LATRINA COTHRON, individually and on behalf of all others similarly situated, Plaintiff-Appellee, v. WHITE CASTLE SYSTEM, INC., Defendant-Appellant.
No. 20-3202
United States Court of Appeals For the Seventh Circuit
December 20, 2021
SYKES, Chief Judge.
ARGUED SEPTEMBER 14, 2021
Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 19 CV 00382 — John J. Tharp, Jr., Judge.
Before SYKES, Chief Judge, and EASTERBROOK and BRENNAN, Circuit Judges.
White Castle moved for judgment on the pleadings based on the statute of limitations. The restaurant argued that a claim accrued under the Act the first time Cothron scanned her fingerprint into the system after the law took effect in 2008. That was more than a decade before she sued, making her suit untimely under the longest possible limitations period. Cothron responded that evеry unauthorized fingerprint
The district judge rejected White Castle‘s “one time only” theory of claim accrual and denied the motion. But he found the question close enough to warrant an interlocutory appeal under
We agree that this issue is best decided by the Illinois Supreme Court. Whether a claim accrues only once or repeatedly is an important and recurring question of Illinois law implicating state accrual principles as applied to this novel state statute. It requires authoritative guidance that only the state‘s highest court can provide.
I. Background
Cothron has worked for White Castle since 2004. She alleges that not long after she began, White Castle introduced a system that requires its employees to scan their fingerprints to access pay stubs and work computers. Each scan is sent to a third-party vendor that authenticates it and gives hеr access to the restaurant‘s computer system. Cothron contends that White Castle implemented this system without properly obtaining her consent in violation of the Illinois Biometric Information Privacy Act (“BIPA” or “the Act“),
The Illinois General Assembly adopted the Act in 2008 in response to increased commercial use of biometric data. Biometrics are “biologically unique” personal identifiers,
To address these concerns, the Act regulates how private entities may collect and handle biometric data and provides a private cause of action for any person “aggrieved by” a violation of the statute.
Two of the Act‘s provisions are relevant here. Section 15(b) provides that a private entity may not “collect, capture, purchase, receive through trade, or otherwise obtain” a person‘s biometric data without first providing notice to and receiving consent from the person.
Cothron alleges that White Castle did not attempt to obtain her сonsent until 2018—a decade after the Act took effect—and therefore unlawfully collected her fingerprints and unlawfully disclosed them to its third-party vendor in violation of sections 15(b) and 15(d), respectively. She sued White Castle and Cross Match Technologies, Inc., the third-party vendor, in Illinois state court seeking to represent White Castle employees whose rights were violated. Cross Match removed the case to federal court under the Class Action Fairness Act of 2005. See
The distriсt judge sua sponte addressed subject-matter jurisdiction, examining whether Cothron alleged a concrete and particularized injury as required for Article III standing. Cothron v. White Castle Sys., Inc., 467 F. Supp. 3d 604 (N.D. Ill. 2020). Based on our reasoning in Bryant v. Compass Group USA, Inc., 958 F.3d 617 (7th Cir. 2020), the judge determined that jurisdiction is secure. Cothron, 467 F. Supp. 3d at 611-13.
White Castle then moved for judgment on the pleadings, see
The judge agreed with Cothron and denied White Castle‘s motion. Cothron v. White Castle Sys., Inc., 477 F. Supp. 3d 723, 734 (N.D. Ill. 2020). Because the decision involved a controlling question of law on which there is substantial ground for disagreement, the judge certified his order for immediate appeal, see
II. Discussion
Though no one challenges the judge‘s jurisdictional ruling, “[s]ubject-matter jurisdiction is the first issue in any cаse,” Miller v. Sw. Airlines Co., 926 F.3d 898, 902 (7th Cir. 2019), so we begin with our “independent duty to ensure” that this case is properly in federal court, Dexia Crédit Loc. v. Rogan, 602 F.3d 879, 883 (7th Cir. 2010). After confirming Cothron‘s standing, we turn to the controlling legal question—whether section 15(b) and 15(d) claims accrue just once or repeatedly—as well as Cothron‘s request to certify the question to the Illinois Supreme Court.
