LATRINA COTHRON, Appellee, v. WHITE CASTLE SYSTEM, INC., Appellant.
Docket No. 128004
SUPREME COURT OF THE STATE OF ILLINOIS
February 17, 2023
2023 IL 128004
Justices Neville, Cunningham, and O‘Brien concurred in the judgment and opinion.
Justice Overstreet dissented, with opinion, joined by Chief Justice Theis and Justice Holder White.
OPINION
¶ 1 This case requires us to construe section 15(b) and 15(d) of the Biometric Information Privacy Act (Act) (
I. BACKGROUND
¶ 2 ¶ 3 We recite the facts as provided by the Seventh Circuit in its certification ruling. See, e.g., In re Hernandez, 2020 IL 124661, ¶ 5. The controversy arises from a proposed class action filed by plaintiff, Latrina Cothron, on behalf of all Illinois employees of defendant, White Castle System, Inc. (White Castle). Plaintiff originally filed her action in the circuit court of Cook County against White Castle and its third-party vendor, Cross Match Technologies. Cross Match Technologies removed the case to federal court under the Class Action Fairness Act of 2005 (
¶ 4 According to her complaint, plaintiff is a manager of a White Castle restaurant in Illinois, where she has been employed since 2004. Shortly after her employment began, White Castle introduced a system that required its employees to scan their fingerprints to access their pay stubs and computers. A third-party vendor then verified each scan and authorized the employee‘s access.
¶ 5 Generally, plaintiff‘s complaint alleged that White Castle implemented this biometric-collection system without obtaining her consent in violation of the Act (
¶ 6 Plaintiff asserted that White Castle did not seek her consent to acquire her fingerprint biometric data until 2018, more than a decade after the Act took effect. Accordingly, plaintiff claimed that White Castle unlawfully collected her biometric data and unlawfully disclosed her data to its third-party vendor in violation of section 15(b) and 15(d), respectively, for several years.
¶ 7 In relevant part, White Castle moved for judgment on the pleadings, arguing that plaintiff‘s action was untimely because her claim accrued in 2008, when White Castle first obtained her biometric data after the Act‘s effective date. Plaintiff responded that a new claim accrued each time she scanned her fingerprints and White Castle sent her biometric data to its third-party authenticator, rendering her action timely with respect to the unlawful scans and transmissions that occurred within the applicable limitations period.
¶ 8 The district court agreed with plaintiff and denied White Castle‘s motion. Cothron v. White Castle System, Inc., 477 F. Supp. 3d 723, 734 (N.D. Ill. 2020). The court later certified its order for immediate interlocutory appeal, finding that its decision involved a controlling question of law on which there is substantial ground for disagreement.
¶ 9 The United States Court of Appeals for the Seventh Circuit accepted the certification. After determining that plaintiff had standing to bring her action in federal court under article III of the United States Constitution (
¶ 10 We chose to answer that question. See Ill. S. Ct. R. 20(a) (eff. Aug. 1, 1992). The Illinois Chamber of Commerce, Chamber of Commerce of the United States, Retail Litigation Center, Inc., Restaurant Law Center, National Retail Federation, Illinois Manufacturers’ Association, National Association of Manufacturers, Illinois Health and Hospital Association, Illinois Retail Merchants Association, Chemical Industry Council of Illinois, Illinois Trucking Association, Mid-West Truckers Association, and Chicagoland Chamber of Commerce were granted leave to file amicus curiae briefs in support of White Castle‘s position. Ill. S. Ct. R. 345 (eff. Sept. 20, 2010). The American Association for Justice, Employment Law Clinic of the University of Chicago Law School‘s Edwin F. Mandell Legal Aid Clinic, NELA/Illinois National Employment Law Project, Raise the Floor Alliance, and Electronic Privacy Information Center (EPIC) were granted leave to file amicus curiae briefs in support of plaintiff‘s position. Id.
II. ANALYSIS
¶ 11 ¶ 12 The certified question asks: “Do section 15(b) and 15(d) claims accrue each time a private entity scans a person‘s biometric identifier and each time a private entity transmits such a scan to a third party, respectively, or only upon the first scan and first transmission?” When answering this question, we assume, without deciding, that White Castle‘s alleged collection of plaintiff‘s fingerprints and transmission to a third party was done in violation of the Act.
