Illinois Supreme Court Rules That BIPA Violations Accrue With Each Scan

• Jurisdiction: Illinois,United States
• Law Firm: Proskauer Rose LLP
• Subject Matter: Litigation, Mediation & Arbitration, Privacy, Privacy Protection, Trials & Appeals & Compensation
• Author: Mr Steven Pearlman, Alexandra Oxyer and Alyssa M. Cook
• Published date: 27 February 2023

On February 17, 2023, the Illinois Supreme Court ruled that claims under the Biometric Information Privacy Act ("BIPA") may accrue with each biometric scan and not just on an individual's first scan. Cothron v. White Castle System, Inc., 2023 IL 128004.

In Cothron, the plaintiff alleged that the employer failed to follow BIPA's requirements in connection requiring employees to scan their fingerprints in order to access computer systems and pay stubs. When the case ascended to the Seventh Circuit, the employer argued that the plaintiff's claims were untimely because the fingerprints were initially collected years before BIPA went into effect. The employer asserted that only the first collection or scan of an individual's biometric information could give rise to liability, as opposed to each subsequent scan used to "match" an individual's fingerprint with the stored information. The Seventh Circuit send this issue to the Illinois Supreme Court for resolution.

The Illinois Supreme Court rejected the employer's argument, holding that BIPA violations may accrue with every subsequent scan of a fingerprint, not just the initial fingerprint capture. The Court analyzed the "plain language" of the statute, particularly section 15(b), which provides that

No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information unless it first obtains informed consent from the individual or the individual's legally authorized representative.

740 ILCS ' 14/15(b) (West 2018). The Court agreed with the district court's analysis that

Each time an employee scans her fingerprint to access the system, the system must capture her biometric information and compare...