Friday, September 29, 2023
Courthouse News Service
Friday, September 29, 2023 | Back issues
Courthouse News Service Courthouse News Service

Limits of Illinois biometric privacy law tested in case against White Castle

A class action against the fast food chain involving employee fingerprints asks whether the Illinois Biometric Information Privacy Act applies only to the first time someone gives up their biometric data or to every subsequent instance as well.

CHICAGO (CN) — The Seventh Circuit heard arguments Tuesday over the limitations of the Illinois Biometric Information Privacy Act, as part of a federal class action filed by White Castle employees who say the fast food chain collected their fingerprints without consent.

The 2019 suit revolves around whether the state's 2008 biometric privacy law applies only to the first time an individual submits their biometric data to a third party, or to every consecutive time they do so.

The lead plaintiff in the case, Latrina Cothron, alleges that her rights under the act were violated every time she clocked into work at White Castle using her fingerprints for more than a decade, beginning in 2007. White Castle only requested Cothron's written consent to use her fingerprint data, and informed her about its biometric data retention policies, in 2018.

U.S. District Judge John Tharp Jr., a Barack Obama appointee, denied White Castle's motion to dismiss the case last year, finding that Cothron "alleged multiple timely violations of" the Biometric Information Privacy Act, or BIPA.

The fast food chain appealed to the Chicago-based Seventh Circuit, which heard oral arguments Tuesday.

"Here, the allegations are that White Castle did collect... and disseminate [Cothron's] data without disclosing the required information or getting her informed consent, and that it did so repeatedly over the course of 10 years," Jim Zouras, one of Cothron's attorneys, argued before a three-judge panel.

He argued that each time White Castle collected its employees' data without having gotten their written consent, it violated BIPA by disregarding employees' rights to informed dissent.

"Did the collector fail to educate the person and get the person's permission before engaging in any collection or dissemination of biometrics?" A 'yes' answer does make the person aggrieved... the allegations are that each time White Castle took and disseminated [Cothron's] data, it repeatedly denied her the right to choose, to say 'no,'" Zouras said.

White Castle does not contest an initial breach of its employees' biometric privacy rights in 2008. But, potentially on the line for millions, it vehemently opposes Cothron's interpretation of the act.

Melissa Siebert, one of the chain's attorneys, argued in Tuesday's hearing that the lower court's ruling in favor of Cothron "incorrectly changes the act from a remedial statute to a punitive one... it imposes potentially catastrophic damages on employers such as White Castle."

The company instead argues that a person's biometric privacy or secrecy cannot be regained once lost. Thus, it says, the only breach of BIPA occurred the first time Cothron clocked in after the law was passed in 2008.

All subsequent clock-ins, Siebert argued, are barred from legal action by the act's one-year statute of limitations.

"Once that privacy right is invaded... the privacy right vanishes into thin air... it can no longer be secret," Siebert told the panel.

U.S. Circuit Judge Frank Easterbrook, a Ronald Reagan appointee, mused that since the case was removed from state to federal court in 2019 under the 2005 Class Action Fairness Act, the issue might be complicated by differences between federal and state court interpretations of limitation statutes.

"If this were a question of federal law, it seems to me that these would be classified as discreet wrongs...but Illinois may want to do something completely differently. It's very hard for us to know," Easterbrook said.

In their arguments, both attorneys referenced two Illinois Supreme Court cases, Rosenbach v. Six Flags Entertainment Corp and Feltmeier v. Feltmeier, which deal with biometric privacy and claims accrual, respectively.

However, Easterbook found these cases insufficient for establishing the best way to interpret BIPA's statute of limitations. He repeatedly asked both Zouras and Siebert for precedent in Illinois appellate cases that could help clarify the issue.

"What the parties are arguing in this case rests a lot on what the Seventh Circuit has said, rests a lot on what two decisions of the state Supreme Court have said in cases that don't involve the period of limitations; I'm just trying to get my hands on genuine Illinois limitations law," Easterbrook said.

Neither attorney could point to substantive precedent, with Zouras commenting that "there isn't a lot of authority out there" for this particular issue.

For this reason, he suggested that perhaps the case should be taken up by the Illinois Supreme Court, so that it could be made into a new precedent case itself.

"It would ensure consistency. It would ensure finality," Zouras said.

Easterbrook was joined on the Seventh Circuit panel by U.S. Circuit Judges Diane Sykes and Michael Brennan, appointed by George W. Bush and Donald Trump, respectively.

The judges took the attorneys' arguments under advisement and did not say when they would issue a ruling.

Follow Dave Byrnes on Twitter

Follow @@djbyrnes1
Categories / Appeals, Business, Civil Rights, Consumers, Employment

Read the Top 8

Sign up for the Top 8, a roundup of the day's top stories delivered directly to your inbox Monday through Friday.