¶ 13 Section 15(b) of the Act provides:
“No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person‘s or a customer‘s biometric identifier or biometric information, unless it first:
(1) informs the subject or the subject‘s legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored;
(2) informs the subject or the subject‘s legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and
(3) receives a written release executed by the subject of the biometric identifier or biometric information or the subject‘s legally authorized representative.”
740 ILCS 14/15(b) (West 2018).
“[n]o private entity in possession of a biometric identifier or biometric information may disclose, redisclose, or otherwise disseminate a person‘s or a customer‘s biometric identifier or biometric information unless:
*** the subject of the biometric identifier or biometric information or the subject‘s legally authorized representative consents to the disclosure or redisclosure[.]”
Id. § 15(d)(1) .
¶ 15 Relevant to this case, the Act further defines the term “biometric identifier” to include a fingerprint and the term “biometric information” to include any information based on an individual‘s biometric identifier used to identify that person.
¶ 16 White Castle argues that section 15(b) and 15(d) claims can accrue only once—when the biometric data is initially collected or disclosed. Section 15(b) provides that no private entity “may collect, capture, purchase, receive through trade, or otherwise obtain a person‘s or a customer‘s biometric identifier or biometric information, unless it first” provides notice and receives consent as outlined in the rest of section 15(b). (Emphasis added.)
¶ 17 White Castle advances a similar argument for section 15(d), noting that it provides that no private entity “in possession of a biometric identifier or biometric information may disclose, redisclose, or otherwise disseminate a person‘s or a customer‘s biometric identifier or biometric information unless” the private entity has obtained consent or certain exceptions apply.
¶ 18 Plaintiff responds that the plain meaning of the statutory language demonstrates that claims under section 15(b) and 15(d) accrue every time a private entity collects or disseminates biometrics without prior informed consent. According to plaintiff, this construction is consistent with the plain meaning of the statutory language, gives effect to every word in the provision, and directly reflects legislative intent to provide an individual with a meaningful and informed opportunity to decline the collection or dissemination of their biometrics. It also provides an incentive for private entities that collect biometric information to take action to mitigate their conduct if they neglected to comply at first.
¶ 19 Plaintiff maintains that section 15(b) applies to every instance when a private entity collects biometric information without prior consent. According to plaintiff, the word “first” in section 15(b) modifies the words “informs” and “receives.” Thus, according to plaintiff, an entity violates section 15(b) when it collects, captures, or otherwise obtains a person‘s biometrics without prior informed consent. Plaintiff observes that our appellate court reached the same conclusion in Watson v. Legacy Healthcare Financial Services, LLC, 2021 IL App (1st) 210279,
¶ 20 To resolve the parties’ dispute and answer the certified question, we focus on the language of the Act itself. The cardinal principle and primary objective in construing a statute is to ascertain and give effect to the intention of the legislature. Roberts v. Alexandria Transportation, Inc., 2021 IL 126249, ¶ 29. The best indicator of legislative intent is the statutory language itself, given its plain and ordinary meaning. In re Hernandez, 2020 IL 124661, ¶ 18. Where the language is clear and unambiguous, we must apply the statute without resort to further aids of statutory construction. Krohe v. City of Bloomington, 204 Ill. 2d 392, 395 (2003). Only if the statutory language is ambiguous may we look to other sources to ascertain the legislature‘s intent. Id.
Section 15(b)
¶ 21 ¶ 22 Section 15(b) mandates informed consent from an individual before a private entity collects biometric identifiers or information. Specifically, section 15(b) provides that “[n]o private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person‘s or a customer‘s biometric identifier or biometric information unless it first” obtains informed consent from the individual or the individual‘s legally authorized representative.
¶ 23 We agree with plaintiff that the plain language of the statute supports her interpretation. “Collect” means to “to receive, gather, or exact from a number of persons or other sources.” Webster‘s Third New International Dictionary 444 (1993). “Capture” means “to take, seize, or catch.” Id. at 334. We disagree with defendant that these are things that can happen only once. As plaintiff explains in her complaint, White Castle obtains an employee‘s fingerprint and stores it in its database. The employee must then use his or her fingerprint to access paystubs or White Castle computers. With the subsequent scans, the fingerprint is compared to the stored copy of the fingerprint. Defendant fails to explain how such a system
¶ 24 We agree with the federal district court that “[a] party violates Section 15(b) when it collects, captures, or otherwise obtains a person‘s biometric information without prior informed consent. This is true the first time an entity scans a fingerprint or otherwise collects biometric information, but it is no less true with each subsequent scan or collection.” Cothron, 477 F. Supp. 3d at 732. Our appellate court has reached the same conclusion, determining that “the plain language of [section 15(b)] establishes that it applies to each and every capture and use of plaintiff‘s fingerprint or hand scan. Almost every substantive section of the Act supports this finding.” Watson, 2021 IL App (1st) 210279, ¶ 46.
