The Illinois Supreme Court recently held that a separate claim accrues under the Illinois Biometric Information Privacy Act (BIPA) each time a private entity scans or transmits an individual's biometric identifier or other protected information in violation of section 15(b) or (d) of the BIPA.
A copy of the opinion is available at: Link to Opinion
A manager for a fast food restaurant chain brought a class action suit in federal court against the restaurant chain on behalf of a putative class of employees who allegedly scanned their fingerprints to access their paystubs and company computers. The manager alleged that the restaurant chain unlawfully collected her alleged biometric information and disclosed it to its third-party vendor in violation of sections 15(b) and (d) of BIPA.
The restaurant chain filed a motion for judgment on the pleadings, arguing that the manager's claims were untimely because they first accrued when BIPA went into effect in 2008, more than 10 years before the complaint was filed. The manager responded by arguing that a new claim accrued each time she scanned her fingerprints and the restaurant chain sent her biometric data to its third-party authenticator.
The federal trial court agreed with the manager and denied the restaurant chain's motion. The trial court later certified its order for immediate interlocutory appeal, finding that its decision involved a controlling question of law on which there was substantial ground for disagreement.
The U.S. Court of Appeals for the Seventh Circuit accepted the certification and found the parties' competing interpretations of claim accrual reasonable under Illinois law and thus certified the following question to the Illinois Supreme Court:
"Do section 15(b) and 15(d) claims accrue each time a private entity scans a person's biometric identifier and each time a private entity transmits such a scan to a third party, respectively, or only upon the first scan and first transmission?"
The Illinois Supreme Court began by noting that section 15(b) of BIPA mandates informed consent from an individual before a private entity collects biometric identifiers or information. Specifically, section 15(b) provides that "[n]o private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information unless it first" obtains informed consent from the individual or the individual's legally authorized representative. 740 ILCS 14/15(b).
After reviewing section 15(b)'s plain language, the Illinois Supreme Court agreed with the manager that "collect" in the context of the statute means to "to receive, gather, or exact from a number of persons or other sources" and "capture" means "to take, seize, or catch." Webster's Third New International Dictionary 334, 444 (1993).
Additionally, the Court disagreed with the restaurant chain that these were things that could happen only once; the restaurant chain obtained an employee's fingerprint and stored it in its database, but the employee was then also required to use his or her fingerprint to access paystubs or company computers. The Court determined that the restaurant chain failed to explain how such a system could work without collecting or capturing the fingerprint every time the employee needed to access his or her computer or pay stub.
Furthermore, the Illinois Supreme Court held that the restaurant chain's suggestion that the "unless it first" phrase in section 15(b) refers only to the first collection of biometric information was inaccurate because that phrase actually refers to the private entity's statutory obligation to obtain consent or a release. See 740 ILCS 14/15(b).
Similar to section 15(b), the Court noted that section 15(d) mandates consent or legal authorization before a specific action is taken. It provides that "[n]o private entity in possession of a biometric identifier or biometric information may disclose, redisclose, or otherwise disseminate a person's or a customer's biometric identifier or biometric information unless" it obtains informed consent from the individual or their legal representative or has other legal authorization to disclose that information. 740 ILCS 14/15(d).
As with section 15(b), the Illinois Supreme Court concluded that the plain language of section 15(d) applies to every transmission to a third party. The Court reasoned that it did not need to specifically determine the meaning of "redisclose" in section 15(d) because the other terms in that section are broad enough to include repeated transmissions to the same party. "Disclose" means to "expose to view," Webster's Third New International Dictionary 645 (1993)), and Webster's gives as an example something happening more than once: "the curtain rises to [disclose] once again the lobby" Id. The Court pointed out that a fingerprint scan system requires a person to expose his or her fingerprint to the system so that the print may be compared with the stored copy and that this happens each time a person uses the system.
Additionally, the Illinois Supreme Court determined that section 15(d) has a catchall provision that broadly applies to any way that an entity may "otherwise disseminate" a person's biometric data. "Disseminate" means "to spread or send out freely or widely." Id. at 656. The restaurant chain asserted that this was something that could happen only once, but the Court found that the chain provided no definitional support for this assertion.
Accordingly, the Illinois Supreme Court answered the certified question by holding that the plain language of sections 15(b) and (d) requires that a claim accrues under BIPA upon each transmission of a person's biometric identifiers or other protected information without prior informed consent.
Lastly, the Illinois Supreme Court concluded that the statutory language made clear that the Illinois legislature chose to make damages under BIPA discretionary, rather than mandatory. However, the Court invited the Illinois legislature to address any policy-based concerns about potentially excessive damages awards.
Ralph T. Wutscher
Maurice Wutscher LLP
The Loop Center Building
105 W. Madison Street, 6th Floor
Chicago, Illinois 60602
Direct: (312) 551-9320
Fax: (312) 284-4751
Mobile: (312) 493-0874
Email: rwutscher@MauriceWutscher.com
Admitted to practice law in Illinois
Alabama | California | Florida | Illinois | Massachusetts | New Jersey | New York | Ohio | Pennsylvania | Tennessee | Texas | Washington, DC
NOTICE: We do not send unsolicited emails. If you received this email in error, or if you wish to be removed from our update distribution list, please simply reply to this email and state your intention. Thank you.
Our updates and webinar presentations are available on the internet, in searchable format, at:
Financial Services Law Updates
and
The Consumer Financial Services Blog™
and
