Justices on the Illinois Supreme Court have questioned whether Illinois' stringent biometrics privacy law should be interpreted to allow class action lawyers to extract "huge" multi-million dollar settlements from businesses fearing even worse "astronomical damages" that could run into the billions of dollars, for technical violations of the law that result in no real harm to anyone.
On May 17, the state’s high court heard arguments in a case against fast food chain White Castle. The case has been closely watched by many across the country for its potential to successfully and significantly limit, for the first time, the potential reach and impact of the state law known as the Biometric Information Privacy Act.
The proceedings centered on a key legal question, raised by White Castle: How many scans of worker fingerprints or other so-called biometric identifiers can actually be considered individual “injuries” under Illinois law?
Since 2019, fast food chain White Castle has defended itself against a class action lawsuit, accusing it of violating BIPA in how it has required workers to scan fingerprints when punching in and out of work shifts.
That lawsuit had been filed by attorney James Zouras and others with the firm of Stephan Zouras, of Chicago. The suit was filed on behalf of named plaintiff Latrina Cothron, who worked as a restaurant manager and had been employed by White Castle since 2004.
In the lawsuit, Cothron and her lawyers accused White Castle of violating the BIPA law by requiring workers to scan fingerprints without first obtaining workers’ consent and without first receiving notices concerning why the company was scanning fingerprints, and how the company would use, store, share and ultimately destroy the prints.
The claims in Cothron’s lawsuit are typical of the bulk of thousands of lawsuits that have been filed in Illinois courts under the BIPA law since about 2015. Most lawsuits to date have also typically targeted employers over worker fingerprint scans.
On the books since 2008, the BIPA law was touted by supporters as a way to govern how companies can collect Illinois’ residents so-called unique biometric identifying data, such as scans of retinas, fingerprints or faces. The law also included provisions designed to punish companies that fail to safeguard that data, or improperly share it with others.
Under the law, Illinois residents are given the ability to sue companies for improperly collecting or sharing their data, and to demand damages of $1,000-$5,000 per violation.
To this point, lawyers have generally interpreted the law to define individual violations as each time a company’s technology scans a user’s unique biometric identifier. When multiplied across hundreds, thousands or even millions of users, scanning fingerprints, faces or other biometric identifiers per day, the potential damages could quickly rise into the many millions or even billions of dollars, depending on the size of the operation.
The law, for instance, has been used to bring claims against tech giants Facebook and Google, resulting in headline-grabbing settlements of $650 million and $100 million, respectively.
Similarly fearing huge payouts, employers across the state have begun to choose to settle BIPA class actions against them, with payouts ranging from hundreds of thousands of dollars, up to $50 million, so far.
In the White Castle case, the fast food chain’s lawyers have asserted they could face damages of at least tens of millions of dollars, or far more, depending on how damages have been calculated.
To seek to limit those damages, White Castle has asked the courts to agree that injuries under BIPA occur only when a new biometric identifier is scanned or transmitted without notice or consent, not when the same fingerprints are scanned repeatedly, in a system that already contains a record of that identifier.
In Cothron’s case, they said, this would mean she should only be able to claim she suffered one “injury” under BIPA, at the time the BIPA law took effect in 2008. Cothron’s injuries did not continue to accrue each time she has scanned her fingerprint while working at White Castle in the 14 years since BIPA became law in Illinois, White Castle argued.
The case had been litigated to this point in federal court in Chicago. However, when White Castle’s legal question landed before the U.S. Seventh Circuit Court of Appeals, the federal appeals judges punted, saying the question, which deals with Illinois state law, must be answered by the Illinois Supreme Court.
VIEW AND LISTEN TO ORAL ARGUMENTS HERE
Attorney Melissa Siebert, of the firm of Shook, Hardy & Bacon, of Chicago, argued White Castle’s position before the Illinois Supreme Court.
She said White Castle’s position is in keeping with prior Illinois Supreme Court decisions regarding liability under BIPA, including the case known as Rosenbach v Six Flags, in which the court ruled plaintiffs don’t need to prove they were ever really harmed by the collection of their biometric data in order to sue under BIPA.
She said subsequent fingerprint scans by Cothron and other White Castle employees don’t amount to “continuing violations” or “new disclosures” that should trigger the risk of more damages under BIPA.
