## Facts

- Latrina Cothron worked for White Castle in Illinois and, beginning in 2004, used a fingerprint-scanning system to access workplace computers and pay stubs.
- After Illinois’s Biometric Information Privacy Act (BIPA) took effect in 2008, White Castle continued requiring fingerprint scans for access.
- Each scan transmitted fingerprint data to a third-party vendor for verification and authorization.
- Cothron alleged White Castle did not provide required notice or obtain informed written consent to collect and disclose her biometric data until 2018.
- Cothron brought a putative class action for violations of BIPA § 15(b) (collection/obtaining) and § 15(d) (disclosure/dissemination).
- White Castle argued claims accrued only once (at the first unlawful scan and first unlawful transmission), warning that per-scan/per-transmission accrual would create extremely large statutory-damages exposure.

## Issues

1. Whether BIPA § 15(b) claims accrue only upon the first unlawful collection/obtaining of biometric data, or accrue with each noncompliant scan or other obtaining.
2. Whether BIPA § 15(d) claims accrue only upon the first unlawful disclosure of biometric data, or accrue with each noncompliant transmission to a third party.

## Decision

- The Illinois Supreme Court answered the certified question by holding that a separate claim accrues under BIPA § 15(b) each time a private entity scans or otherwise obtains biometric data without complying with § 15(b).
- The court held that a separate claim accrues under BIPA § 15(d) each time a private entity discloses or otherwise disseminates biometric data without complying with § 15(d).
- The majority relied on BIPA’s text, reasoning the statutory verbs describe discrete acts; each scan and each transmission can be an independent statutory violation.
- The court rejected policy arguments that per-scan accrual would produce excessive damages, stating that text controls and any change to the remedial scheme is for the legislature; the court also noted statutory damages are framed permissively (“may” recover).

## Legal Principles

- Statutory interpretation begins with the statute’s plain language; where the text is clear, courts apply it as written.
- Under BIPA, a claim accrues when the plaintiff’s statutory right is violated.
- For BIPA § 15(b), each noncompliant act of collecting, capturing, or otherwise obtaining biometric data constitutes a separate violation giving rise to a separately accruing claim.
- For BIPA § 15(d), each noncompliant act of disclosing, redisclosing, or otherwise disseminating biometric data constitutes a separate violation giving rise to a separately accruing claim.
- Courts may not modify unambiguous statutory text to limit liability based on policy concerns about damages; remedial design is for the legislature.

## Conclusion

The Illinois Supreme Court held that BIPA §§ 15(b) and 15(d) claims accrue with every nonconsensual scan and every nonconsensual disclosure, not solely at the first scan or first transmission, allowing potentially separate claims for each noncompliant biometric collection and disclosure event.


Cothron v. White Castle Sys., Inc., 216 N.E.3d 918 (Ill. 2023)