Labor & Employment Law Update

Right on the heels of the Illinois Supreme Court’s decision in Tims, the Court delivered yet another crushing blow to Illinois businesses in Cothron v. White Castle System, Inc. Answering the crucial question of when a Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (BIPA), claim accrues for the collection and disclosure of biometric “identifiers,” the razor thin majority found that a separate claim accrues “each time a private entity scans or transmits” an individual’s biometrics.

Under BIPA, an aggrieved person may recover $1,000, or even $5,000, for each violation. White Castle argued that, on any given day, an employee may clock-in and clock-out of a biometric timeclock at least three or four times. The company cautioned against the very finding the Court reached today, because concluding that a separate claim accrues for each scan could mean “annihilative liability” to Illinois businesses. Indeed, with this scenario of three to four scans per day, the potential damages are ruinous.

Notably, the three dissenting justices keyed into this concern, explaining: “[i]mposing punitive, crippling liability on businesses could not have been a goal of the Act, nor did the legislature intend to impose damages wildly exceeding any remotely reasonable estimate of harm.” The four-justice majority did recognize the “potential for significant damages awards” but also found that the “legislature intended to subject private entities who fail to follow the statute’s requirements to substantial potential liability.”

A potential, silver lining? The majority also explained that it “appears that the General Assembly chose to make damages discretionary rather than mandatory under the Act.” The Court took this to mean that the trial court “would certainly possess the discretion to fashion a damage award that (1) fairly compensated claiming class members and (2) included an amount designed to deter future violations, without destroying defendant’s business.” In reality, this may be small comfort because White Castle, for instance, has 9,500 employees at issue, such that the potential, class-wide damages could exceed $17 billion.

On balance, Tims and Cothron are a succession of decisions that could be devastating for Illinois businesses. They comprise the Illinois Supreme Court’s definitive interpretation that BIPA claims are subject to the longest limitations period available (five-years) and could sustain an award of crippling damages since each scan or transmission is a separate violation under the Act. 

More than ever, it would be wise to audit and assess whether BIPA applies to your business and determine if you’ve taken the necessary measures to comply. We’ve provided some takeaways earlier this month; and here is some more food for thought:

What data are you collecting?  Have a clear understanding of your collection of data, including what your vendors or third-party processors actually store or collect, and evaluate your transparency around those relationships.

What written consent and records of consent do you maintain? Regular evaluation, review and updating of disclosure and consent policies vis-à-vis any personal data of any sort is crucial to stay in front potential litigation.

Are you staying up to date on pending legislation? The firestorm of class action litigation under BIPA unequivocally demonstrates that consumer and employee rights as to their private information are only expanding, especially in certain jurisdictions. Remain aware of data privacy regulations in any state in which you are located and any state in which you reach customers or consumers. Partner with your trusted advisor to get a clear assessment of your consent and disclosure requirements and potential exposure for class action litigation.