CHICAGO (CN) — The Seventh Circuit on Monday left it in the hands of the Illinois Supreme Court to determine whether an employee’s biometric rights are violated each time they use their fingerprint to clock in at work, or only the first time the print is collected.
The underlying 2019 class action involves the limits on the Illinois Biometric Information Privacy Act, or BIPA, a 2008 law protecting the privacy rights of individuals as the use of their intimate, personalized and unchangeable biometric data for security screening and financial transaction purposes becomes more and more commonplace.
The lawsuit’s lead plaintiff, Latrina Cothron, claims her employer, White Castle, began making her scan her fingerprint to clock into work and access the restaurant’s computer system not long after she started work there in 2004. She says, however, that the restaurant did not inform her about its biometric data retention policies—which involve sending the data to a third party for authentication—or get her written consent to use her fingerprint data until 2018, a decade after BIPA took effect.
U.S. District Judge John Tharp Jr., a Barack Obama appointee, disagreed with White Castle’s argument that Cothron’s claim accrued only the first time she scanned her fingerprint and denied the restaurant’s motion to dismiss the case. White Castle appealed and the matter was argued at the Chicago-based Seventh Circuit in September ahead of the three-judge panel’s decision on Monday.
The question of whether Cothron’s claim accrued only once or repeatedly over more than a decade will now be settled by the Illinois Supreme Court. The first scenario would mean the employee’s lawsuit was filed beyond the statute of limitations.
“The disagreement…is whether [BIPA] should be treated like a junk-fax statute for which a claim accrues for each unsolicited fax…or instead like certain privacy and reputational torts that accrue only at the initial publication of defamatory material,” Chief U.S. Circuit Judge Diane Sykes wrote in the Seventh Circuit’s decision.
Attorneys for White Castle—which does not contest an initial breach of its employees’ biometric privacy rights in 2008—have argued that an unlawful disclosure of someone’s biometric data is more like the latter, a privacy-invading “publication” fitting its one-time-only reading of the law, an argument Sykes felt was plausible.
“Repeated transmission of the same biometric identifier to the same third party are not new revelations,” Sykes said. “White Castle argues, not unreasonably, that an actionable disclosure occurred only the first time Cothron’s fingerprint was transmitted.”
But the judge also found some weaknesses in White Castle’s “one-and-done theory.” For one thing, she said, “repeated collections or disclosures of biometric data, even if by or to the same entity, might increase the risk of misuse or mishandling of biometric data,” giving weight to the idea that a plaintiff is potentially aggrieved each time the data is collected.
Both White Castle and Cothron claim the other side’s argument, if vindicated, will lead to unintended consequences. Of Cothron’s reasoning, the restaurant says it and other employers would be open to catastrophic financial liabilities and damages if a new claim accrues with each fingerprint scan, which occur frequently. The employee, meanwhile, says White Castle and others would have no incentive to right their wrongs after they violate BIPA once if there are no legal repercussions for subsequent violations.
Sykes, a George W. Bush appointee, considered the novel issue presented by Cothron and White Castle regarding BIPA’s limitations best left to the Illinois Supreme Court, and she stayed Seventh Circuit proceedings while the state high court wrangles with the certified question.
U.S. Circuit Judges Frank Easterbrook and Michael Brennan rounded out the Seventh Circuit panel. They were appointed by Ronald Reagan and Donald Trump, respectively.
Read the Top 8
Sign up for the Top 8, a roundup of the day's top stories delivered directly to your inbox Monday through Friday.