A. Article III Standing and Section 15(d)
Article III of the Constitution limits the jurisdictional reach of the federal courts to “Cases” and “Controversies.”
Our decision in Bryant resolved the standing question for claims under section 15(b) of the Act, see 958 F.3d at 624, but we have yet to decide whether a violation of section 15(d) inflicts a concrete and particularized Article III injury. We do so here.
Concrete injuries encompass harms that are “real, and not abstract.” Spokeo, Inc. v. Robins, 578 U.S. 330, 340 (2016) (quotation marks omitted). Tangible harms like physical and monetary injuries are the most obvious, but certain intangible harms, most particularly those closely related to harms “traditionally recognized as providing a basis for lawsuits in American courts,” also qualify. TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2204 (2021); see also Spokeo, 578 U.S. at 340-41. These include, for example, “reputational harms, disclosure of private information, and intrusion upon seclusion.” TransUnion, 141 S. Ct. at 2204.
Our application of these principles to section 15(d) is streamlinеd by the reasoning in Bryant and related circuit precedent regarding other sections of the Act. In Bryant we addressed whether the collection of biometric data without complying with section 15(b)‘s informed-consent procedures inflicts an Article III injury. 958 F.3d at 620. We noted that the informed-consent duties prescribed by section 15(b) protect a person‘s privacy interests in his unique biometric data, so a noncompliant collection of biometric data amounts to an invasion of an individual‘s “private domain, much like an act of trespass.” Id. at 624.
We explained that the duties imposed by section 15(b) reflect the General Assembly‘s judgment that people must have “the opportunity to make informed choices about to whom and for what purpose they will relinquish control” over their biometric data. Id. at 626. Failure to comply with these requirements deprives a person of “the opportunity to consider whether the terms of collection and usage [are] acceptable given the attendant risks.” Id. That deprivation, we held, is a concrete and particularized harm, so a violation of section 15(b) infliсts an Article III injury. Id.
In Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146 (7th Cir. 2020), we extended Bryant‘s reasoning to a provision in section 15(a) of the Act,
The same reasоning applies to section 15(d), which prohibits the disclosure, redisclosure, or dissemination of a person‘s biometric data without consent, an act that invades his private domain just as surely as an unconsented collection or retention does. Section 15(d) is therefore unlike other sections of the Act that impose duties owed only to the public generally—the violation of which does not, without more, confer standing. See, e.g., Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1247 (7th Cir. 2021) (holding that a violation of section 15(c)‘s general prohibition on the sale of biometric data does not infliсt an Article III injury); Bryant, 958 F.3d at 626 (holding that a violation of section 15(a)‘s duty to provide a data-retention schedule to the public does not inflict an Article III injury). And just as with section 15(b), the failure to obtain consent for a disclosure or dissemination deprives a person of the opportunity to consider who may possess his biometric data and under what circumstances, “given the attendant risks.” Bryant, 958 F.3d at 626. It follows that a violation of section 15(d) inflicts a concrete and particularized Article III injury. Cothron‘s suit is properly in federal court.
B. BIPA Claim Accrual
The timeliness of the suit depends on whether a claim under the Act accrued each time Cothron scanned her fingerprint to access a work computer or just the first time. Cothron maintains that each scan amounted to a distinct and separately actionable
The disagreement, framed differently, is whether the Act should be treated like a junk-fаx statute for which a claim accrues for each unsolicited fax, Reliable Money Ord., Inc. v. McKnight Sales Co., 704 F.3d 489, 491 (7th Cir. 2013), or instead like certain privacy and reputational torts that accrue only at the initial publication of defamatory material, Pippen v. NBCUniversal Media, LLC, 734 F.3d 610, 614-15 (7th Cir. 2013). In the district court, the judge sided with Cothron and denied White Castle‘s motion for judgment on the pleadings. We review that ruling de novo. Moss v. Martin, 473 F.3d 694, 698 (7th Cir. 2007).
