should accrue “only upon the first scan or transmission.”)

The majority acknowledged White Castle’s concern that allowing repeated accrual of claims by one individual “could potentially result in punitive and ‘astronomical’ damage awards that would constitute ‘annihilative liability.’” In particular, White Castle estimated that if the plaintiff was successful and allowed to bring her claims on behalf of 9,500 current and former employees, damages may exceed $17 billion. In response, the court emphasized that the “statutory language clearly supports plaintiff’s position,” and that it “has repeatedly recognized the potential for significant damages awards under the Act.” However, the court further noted that damages are discretionary, rather than mandatory, under the Act, and that “there is no language in the Act suggesting legislative intent to authorize a damages award that would result in the financial destruction of a business.” Ultimately, the court suggested that concerns about potentially excessive damages awards under the Act are best addressed by the legislature.

Employers in Illinois should carefully consider the use of biometric information in the wake of this decision and take immediate steps to ensure that such usage is consistent with the BIPA’s strict requirements. We will continue to monitor this case for additional developments, including appeal. If you have any questions specific to your organization, please contact your regular Armstrong Teasdale lawyer or one of the authors listed below.

Contact Us
  • Worldwide
  • Chicago, IL
  • Denver, CO
  • Edwardsville, IL
  • Jefferson City, MO
  • Kansas City, MO
  • Las Vegas, NV
  • Miami, FL
  • New York, NY
  • Orange County, CA
  • Philadelphia, PA
  • St. Louis, MO
  • Washington, D.C.
  • Wilmington, DE
Worldwide
abstract image of world map
Chicago, IL
100 North Riverside Plaza
Suite 1500
Chicago, IL 60606-1520
Google Maps
Chicago, Illinois
Denver, CO
4643 S. Ulster St.
Suite 800
Denver, CO 80237
Google Maps
Denver, Colorado
Edwardsville, IL
115 N. Second St.
Edwardsville, IL 62025
Google Maps
Edwardsville, Illinois
Jefferson City, MO
101 E. High St.
First Floor
Jefferson City, MO 65101
Google Maps
Jefferson City, Missouri
Kansas City, MO
2345 Grand Blvd.
Suite 1500
Kansas City, MO 64108
Google Maps
Kansas City, Missouri
Las Vegas, NV
7160 Rafael Rivera Way
Suite 320
Las Vegas, NV 89113
Google Maps
Las Vegas, Nevada
Miami, FL
355 Alhambra Circle
Suite 1200
Coral Gables, FL 33134
Google Maps
Photo of Miami, Florida
New York, NY
7 Times Square, 44th Floor
New York, NY 10036
Google Maps
New York City skyline
Orange County, CA
19800 MacArthur Boulevard
Suite 300
Irvine, CA 92612
Google Maps
Philadelphia, PA
2005 Market Street
29th Floor, One Commerce Square
Philadelphia, PA 19103
Google Maps
Philadelphia, Pennsylvania
St. Louis, MO
7700 Forsyth Blvd.
Suite 1800
St. Louis, MO 63105
Google Maps
St. Louis, Missouri
Washington, D.C.
1717 Pennsylvania Avenue NW
Suite 400
Washington, DC 20006
Google Maps
Photo of Washington, D.C. with the Capitol in the foreground and Washington Monument in the background.
Wilmington, DE
1007 North Market Street
Wilmington, DE 19801
Google Maps
Wilmington, Delaware