Duane Morris Privacy Class Action Review – 2024

one-time-only theory of claim accrual, holding that the lawsuit was timely because each separate unauthorized fingerprint scan constituted an independent violation of the statute, meaning the plaintiff ’ s BIPA claims were timely because her last fingerprint scan occurred within five years of the filing of her complaint. Because the issue presented a close call, however, the district court permitted White Castle to file an interlocutory appeal to the Seventh Circuit regarding whether §§ 15(b) and 15(d) claims accrue each time a private entity scans a person ’ s biometric identifier and each time a private entity transmits a scan to a third party, respectively, or only upon the first scan and first transmission. The Seventh Circuit accepted the interlocutory appeal and explained that the parties’ competing interpretations of claim accrual were reasonable under Illinois law. It ultimately agreed with the plaintiff and held that “the novelty and uncertainty of the claim-accrual question” warranted certification of the question to the Illinois Supreme Court. Id. at 1165-66. The Seventh Circuit “observed that the answer to the claim-accrual question would determine the outcome of the parties’ dispute, this court could potentially side with either party on the question, the question was likely to recur, and it involved a unique Illinois statute regularly applied by federal courts.” Id. After the Illinois Supreme Court received the certified question from the Seventh Circuit, in a 4-3 split ruling, the Illinois Supreme Court held that that a separate claim accrues under the BIPA each time a private entity scans or transmits an individual ’ s biometric identifier or information, in violation of §§ 15(b) or 15(d). In coming to this conclusion, the Illinois Supreme Court first analyzed the certified question with respect to § 15(b), which provides that no private entity “may collect, capture, purchase, receive through trade, or otherwise obtain” a person ’ s biometric data unless it first provides notice and receives written consent. 740 ILCS 14/15(b). Relying on the plain language of the statute and the fact that the actions of “collecting” and “capturing” biometric data can occur more than once, the Illinois Supreme Court agreed with plaintiff ’ s interpretation – namely, that § 15(b) “applies to every instance when a private entity collects biometric information without prior consent.” Id. at 19, 23. As interpreted in the context of the facts of the case, the Illinois Supreme Court further observed that White Castle obtained an employee ’ s fingerprint, stored it in its database, and then compared the fingerprint taken during subsequent scans to verify the identity of the employee. In the Supreme Court ’ s words, White Castle failed “to explain how such a system could work without collecting or capturing the fingerprint every time the employee needs to access his or her computer or pay stub.” Id. at 23. Accordingly, consistent with the Northern District of Illinois decision in Cothron , the Illinois Supreme Court held that an entity violates § 15(b) the first time it collects biometric data without having provided the requisite notice and obtaining consent, in addition to “each subsequent scan or collection.” Id. at 24. Closely tracking its analysis of § 15(b), the Illinois Supreme Court similarly held that § 15(d) – which prohibits the disclosure, redisclosure, or dissemination of biometric data without consent – “applies to every transmission to a third party.” Id. at 28. Like the verbs “collect” and “capture” in § 15(b), the Illinois Supreme Court reasoned that the acts of disclosing and redisclosing biometric data occur upon the initial disclosure in addition to any subsequent disclosure or redisclosure of the data. Id. The majority opinion also rejected White Castle ’ s remaining “nontextual” arguments supporting its single- accrual interpretation. White Castle argued that a BIPA claim accrued only upon the initial collection or disclosure of a person ’ s biometric data because an individual loses the right to control his or her biometric data as soon as the data is collected and/or disclosed. In rejecting the argument, the Illinois Supreme Court again relied on the statute ’ s plain language, stating: “[n]o such limitation appears in the statute. We cannot rewrite a statute to create new elements or limitations not included by the legislature.” Id. at 39.

Made with FlippingBook - professional solution for displaying marketing and sales documents online