1. Illinois Claim-Accrual Principles
This appeal requires us to apply Illinois claim-accrual principles to this unique statute. As a general matter, the Illinois Supreme Court has explained that a claim accrues and “a limitations period begins to run when facts exist that authorize one party to maintain an action against another.” Feltmeier v. Feltmeier, 798 N.E.2d 75, 85 (Ill. 2003); see also Khan v. Deutsche Bank AG, 978 N.E.2d 1020, 1028 (Ill. 2012) (“A cause of action ‘accrues’ when facts exist that authorize the bringing of a cause of action.“).
The elements of the statutory cause of action are found in sections 15 and 20 of the Act. Again, as relevant here, section 15(b) makes it unlawful to “collect, capture, purchase, receive through trade, or otherwise obtain” a person‘s biometric data without his written consent. And section 15(d) makes it unlawful to “disclose, redisclose, or othеrwise disseminate” biometric data without the subject‘s consent. Section 20 sets out the private cause of action, authorizing “[a]ny person aggrieved by a violation” of the Act to sue and “recover for each violation.”
The key inquiry for claim-accrual purposes is identifying when these statutory elements were satisfied, thus authorizing suit. See Khan, 978 N.E.2d at 1028. More to the point here, we must determine whether suit was authorized on only one occasion or instead repeatedly.
2. The Parties’ Arguments
Cothron contends that the plain language of section 15(b) points to only оne conclusion: each unlawful “collection” of her fingerprint is a separate violation. She further argues that the language of section 15(d) is similarly plain and means that each unlawful “disclosure” or “dissemination” is a separate violation. Finally, she maintains that she was “aggrieved” afresh with each statutory violation. For support she relies on the Illinois Supreme Court‘s decision in Rosenbach v. Six Flags Entertainment Corp., 129 N.E.3d 1197, 1206 (Ill. 2019), which explained that a violation of section 15 itself “aggrieves” a plaintiff within the meaning of section 20. Putting these pieces together, Cothron argues that she hаs a claim for each fingerprint scan within the limitations period.
White Castle argues that the answer to the accrual question is not quite so straightforward, offering two reasons for its proposed one-time-only rule. First, White Castle invokes a special accrual principle applicable in cases involving defamation and other privacy torts: the single-publication rule. Second, the restaurant argues that the Illinois Supreme Court‘s reasoning in Rosenbach actually points to the opposite conclusion: that a plaintiff is “aggrieved”
Under the singlе-publication rule, a tort claim based on a defamatory statement contained in a widely circulated publication accrues only upon initial publication, not with each subsequent publication of the same statement. See Ciolino v. Simon, No. 126024, 2021 WL 1031371, at *6 (Ill. Mar. 18, 2021); see also Founding Church of Scientology of Wash., D.C. v. Am. Med. Ass‘n, 377 N.E.2d 158, 160 (Ill. App. Ct. 1978) (“[T]he cause of action for libel is complete at the time of the first publication, and any subsequent appearances or distributions of copies of the original publication are of no consequence to the creation or existence оf a cause of action ... .“). The purpose and effect of this rule is to “protect[] speakers and writers from repeated litigation arising from a single, but mass-produced, defamatory publication.” Pippen, 734 F.3d at 615.
Though originally adopted judicially in Illinois, see Winrod v. Time, Inc., 78 N.E.2d 708, 714 (Ill. App. Ct. 1948), the single-publication rule is now codified in the Uniform Single Publication Act, which Illinois has adopted. The statute provides in relevant part:
No person shall have more than one cause of action for damages for libel or slander or invasion of privacy or any other tort founded upon any single publication or exhibition or utterance, such as any one edition of a newspaper or book or magazine or any one presentation to an audience or any one broadcast over radio or television or any one exhibition of a motion picture.
White Castle argues that an unlawful disclosure of a person‘s biometric data is a privacy-invading “publication” to which the single-publication rule should apply, drawing on the reasoning in the Illinois Supreme Court‘s decision in West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc., No. 125978, 2021 WL 2005464 (Ill. May 20, 2021). There the court held that a disclosure оf a fingerprint scan in violation of the Act was a “publication” within the meaning of a commercial insurance policy. Id. at *7. If White Castle is right, Cothron‘s section 15(d) claim is untimely.
