Seventh Circuit punts BIPA claim accrual question to Illinois Supreme Court

On December 20, 2021, the Seventh Circuit Court of Appeals issued a long-awaited decision in Cothron v. White Castle System, Inc., No. 20-3202, 2021 WL 5998537 (7th Cir. Dec. 20, 2021), a case in which the Seventh Circuit could have provided an answer to the open question of when claims for violations of sections 15(b) and 15(d) of the Illinois Biometric Information Privacy Act (BIPA) accrue. Rather than answer that question itself, however, the Seventh Circuit certified the question to the Illinois Supreme Court.

BIPA does not set forth an accrual date. Just days before the Seventh Circuit rendered its decision in Cothron, the Appellate Court of Illinois for the First District issued the first ruling by an Illinois appellate court regarding the repeated accrual of claims under BIPA. Watson v. Legacy Healthcare Fin. Servs., LLC, No. 1-21-0279, 2021 IL App (1st) 210279 (Ill. App. Ct. Dec. 15, 2021). In Watson, the plaintiff alleged that the defendants, his former employers, violated sections 15(a) and 15(b) of BIPA by requiring him to scan his fingerprint and/or handprint into a biometric scanner in order to “clock in” and “clock out” of work each day without providing a written policy establishing a retention schedule and destruction guidelines, as required by section 15(a), and without first providing notice and obtaining the plaintiff’s informed written consent, as required by section 15(b). Id. ¶ 10. One issue before the court was when the plaintiff’s claims accrued for statute-of-limitations purposes. See id. ¶ 45. The court held that a claim for violation of section 15(b) of BIPA accrues with “each and every capture and use of [a] plaintiff’s fingerprint or hand scan.” Id. ¶ 46.

The Watson decision did not address the accrual of claims for violation of BIPA section 15(d), which makes it unlawful for a private entity in possession of biometric data to “disclose, redisclose, or otherwise disseminate” the data without the subject’s consent. 740 ILCS 14/15(d). Thus, the Cothron case—which involved claims under both sections 15(b) and 15(d)—presented an issue that has still not been addressed by an Illinois appellate court.

The relevant facts of the Cothron case are as follows.

Since 2004, Latrina Cothron had worked at an Illinois hamburger restaurant operated by White Castle System, Inc. (White Castle). Cothron, 2021 WL 5998537, at *1. Cothron alleged that, shortly after she began working there, White Castle introduced a system that (i) required her and other employees to scan their fingerprints to access the restaurant’s computer system, and (ii) collected and transmitted each fingerprint scan to a third-party vendor for authentication. Id. Cothron filed a putative class action lawsuit against White Castle and the vendor in Illinois state court, alleging violations of BIPA. Id. at *1-2. Specifically, Cothron alleged that White Castle did not attempt to obtain her consent until 2018—a decade after BIPA took effect—and therefore unlawfully collected and disclosed her fingerprint scans to the vendor in violation of sections 15(b) and 15(d) of BIPA, respectively. Id. at *2. The vendor removed the case to federal court and was later voluntarily dismissed. Id.

Thereafter, White Castle filed a motion for judgment on the pleadings based on the statute of limitations, arguing that Cothron filed suit too late because her BIPA claims accrued the first time she scanned her fingerprint after BIPA took effect in 2008. Id. at *1-2. White Castle contended that, because Cothron’s claim accrued in 2008, her suit was untimely under the longest possible limitations period. Id. (Though the parties disputed which statute of limitations applied, they agreed that it was no longer than five years. Id. at *2.) Cothron countered that every unauthorized fingerprint scan amounted to a distinct and separately actionable section 15(b) violation, and that each transmission of her fingerprint to the third-party authenticator likewise amounted to a distinct and separately actionable section 15(d) violation. Id. at *1-2, *4. Therefore, Cothron maintained, a new claim accrued each time she scanned her fingerprint and White Castle sent it to the vendor—not just the first time—and her suit was accordingly timely with respect to the unlawful scans and transmissions that occurred within the limitations period. Id.

The district court rejected White Castle’s “one time only” theory of claim accrual and denied White Castle’s motion for judgment on the pleadings. Id. at *1. However, the district court found the question close enough that it certified its order for immediate interlocutory appeal, and the Seventh Circuit eventually accepted the certification. Id. at *1-2. Subsequently, Cothron asked the Seventh Circuit to certify the question to the Illinois Supreme Court. Id. 

In evaluating Cothron’s certification request, the Seventh Circuit first confirmed that Cothron had standing to sue in federal court, concluding that a violation of BIPA section 15(d) inflicts a concrete and particularized Article III injury. Id. at *2-3. The Seventh Circuit then turned to the controlling legal question of whether section 15(b) and 15(d) BIPA claims accrue just once or repeatedly. Id. at *4. After addressing the competing arguments by Cothron and White Castle, the court found itself “genuinely uncertain” about the answer, determining that there were “reasons to think that the Illinois Supreme Court might side with either Cothron or White Castle.” Id. at *7 (emphasis in original). The court further concluded that the question was “a close, recurring, and hotly disputed question of great legal and practical consequence that require[d] authoritative guidance from the Illinois Supreme Court.” Id. at *7 n.2. Moreover, the court opined that the recent Watson decision did not weigh against certification because the Watson court did not address section 15(d), which the Cothron court considered alongside section 15(b). Id.

For the foregoing reasons, the Seventh Circuit agreed with Cothron that the accrual issue was best decided by the Illinois Supreme Court. Id. at *1, *8. Accordingly, the Seventh Circuit certified the following question to the Illinois Supreme Court:

Do section 15(b) and 15(d) claims accrue each time a private entity scans a person’s biometric identifier and each time a private entity transmits such a scan to a third party, respectively, or only upon the first scan and first transmission?

Id. at *8.

With the Cothron decision, the issue of when section 15(d) BIPA claims accrue is now in the hands of the Illinois Supreme Court. The Court’s answer to that question will have significant implications for both the defense of BIPA lawsuits involving section 15(d) claims as well as insurers’ respective coverage obligations.

We will continue to monitor developments in this important area.