Section 15(d)
¶ 26 ¶ 27 Similar to section 15(b), section 15(d) mandates consent or legal authorization before a specific action is taken. It provides that “[n]o private entity in possession of a biometric identifier or biometric information may disclose, redisclose, or otherwise disseminate a person‘s or a customer‘s biometric identifier or biometric information unless” it obtains informed consent from the individual or their legal representative or has other legal authorization to disclose that information.
¶ 28 As with section 15(b), we conclude that the plain language of section 15(d) applies to every transmission to a third party. White Castle argues that a disclosure is something that can happen only once. The Seventh Circuit asserted that the plain meaning of “disclose” connotes a new revelation. See Cothron, 20 F.4th at 1163; see also Webster‘s Third New International Dictionary 645 (1993) (defining “disclose” as “to make known” or “to reveal *** something that is secret or not generally known“). In determining that an entity violates section 15(d) every time it discloses or otherwise disseminates biometric data, the district court focused on this section‘s use of the term “redisclose.” Cothron, 477 F. Supp. 3d at 733. The district court agreed with plaintiff that repeated transmissions to the same third party are “redisclosures.” Id. As the Seventh Circuit court pointed out, however, the issue is not quite so simple:
“[Cothron] reads the term ‘redisclose’ as used in section 15(d) to include repeated disclosures of the same biometric data to the same third party. For its part, White Castle offers a different interpretation of the term: a downstream
disclosure carried out by a third party to whom information was originally disclosed. That reading is consistent with the term ‘redisclose’ as used in other Illinois statutes.2 Countering again, Cothron argues that this usage would make ‘redisclose’ meaningless surplusage. Section 15(d) applies to any ‘private entity in possession of a biometric identifier or biometric information.’ As such, a violation by a down-stream entity can just be called a ‘disclosure,’ making ‘redisclose’ redundant under White Castle‘s reading. Maybe so; or maybe ‘redisclose’ serves to make certain that down-stream entities are subject to section 15(d). See Reid Hosp. & Health Care Servs., Inc. v. Conifer Revenue Cycle Sols., LLC, 8 F.4th 642, 652 (7th Cir. 2021) (noting the tension between the anti-surplusage canon and the belt-and-suspenders drafting approach).” Cothron, 20 F.4th at 1164.
¶ 29 We note that, even in the dictionary relied upon by White Castle, the principal meaning of “redisclose” is “[t]o disclose again.” See WordSense Dictionary, https://www.wordsense.eu/redisclose/ (last visited Jan. 7, 2023) [https://perma.cc/63VU-RRTK]. Nevertheless, we do not believe that we have to specifically determine the meaning of “redisclose” in section 15(d) because the other terms in that section are broad enough to include repeated transmissions to the same party. “Disclose” also means to “expose to view” (Webster‘s Third New International Dictionary 645 (1993)), and Webster‘s gives as an example something happening more than once: “the curtain rises to [disclose] once again the lobby” (emphasis added) (id.). A fingerprint scan system requires a person to expose his or her fingerprint to the system so that the print may be compared with the stored copy, and this happens each time a person uses the system. Moreover, section 15(d) has a catchall provision that broadly applies to any way that an entity may “otherwise disseminate” a person‘s biometric data. “Disseminate” means “to spread or send out freely or widely.” Id. at 656. White Castle asserts that this is something that can happen only once but provides no definitional support for that assertion. Thus, we
¶ 30 We agree with the district court‘s explanation of how sections 15(b) and (d) are violated:
“Section 15(b) provides that no private entity ‘may collect, capture, purchase, receive through trade, or otherwise obtain’ a person‘s biometric information unless it first receives that person‘s informed consent.