As Cothron points out, however, there are reasons to doubt the application of the single-publication rule in this context. By its terms the Uniform Single Publication Act covers defamation and other traditional privacy torts, and its illustrative list of publication media—newspapers, books, movies, and television and radio broadcasts—suggests that it may not be a comfortable fit with the Act. Nоr is West Bend Mutual the slam dunk that White Castle thinks it is. That case concerned whether a section 15(d) disclosure was a publication within the meaning of an insurance contract, not within the meaning of the Uniform Single Publication Act. Id. at *6.
Even if the single-publication rule does not apply, the language of section 15(d) is arguably consistent with White Castle‘s proposed first-time-only accrual rule. The ordinary meaning of “disclose” connotes a new revelation. Disclose, BLACK‘S LAW DICTIONARY (11th ed. 2019) (“To make (something) known or public; to show (something) after a period of inaccessibility or of being unknown; tо reveal.“). Repeated transmissions of the same biometric identifier to the same third party are not new revelations. White Castle argues, not unreasonably, that an actionable disclosure occurred only the first time Cothron‘s fingerprint was transmitted.
Finally, the catchall language in section 15(d)—recall that the statute makes it unlawful to “disclose, redisclose, or otherwise disseminate” a person‘s biometric identifier—does not clearly preclude a single-time accrual rule. The phrase following thе terms “disclose” and “redisclose” may simply be a way to ensure that all disclosure-like acts are covered.
See People v. Davis, 766 N.E.2d 641, 645 (Ill. 2002) (“[W]hen a statutory clause specifically describes several classes of persons or things and then includes ‘other persons or things,’ the word ‘other’ is interpreted as meaning ‘other such like.‘“). The upshot is that although section 15(d) does not clearly say that a claim accrues only once, that is a plausible reading of the statutory language.
White Castle‘s second argument is based on the Illinois Supreme Court‘s reasoning in Rosenbach, which concerned section 15(b) of the Act. There, a Six Flags amusement park collected a patron‘s fingerprint to facilitate his entry to the park as a season pass holder. Rosenbach, 129 N.E.3d at 1200. He sued for the unlawful collection of his biometric data in violation of section 15(b). Id. at 1201. The question was whether the alleged statutory violation by itself “aggrieved” the plaintiff within the meaning of section 20, giving him the right to sue. Id. at 1202.
To answer the question, the Illinois Supreme Court explained that the Act generally protects a person‘s “right to privacy in and control over” his biometric data аnd that the provisions in section 15 define the contours of that right. Id. at 1206. It follows, the court held, that a violation of one of those provisions aggrieves a plaintiff within the meaning of section 20. Id. The court was clear that “[n]o additional consequences need be pleaded or proved.” Id. Accordingly, a plaintiff can sue without “show[ing] some injury beyond [a]
Rosenbach‘s expansive language can be read to favor Cothron‘s position. A section 15 violation, without more, aggrieves a plaintiff within the meaning of section 20. And it may follow that an “aggrievement” ocсurs at each violation, with a claim accruing each time as well.
At bottom, however, the issue in Rosenbach was not claim accrual, let alone the repeated accrual issue we consider here. Seizing this opening, White Castle focuses on Rosenbach‘s reasoning, with special emphasis on the court‘s explanation that the Act protects a person‘s right of “privacy in and control over” his biometric data. White Castle theorizes that this right is fully invaded by an initial violation of section 15(b) or 15(d) and that repeated violations by the same person do no further harm to the person‘s privacy or control rights.
White Castle‘s one-and-done theory makes sense if we accept that subsequent collections or disclosures of biometric data do not work a harm that the Act seeks to prevent. And more importantly, focusing on what it means to be “aggrieved” by a violation of the statute gives this theory a plausible hook in the statutory text. But the theory also has some notable weak spots. The premise—two violations aren‘t worse than one—may simply be wrong. Repeated collections or disclosures of biometric data, even if by or to the same entity, might increase the risk of misuse or mishandling of biometric data. If so, each violation would seem to independently aggrieve a plaintiff. And the theory is hard to square with the broad language in Rosenbach that “[n]o additional consequences need be pleaded or proved” other than a violation of the plaintiff‘s statutory rights. Id. at 1206.
