Fast food chain operator White Castle, Inc. has asked the U.S. Court of Appeals for the Seventh Circuit to address the question of when claims accrue under Illinois’ Biometric Information Privacy Act (“BIPA”). The Seventh Circuit’s decision may resolve the question of BIPA claims’ timeliness, an issue that has long plagued litigants.
The case, Cothron v. White Castle Systems, Inc., is based on a White Castle employee’s claims that White Castle violated BIPA by improperly collecting and disclosing scans of her fingerprints from its biometric time clock and computer access system. White Castle moved to dismiss, arguing that the plaintiff’s claims were untimely because they accrued, if at all, in 2008 – when the plaintiff first scanned her fingerprints after the passage of BIPA. This would place the claims outside the longest possibly applicable statute of limitations, which is five years. The district court denied White Castle’s motion, holding that a claim accrued each time White Castle unlawfully collected or disseminated the plaintiff’s fingerprints. As a result, the court ruled that some of the plaintiff’s claims were timely.
White Castle appealed this decision to the Seventh Circuit. It argues that repeated conduct allegedly violating BIPA §§ 15(b) (requiring informed consent to collect biometrics) and 15(d) (requiring consent to disclose biometrics) gives rise to only a single claim that accrues at the first violation. By contrast, the plaintiff argued in district court that White Castle’s actions are either a continuing violation that gives rise to a claim at any point until the violation ends, or a repeated violation, with each new violation giving rise to a new claim. White Castle argues that under BIPA, individuals are injured when they lose control of their biometrics, which occurs the first time their biometrics are unlawfully collected or disclosed. “Once control is lost, it is lost,” White Castle contends – i.e., control cannot be later regained and lost, giving rise to subsequent claims.
Both sides argue that their interpretations of BIPA are supported by the Illinois Supreme Court’s decision in Rosenbach v. Six Flags Ent. Corp., which states that a person is “‘aggrieved’ within the meaning of Section 20 of [BIPA] and entitled to seek recovery” whenever “a private entity fails to comply with one of section 15’s requirements.” White Castle interprets this to mean that the first failure to comply with BIPA gives rise to a claim. The decision also quotes BIPA, which says that “aggrieved” persons may recover for “each violation,” which the plaintiff reads to mean that a claim accrues with every individual BIPA violation.
Although the issue of accrual is the primary question under consideration, the Seventh Circuit’s order granting the appeal noted that other issues may also be considered. It is thus possible that the court will address the appropriate statute of limitations for BIPA claims, which has also been an issue of contention in BIPA cases because the law does not provide a limitations period. Defendants argue for the one- or two-year period for privacy or personal injury claims, respectively, while plaintiffs argue for the five-year period applicable to civil actions without a specific limitations period. If the Seventh Circuit were to weigh in on this issue, it would provide much-needed guidance on one of the many grey areas under the Illinois law.
If the Seventh Circuit sides with White Castle, it would be a rare and important win for companies that have seen a flood of BIPA cases, as many claims currently being litigated will be rendered untimely. The plaintiff’s brief is due by April 28, 2021. We will be following this case and posting updates.