740 ILCS 14/15(b) . This requirement is violated—fully and immediately—when a party collects biometric information without the necessary disclosure and consent. Similarly, Section 15(d) states that entities in possession of biometric data may only disclose or ‘otherwise disseminate’ a person‘s data upon obtaining the person‘s consent or in limited other circumstances inapplicable here.740 ILCS 14/15(d) . Like Section 15(b), an entity violates this obligation the moment that, absent consent, it discloses or otherwise disseminates a person‘s biometric information to a third party.” Cothron, 477 F. Supp. 3d at 730-31.
We believe that the plain language of section 15(b) and 15(d) demonstrates that such violations occur with every scan or transmission.
White Castle‘s Other Arguments
¶ 31 ¶ 32 We are not persuaded by White Castle‘s nontextual arguments in support of its single-accrual interpretation. Citing Feltmeier v. Feltmeier, 207 Ill. 2d 263 (2003), White Castle maintains that under Illinois law a claim accrues when a legal right is invaded and an injury inflicted. White Castle maintains that this court‘s decisions interpreting the Act define a right to secrecy in and control over biometric data and define the “injury” as loss of control or secrecy.
¶ 33 Citing Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, ¶¶ 33-34, White Castle contends that the Act allows a claim for an individual‘s loss of the “right to control” biometric information and that, once an individual loses control over the secrecy in his or her biometric information, it cannot be recreated, resulting in the loss of any confidentiality. See also West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978, ¶ 46 (explaining that the Act protects a “secrecy interest“); McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511, ¶ 24 (reiterating that the Act protect an individual‘s ” ‘right to privacy in and control over their biometric identifiers and biometric information’ ” (quoting Rosenbach, 2019 IL 123186, ¶ 33)).
¶ 34 Relying on this precedent, White Castle contends that, when a party collects or discloses biometric information without complying with the Act‘s notice and consent requirements, an individual‘s rights have been invaded, an injury has occurred, and the plaintiff may immediately sue. In other words, “the invasion and injury are one and the same and occurred upon [p]laintiff‘s initial loss of control of her biometrics.” For purposes of claim accrual under sections 15(b) and 15(d), White Castle argues that the claim accrues only on the initial scan or transmission of biometric information. Because a person cannot keep information secret from another entity that already has it, White Castle contends that the loss of an individual‘s right to control his or her biometrics is a “single overt act” that encompasses both the invasion of the interest and the infliction of the injury. See Feltmeier, 207 Ill. 2d at 279. Thus, a claim under section 15(b) or 15(d) can accrue only the first time the information is collected or disclosed. We disagree.
¶ 35 White Castle misreads our decisions in Rosenbach, West Bend Mutual Insurance Co., and McDonald. As a preliminary observation, we note that none of those decisions involved, let alone analyzed, the question of claim accrual under the Act.
¶ 36 In fact, we find that Rosenbach supports our construction of sections 15(b) and 15(d). This court recognized in Rosenbach that the Act operates to codify an individual‘s right to privacy in and control over his or her biometric identifiers and information. Rosenbach, 2019 IL 123186, ¶ 33. Importantly, we determined in Rosenbach that a person is “aggrieved” or injured under the Act “when a private entity fails to comply with one of section 15‘s requirements.” Id.
¶ 37 Focusing on the section 15 violation in Rosenbach, the same provision at issue in this case, we determined that, “[w]hen a private entity fails to comply with one of section 15‘s requirements, that violation constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose biometric identifier or biometric information is subject to the breach.” Id. Critically, Rosenbach
¶ 38 Thus, contrary to White Castle‘s position, Rosenbach does not stand for the proposition that the “injury” for a section 15 claim is predicated on, or otherwise limited to, an initial loss of control or privacy. Instead, Rosenbach clearly recognizes the statutory violation itself is the “injury” for purposes of a claim under the Act, which is entirely consistent with our decision here. Our subsequent decisions in West Bend Mutual Insurance Co. and McDonald adhered to Rosenbach‘s construction of the Act and similarly recognized that a claim under the Act is a private cause of action based exclusively on a statutory violation. West Bend Mutual Insurance Co., 2021 IL 125978, ¶ 46 (citing Rosenbach); McDonald, 2022 IL 126511, ¶ 23 (citing Rosenbach).