Beyond their arguments from text and precedent, both Cothron and White Castle maintain that the other‘s position would produce untenable consequences that the General Assembly could not possibly have intended. See People v. Collins, 824 N.E.2d 262, 266 (Ill. 2005) (“[I]n construing a statute, we presume that the legislature did not intend an absurd result.“). White Castle reminds us that the Act provides for statutory damages of $1,000 or $5,000 for “each violation” of the statute.
Cothron responds that the calculation of damages is separate from the question of claim accrual. True, but she does not explain how alternative theories of calculating damages might be reconciled with the text of section 20. Her better point is that White Castle‘s first-time-only reading would itself lead to an odd result. Once a private entity has violated the Act, it would have little incentive to course correct and comply if subsequent violations carry no legal consequences. All told, the practical implications of either side‘s intеrpretation, to the extent that Illinois courts would weigh them, do not decisively tilt one way or the other.
C. Certification
In light of the novelty and uncertainty of the claim-accrual question, Cothron asks us to certify it to the Illinois Supreme Court. Our rules permit us to certify state-law questions to a state supreme court when the answer will control the outcome of a case and the state court accepts such certifications. 7TH CIR. R. 52(a). The Illinois Supreme Court accepts certified questions from this court when none of its precedents
These are necessary but not sufficient conditions for certification. We are mindful of our obligation not to burden a state‘s highest court with unwarranted certification requests, so additional factors weigh in the balance. See State Farm Mut. Auto. Ins. Co. v. Pate, 275 F.3d 666, 671 (7th Cir. 2001). First and foremost, we must find ourselvеs “genuinely uncertain” about the answer to the state-law question before considering certification. In re Hernandez, 918 F.3d 563, 570 (7th Cir. 2019). That criterion is satisfied here. As discussed, there are reasons to think that the Illinois Supreme Court might side with either Cothron or White Castle. A wrong answer may also transcend the Act and implicate fundamental Illinois accrual principles on which only the state‘s highest court can provide authoritative guidance.2
It‘s also important that the dispositive legal question is general and likely to recur rather than unique and fact bound. Zahn v. N. Am. Power & Gas, LLC, 815 F.3d 1082, 1085 (7th Cir. 2016). The question here is a рurely legal one that has already shown itself to frequently arise. It drew significant interest from amici on both sides. Several federal district courts have recently stayed their proceedings awaiting our judgment in this case. E.g., Callender v. Quality Packaging Specialists Int‘l, LLC, No. 21-cv-505-SMY, 2021 WL 4169967, at *2 (S.D. Ill. Aug. 27, 2021); Johns v. Paycor, Inc., No. 20-cv-00264-DWD, 2021 WL 2627974, at *2 (S.D. Ill. May 11, 2021).
Finally, it matters that the Act is a unique Illinois statute regularly applied by the federal courts, see Nagy v. Riblet Prods. Corp., 79 F.3d 572, 577 (7th Cir. 1996), and one that the Illinois Supreme Court has shown an interest in interpreting, see Stephan v. Rocky Mountain Chocolate Factory, Inc., 129 F.3d 414, 418 (7th Cir. 1997). In addition to deciding Rosenbach in 2019 and West Bend Mutual in 2021, the court recently accepted review of McDonald v. Symphony Bronzeville Park, LLC, 163 N.E.3d 746 (Table) (Ill. 2021), which asks whether the state‘s Workers’ Compensation Act precludes an employee‘s claims for statutory damages under the Act.
Accordingly, the relevant criteria favor certification. We therefore respectfully ask the Illinois Supreme Court, in its discretion, to answer the following certified question:
Do section 15(b) and 15(d) claims accrue each time a private entity scans a person‘s biometric identifier and each time a private entity transmits such a scan to a third party, respectively, or only upon the first scan and first transmission?
Nothing in this certification should be read to limit the scope of the Illinois Supreme Court‘s inquiry, and the justices are invited to reformulate the certifiеd question. Further proceedings in this court are stayed while this matter is under consideration by the Illinois Supreme Court.
QUESTION CERTIFIED