Cothron v. White Castle Systems, Inc.

Latrina Cothron (plaintiff) worked for White Castle Systems, Inc. (White Castle) (defendant) as the manager of one of its fast-food restaurants in Illinois. Beginning in 2004, White Castle required employees to scan their fingerprints to access computers and pay stubs. The prints were transmitted to a third-party vendor for verification, and the vendor would authorize access. White Castle did not obtain Cothron’s consent to collect and share her fingerprint data until 2018. The same year, Cothron sued White Castle in federal court, alleging that Illinois’s Biometric Information Privacy Act (BIPA), which became effective in 2008, prohibited White Castle from collecting and sharing Cothron’s fingerprint data without her consent. Consequently, Cothran argued that White Castle had been violating BIPA for over a decade and should be liable for statutory damages for each time it collected and shared her fingerprint data during that period. White Castle argued that BIPA should be construed to allow a person to recover statutory damages only for the first improper collection and disclosure of fingerprint data, not for each collection and disclosure individually. It argued that allowing statutory damages for each instance would result in absurd damages awards. White Castle estimated that 9,500 current and former employees might have claims and the damages could total more than $17 billion. The district court concluded that under the statute’s plain language, a claim accrued each time an entity improperly collected or disclosed biometric information. White Castle appealed that decision to the Seventh Circuit. The Seventh Circuit certified a question to the Illinois Supreme Court, asking for guidance as to whether BIPA allowed statutory damages for each instance in which an entity improperly collected and disseminated biometric information.