¶ 39 Put simply, our caselaw holds that, for purposes of an injury under section 15 of the Act, the court must determine whether a statutory provision was violated. Consequently, we reject White Castle‘s argument that we should limit a claim under section 15 to the first time that a private entity scans or transmits a party‘s biometric identifier or biometric information. No such limitation appears in the statute. We cannot rewrite a statute to create new elements or limitations not included by the legislature. Zahn v. North American Power & Gas, LLC, 2016 IL 120526, ¶ 15.
¶ 40 White Castle and amici supporting White Castle‘s position caution this court against construing section 15(b) and section 15(d) to mean that a claim accrues for each scan or transmission of biometric information made in violation of those provisions. They assert that, because section 20 of the Act sets forth liquidated damages that a party may recover for “each violation,” allowing multiple or repeated accruals of claims by one individual could potentially result in punitive and “astronomical” damage awards that would constitute “annihilative liability” not contemplated by the legislature and possibly be unconstitutional. For example, White Castle estimates that if plaintiff is successful and allowed to bring her claims on behalf of as many as 9500 current and former White Castle employees, class-wide damages in her action may exceed $17 billion. We have found, however, that the statutory language clearly supports plaintiff‘s position. As the district court observed, this court has repeatedly held that, where statutory language is clear, it
¶ 41 This court has repeatedly recognized the potential for significant damages awards under the Act. Rosenbach, 2019 IL 123186, ¶¶ 36-37; McDonald, 2022 IL 126511, ¶ 48. This court explained that the legislature intended to subject private entities who fail to follow the statute‘s requirements to substantial potential liability. Rosenbach, 2019 IL 123186, ¶ 36. The purpose in doing so was to give private entities “the strongest possible incentive to conform to the law and prevent problems before they occur.” Id. ¶ 37. As the Seventh Circuit noted, private entities would have “little incentive to course correct and comply if subsequent violations carry no legal consequences.” Cothron, 20 F.4th at 1165.
¶ 42 All of that said, we generally agree with our appellate court‘s recognition that “[a] trial court presiding over a class action—a creature of equity—would certainly possess the discretion to fashion a damage award that (1) fairly compensated claiming class members and (2) included an amount designed to deter future violations, without destroying defendant‘s business.” Century Mutual Insurance Co. v. Tracy‘s Treasures, Inc., 2014 IL App (1st) 123339, ¶ 72. It also appears that the General Assembly chose to make damages discretionary rather than mandatory under the Act. See
¶ 43 Ultimately, however, we continue to believe that policy-based concerns about potentially excessive damage awards under the Act are best addressed by the
III. CONCLUSION
¶ 44 ¶ 45 In sum, we conclude that the plain language of section 15(b) and 15(d) shows that a claim accrues under the Act with every scan or transmission of biometric identifiers or biometric information without prior informed consent.
¶ 46 Certified question answered.
¶ 47 JUSTICE OVERSTREET, dissenting:
¶ 48 I respectfully disagree with my colleagues’ answer to the certified question. The majority‘s interpretation cannot be reconciled with the plain language of the statute, the purposes behind the Biometric Information Privacy Act (Act) (
¶ 49 The principles guiding our analysis are set forth in Feltmeier v. Feltmeier, 207 Ill. 2d 263, 278-79 (2003). This court held that, generally, “a limitations period begins to run when facts exist that authorize one party to maintain an action against another.” Id. at 278. Moreover, “where there is a single overt act from which subsequent damages may flow, the statute begins to run on the date the defendant invaded the plaintiff‘s interest and inflicted injury.” Id. at 279. Thus, to resolve the question of when claims accrue under section 15(b) and (d), we must consider
¶ 50 Two considerations inform this inquiry: (1) what interests does the Act seek to protect and (2) what constitutes a violation of section 15(b) or (d) under the plain language of those provisions? This court has addressed the first question several times. In Rosenbach, this court explained that “[t]he Act vests in individuals and customers the right to control their biometric information by requiring notice before collection and giving them the power to say no by withholding consent.” Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, ¶ 34. This court further explained that the “precise harm” the legislature sought to prevent was an individual‘s loss of the right to maintain biometric privacy. Id. In West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978, ¶ 46, this court stated that the Act “protects a secrecy interest,” such as an individual‘s right to “keep his or her personal identifying information like fingerprints secret.” Finally, in McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511, ¶ 24 (quoting Rosenbach, 2019 IL 123186, ¶ 33), this court reiterated that the Act protects an individual‘s ” ‘right to privacy in and control over their biometric identifiers and biometric information.’ ”
¶ 51 Turning to the language of the statute, section 15(b) requires certain disclosures to be made, and a written release obtained, before that entity may “collect, capture, purchase, receive through trade, or otherwise obtain a person‘s or a customer‘s biometric identifier or biometric information.”
