Saying to find otherwise would produce a legal regime that could “bankrupt Illinois employers,” attorneys for fast food chain White Castle asked a federal appeals panel to determine Illinois’ biometric privacy law should be read in a way that limits damages to just one injury claim per employee, not hundreds or even thousands of claims each.
Judges on the U.S. Seventh Circuit Court of Appeals, however, appeared skeptical they could answer the legal questions at the core of the dispute, without first hearing from the Illinois Supreme Court.
On Sept. 14, a three-judge Seventh Circuit panel heard arguments from attorneys on both sides over whether they should become one of the first judicial bodies to restrict the reach of the Illinois Biometric Information Protection Act (BIPA.)
Melissa Siebert
| Shook Hardy & Bacon
In recent years, the BIPA law has spawned thousands of class action lawsuits against businesses of many different types operating in Illinois. While the lawsuits have targeted some of the world’s biggest tech companies, including Facebook and Google, it has primarily been used by plaintiffs’ lawyers to take aim at relatively quick payouts from employers.
Those lawsuits, to this point, have typically centered on the way employers have required workers scan fingerprints or other so-called biometric identifiers to verify their identity when punching the clock at the beginning or end of work shifts, or when accessing cash registers or other store devices or systems.
Specifically, the lawsuits typically accuse employers of failing to secure written consent from workers before requiring the scans, or providing them with notices concerning why the fingerprint and other biometric scans may be required, and how the employer may store, share and ultimately destroy the data.
In early 2019, attorneys with the firm of Stephan Zouras LLP, of Chicago, sued White Castle in Cook County Circuit Court on behalf of named plaintiff Latrina Cothron. According to court documents, Cothron worked as a restaurant manager, and had been employed by White Castle since 2004.
Cothron’s lawsuit accused White Castle of violating the BIPA law by requiring Cothron and other workers to scan their fingerprints without first receiving the notices and giving consent, as allegedly required by the law.
White Castle removed the case to federal court, and sought to dismiss the lawsuit. The restaurant chain argued Cothron had, in fact, provided consent, at the time she was hired in 2004, and again in 2018.
Further, White Castle asked the judge to limit the scope of the law, and restrict how much plaintiffs can claim as damages.
The law allows plaintiffs to claim damages of $1,000-$5,000 per violation.
To this point, the BIPA law has been interpreted in courts to allow plaintiffs to claim such damages for each time a worker scans their fingerprint without receiving notice or giving consent.
White Castle argued the law should not be interpreted to allow damages to accrue. Rather, they said, the law should be read to limit the damage claims to the first time each worker scanned their fingerprints.
Allowing damages to accrue would result in damages of potentially millions or even billions of dollars, depending on the size of the employer, driving companies out of business, White Castle and other business advocates have contended.
U.S. District Judge John Tharp rejected their arguments, setting the case up for appeal.
During the Sept. 14 oral arguments, White Castle attorney Melissa Siebert, of the firm of Shook Hardy and Bacon, of Chicago, reiterated White Castle’s arguments concerning the need to limit damages.
The BIPA law, she said, “should not be read to impose catastrophic damages and to bankrupt Illinois employers.”
“That’s what a per use per disclosure interpretation of BIPA will do,” Siebert said.
Cothron’s attorney James Zouras took the opposite position, asserting the “plain text of the statute” should direct the outcome.
White Castle, he said, “collected” biometric information from Cothron and many of its other workers without consent, and without “disclosing required information.”
“And it did so repeatedly over the course of 10 years,” Zouras said, from the time the BIPA law was enacted in 2008 to 2018, when the restaurant chain formally complied with the notice and consent provisions of BIPA.
The judges on the appeals panel, however, appeared to doubt whether the Seventh Circuit should rule on the question at this time.
Circuit Judge Frank Easterbrook repeatedly expressed concern over the lack of appellate rulings on the question from Illinois state courts, and especially, from the Illinois Supreme Court.
Since the questions center on a state law, he said, the Seventh Circuit should likely look to Illinois state courts for help in finding the correct answers.
Easterbrook particularly noted employers who are sued under the BIPA law have routinely taken the case to federal court, under the federal Class Action Fairness Act, to get their case away from judges in Cook County Circuit Court, a jurisdiction generally recognized as being friendly to plaintiffs in lawsuits.
The removal of those cases, however, has, to this point, limited the number of opportunities for a BIPA class action to land before the Illinois Supreme Court, to answer key questions on the law’s limitations.
Zouras said he would support punting the matter over to the Illinois Supreme Court for a hearing and decision.
Siebert, however, said she and White Castle believed prior rulings from the state Supreme Court on other questions under BIPA can be used to guide the Seventh Circuit in this case, too.
She particularly noted those rulings indicated that, at the time a plaintiff scans their fingerprints or other biometric identifier into a company’s system, their “right to privacy,” essentially “vanishes into thin air.”
Any further scans of the same fingerprint, and any further disclosure of that fingerprint to the same timeclock vendor or human resources contractor as in the initial disclosure, should not count as separate violations, Siebert said.
“It does not constitute a new injury each time the same data is published to the same audience,” Siebert said.
Judge Easterbrook, however, questioned whether the Illinois Supreme Court would see it the same way.
The panel, which also includes Chief Judge Diane Sykes and Circuit Judge Michael Brennan, has not yet ruled on the matter.