“… Once the secret is out, the secret is out. Once the privacy has been invaded, the right vanishes, and it never returns,” Siebert said. “And at that point (under Illinois Supreme Court BIPA precedent) you can sue. Nothing further need be pled.”
That point was reinforced later in the arguments by Siebert’s colleague, Matthew C. Wolfe.
He said White Castle’s position is not that Cothron lost her rights in 2008. Rather, he said, they argue Illinois law and legal precedent holds that there cannot be repeated violations if the same private information is repeatedly exchanged only between the same two parties – in this case, between Cothron and White Castle.
“Once I have someone else’s information, it doesn’t make any sense to say it is repeatedly being disclosed to me,” Wolfe said. “I already have it.”
Siebert also noted White Castle’s position does not absolve the company of any risk. The company employs more than 7,500 workers in Illinois, she said. Even under White Castle’s interpretation of Illinois law, Siebert said the company could still face liability of as much as $37.5 million, should it ultimately lose at trial.
However, should the court find each individual scan amounts to a separate violation of BIPA, White Castle’s potential liability under BIPA could run quickly into the many billions of dollars.
To this point, the Illinois Supreme Court has expressed little concern for the potential financial damage that could be inflicted on employers in Illinois under BIPA class actions. Indeed, in the landmark 2019 Rosenbach decision, justices said they believed the steep financial damages were specifically included as a strong deterrent.
However, justices on May 17 for the first time questioned whether the massive settlements to date and the even greater risk of staggering judgments were what lawmakers really intended for the BIPA law.
“This could run into multimillion dollar damages where no person was ever harmed, and no data was ever breached,” said Justice Michael Burke, a DuPage County Republican, in questions directed to Cothron’s lawyer, James Zouras. “Isn’t that disproportionate? …. Can’t we then take that next step to say Legislature clearly didn’t intend for these astronomical damages where all we have is a statutory violation.”
The question prompted Zouras to state the plaintiffs’ lawyers leading the BIPA-related class actions are not pushing for “astronomical damages,” nor do the plaintiffs’ lawyers believe it was ever the intent of state lawmakers to allow BIPA to be used to collect in such ways.
Rather, Zouras asserted the notion of damages that “could possibly soar into the atmosphere” under BIPA was “an invention” of lawyers representing the businesses targeted by the BIPA class actions he and other plaintiffs’ lawyers have filed.
“Defendants were the first ones – and the only ones – to calculate damages on that basis, that every time you scan your finger, it’s $5,000,” Zouras said.
“We don’t say that, we don’t allege that. To my knowledge, no plaintiff ever has.”
Zouras further noted no court has yet awarded damages under BIPA, as no case has yet gone to trial, even though class actions have been filed under the law for at least seven years.
That assertion prompted Justice Mary Jane Theis, a Democrat, to exclaim: “There have been settlements. Huge settlements.”
Zouras said he believed damage requests under BIPA will be held down by due process and other “constitutional questions.” He noted the law does not direct courts to award damages of $1,000-$5,000 for each improper biometric scan. Rather, he said the law says the court “may” award such damages.
“There are many alternatives to calculate damages in a more reasonable way,” Zouras said.
He said it should be left to the court to determine whether any damages should be awarded, and “the magnitude” of those damages.
Justice Robert Carter, a Democrat, however, said he was “troubled” by that reading of the law.
“There is the ‘may,’” Carter said. “It doesn’t say ‘cannot.’”
While asserting he believed the law shouldn’t be read to allow damages to “balloon” to disproportionate levels, Zouras continued to fight against White Castle’s interpretation of the law.
He maintained Cothron and other White Castle employees were “aggrieved” each time they scanned their fingerprints at work, from 2008-2018.
“This idea that Ms. Cothron was aggrieved only once works only if she lost all of her rights under the Act upon the very first collection or dissemination of her biometric data,” Zouras said. “It only works if the defendant relieved itself of all of its duties or obligations at the same moment.”
That prompted Wolfe, on rebuttal, to declare Zouras “wants to have it both ways:”
Arguing for an interpretation of the law that allows for the accrual of massive potential injuries, while claiming there is no risk for massive potential damages, because judges can use the word “may” to order only more limited payouts.
“This is a convenient position,” Wolfe said. “This court must consider the consequences of its ruling.”