¶ 52 The Watson court held that section 15(b) means that “an entity must inform a subject and receive a release ‘before’ it collects or captures. *** [T]here is no temporal limitation on ‘collects’ or ‘captures,’ thereby applying to the first, as well
¶ 53 The above reading of the statute is the only one consistent with the purposes of the Act. As this court explained in Rosenbach, the “precise harm” the legislature was addressing was an individual‘s loss of the right to maintain biometric privacy. Rosenbach, 2019 IL 123186, ¶¶ 33-34; McDonald, 2022 IL 126511, ¶ 24. And in Krishna, 2021 IL 125978, ¶ 46, this court stated that the Act “protects a secrecy interest,” such as an individual‘s right to “keep his or her personal identifying information like fingerprints secret.”3 An individual loses his or her privacy in and
¶ 54 Thus, I agree with White Castle‘s argument on appeal: “Plaintiff‘s injury under [section] 15(b) occurred, if at all, the first time that her biometrics were collected by White Castle without her consent, not each subsequent time that her finger was rescanned.” There is only one loss of control or privacy, and this happens when the information is first obtained. Indeed, the legislative findings in the Act confirm this. See
¶ 55 The analysis is the same for section 15(d) claims. Under section 15(d), a private entity in possession of a person‘s biometric identifier or information must obtain that person‘s consent before it may “disclose, redisclose, or otherwise disseminate a person‘s or a customer‘s biometric identifier or biometric information.”
¶ 57 Although the majority holds that it need not determine the meaning of “redisclose” in section 15(d) (supra ¶ 28), the definition of “redisclose” found in the WordSense Dictionary, https://www.wordsense.eu/redisclose/ (last visited Jan. 7, 2023) [https://perma.cc/63VU-RRTK] (“[t]o disclose again; to disclose what has been disclosed to the discloser” (emphasis added)) is consistent with how the term is used by the Illinois legislature. See Cothron, 20 F.4th at 1164. As noted by the majority, the Seventh Circuit gave two examples: section 35.3(b) of the Children and Family Services Act (
¶ 59 The majority acknowledges that, in construing the Act as it has, the consequences may be harsh, unjust, absurd, or otherwise unwise. Supra ¶ 40. In doing so, the majority ignores that the construction of a statute that leads to an absurd result must be avoided. Mulligan v. Joliet Regional Port District, 123 Ill. 2d 303, 312-13 (1988). Instead, a court construing the language of a statute should
” ‘assume that the legislature did not intend to produce an absurd or unjust result’ (State Farm Fire & Casualty Co. v. Yapejian, 152 Ill. 2d 533, 541 (1992)), and [should] avoid a construction leading to an absurd result, if possible (City of East St. Louis v. Union Electric Co., 37 Ill. 2d 537, 542 (1967)).” Hubble v. Bi-State Development Agency of the Illinois-Missouri Metropolitan District, 238 Ill. 2d 262, 283 (2010).
¶ 60 In considering the consequences of construing the Act one way or another and giving each word of the statute a reasonable meaning (Haage v. Zavala, 2021 IL 125918, ¶ 44), two significant consequences militate against the majority‘s construction. First, under the majority‘s rule, plaintiffs would be incentivized to delay bringing their claims as long as possible. If every scan is a separate,
¶ 61 Next, the majority‘s construction of the Act could easily lead to annihilative liability for businesses. As the Seventh Circuit explained:
“White Castle reminds us that the Act provides for statutory damages of $1,000 or $5,000 for ‘each violation’ of the statute. § 14/20. Because White Castle‘s employees scan their fingerprints frequently, perhaps even multiple times per shift, Cothron‘s interpretation could yield staggering damages awards in this case and others like it. If a new claim accrues with each scan, as Cothron argues, violators face potentially crippling financial liability.” Cothron, 20 F.4th at 1165.
