Illinois Supreme Court Find BIPA Claims Accrue Upon Each Scan and/or Disclosure



By Pat Eckler, Amy Frantz, Glenn Klinger, Michael Sanders, and Jonathan Schwartz

The long-awaited decision from the Illinois Supreme Court on how claims accrue under Subsections 15(b) and 15(d) of the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 (“BIPA”), brings no better a result for businesses and their insurance carriers than the Court’s recent decision in Tims v. Black Horse Carriers, Inc., 2023 IL 127801, which found that a five-year limitations period applies to all claims under BIPA (covered in FMG’s February 7, 2023 blog).   

In Cothron v. White Castle Sys., Inc., 2023 IL 128004, the Illinois Supreme Court held that, for purposes of Subsection 15(b), a cause of action accrues each time a private entity allegedly scans a person’s biometric identifier, and that, under Subsection 15(d), a cause of action accrues each time a private entity allegedly transmits such a scan to a third party.  The majority’s decision, apparently based on the plain language of Subsections 15(b) and 15(d), found that the requirement in Subsection 15(b) that private entities must notify individuals of the “length of term for which a biometric identifier or biometric information is being collected, stored, and used” means that the Legislature contemplated collection “as being something that would happen more than once.”  As to Subsection 15(d), the majority noted that statutory terms like “disclose” connote a new revelation, which means the statute contemplates that more than one violation may occur, i.e., a claimed violation in connection with every alleged transmission. 

Since BIPA allows for an award of $1,000 per violation or $5,000 per intentional or reckless violation, White Castle and the amici argued that such a finding could spell “annihilative liability” for businesses in Illinois.  The majority observed, however, that it has “repeatedly recognized the potential for significant damages awards under” BIPA, that private entities would have “little incentive to course correct and comply if subsequent violations carry no legal consequences,” and that it previously admonished (in McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511) that “whether a different balance should be struck … is a question more appropriately addressed to the legislature.”  The majority then specifically called on the Legislature to answer whether such massive damages (with the potential to “result in the financial destruction of a business”) were the intent of BIPA.  Yet, the majority noted that because trial courts have the discretion to fashion appropriate damages awards, and the Legislature appears to have made damages discretionary, and not mandatory, companies may not actually face annihilation. 

Despite that recognition, the majority did nothing to alleviate the likelihood of excessive settlement demands by class action lawyers amidst continuing disputes over the applicability of insurance coverage disputes over BIPA claims.  Relatedly, we await the response by Illinois trial courts and district courts to the Supreme Court’s invitation to use their discretion to reduce potential damage awards so as to not make them annihilative or financially destructive.   

Notably, an area of uncharted territory under BIPA, which White Castle should bring to light, is whether both a $1,000 and $5,000 award per violation is inherently punitive, and therefore, may not be covered by many insurance policies.  Relatedly, businesses are now more incentivized to bring Due Process challenges to BIPA awards on grounds that they are grossly disproportionate to the harm caused by the technical violation of the statute.   

In the meantime, and until the Legislature responds (there have been multiple bills proposed thus far to rectify the mistakes inherent in the BIPA statute), businesses and their insurance carriers are certain to face off against the backdrop of exponentially more alleged BIPA violations. 

Please contact your local FMG attorney with any questions.