The majority acknowledges White Castle‘s estimate that, if plaintiff is successful in her claims on behalf of as many as 9500 current and former White Castle employees, damages in this action may exceed $17 billion. Supra ¶ 40. Nevertheless, the majority brushes this concern aside by stating that “policy-based concerns about potentially excessive damage awards under the Act are best addressed by the legislature.” Supra ¶ 43.
¶ 62 However, we are not being asked to render a decision on the damages in this case or to make a policy-based decision about excessive damages. Rather, we are being asked to determine legislative intent by considering the consequences of construing the statute one way or another. Surely the potential imposition of crippling liability on businesses is a proper consequence to consider. When the plaintiff argued in the Seventh Circuit that the calculation of damages is separate from claim accrual, that court pointed out that plaintiff “does not explain how alternative theories of calculating damages might be reconciled with the text of section 20.” Cothron, 20 F.4th at 1165. Given that plaintiff argues that every scan is a violation and the statute sets forth what an aggrieved person may recover for
¶ 63 Imposing punitive, crippling liability on businesses could not have been a goal of the Act, nor did the legislature intend to impose damages wildly exceeding any remotely reasonable estimate of harm. Rather, the legislature recognizes that the use of biometrics is an emerging area whose ramifications are not completely known and that it is in the public interest to regulate the “collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.”
¶ 64 The majority fails to set forth any similar dire consequences with White Castle‘s interpretation. With respect to control, the individual does not lose all control over his or her biometric data. Consent is still required before the private entity may disclose it to anyone else (
“[T]he Privacy Act itself contains numerous provisions that serve its prophylactic goals even after the first collection or disclosure. Specifically, White Castle has a duty to safeguard information it has collected.
740 ILCS 14/15(a) ,(e) . White Castle has an ongoing duty to destroy any biometric data that current employees have already scanned, once the data‘s purpose is fulfilled.Id. at 15(a) . Section 15(c) prohibits the sale of biometrics, so any sale of biometrics would give rise to a new claim.Id. at 15(c) . Section 15(d) prohibits the disclosure of biometrics to a third party without consent.Id. at 15(d) . So disclosure of biometrics to a new third party would give rise to a new claim—a straightforward reading of the statute that has always been White Castle‘s position ***.” (Emphases in original.)
Thus, the Act very tightly regulates what private entities may do with the biometric information they collect, and individuals maintain a measure of control over their biometric data.
¶ 65 While discussing the strengths and weaknesses of each side‘s argument, the Seventh Circuit suggested two potential problems with a single accrual rule. First, that court speculated that the premise that “two violations aren‘t worse than one” may “simply be wrong.” Cothron, 20 F.4th at 1165. The court speculated that “[r]epeated collections or disclosures of biometric data, even if by or to the same entity, might increase the risk of misuse or mishandling of biometric data.” Id. This assumes, however, that repeated scans of the same biometric identifier by the same entity are repeated “collections” or “disclosures,” which is a dubious proposition. Indeed, the Seventh Circuit itself had earlier explained that a disclosure is a “new revelation” and that “[r]epeated transmissions of the same biometric identifier to the same third party are not new revelations.” Id. at 1163. Moreover, there is no reason to believe that subsequent scans of the same biometric identifier used for authentication purposes against a stored copy would increase the risk of misuse or mishandling of biometric data. Second, the Seventh Circuit speculated that, under a single accrual rule, “[o]nce a private entity has violated the Act, it would have little incentive to course correct and comply if subsequent violations carry no legal consequences.” Id. at 1165. The Act, however, provides for injunctive relief. See
“Plaintiff purports to allege two violations of the Act, for up to 9,500 current and former White Castle employees. Even under a single accrual method, damages could equate to between $19 million and $95 million if Plaintiff‘s
claims had been timely made, assuming that Plaintiff could recover separately under Section 15(b) and 15(d). Even under a ‘one violation per employee’ calculation of $1,000 per employee, damages could equal $9.5 million. These numbers, in and of themselves, are sufficient to incentivize [Act] compliance.”
The consequences of construing the statute to provide multiple accruals are severe, and neither plaintiff nor the majority has identified similar severe consequences to White Castle‘s interpretation.
¶ 66 In sum, the Act‘s legislative findings and intent show that the legislature recognized the utility of biometric technology and wanted to facilitate its safe use by private entities by regulating how it is used. See
¶ 67 CHIEF JUSTICE THEIS and JUSTICE HOLDER WHITE join in this dissent.