Seventh Circuit Asks Illinois Supreme Court to Decide Important Biometric Rights Question

Earlier this week, the Seventh Circuit asked the Illinois Supreme Court to decide when a person can sue for violations of their rights under the state’s Biometric Information Privacy Act, commonly referred to as BIPA. EPIC filed an amicus brief urging this outcome. BIPA prohibits collection or disclosure of biometrics without consent. A few years ago, in a case called Rosenbach v. Six Flags, the Illinois Supreme Court said that people are injured, and can sue, whenever someone violates their BIPA rights as defined by the plain text of the statute—they need not allege anything additional, like a harm resulting from the statutory violation. The plaintiff in this case, Cothron v. White Castle, was a White Castle employee whose fingerprints were continuously collected by White Castle and disclosed to a third party for years without consent. White Castle argues that Cothron was only injured the very first time her fingerprints were collected and disclosed because that is when she “lost control” of her biometrics—a phrase not found in the statute. Because the statute of limitations has run on the first violation, White Castle argues that Cothron cannot sue for White Castle’s years of violating of her BIPA rights. EPIC filed an amicus brief in the case explaining that White Castle misconstrued Rosenbach and misapplied federal Article III standing principles to a state law statutory injury case. EPIC stressed that adopting White Castle’s atextual reading of the statute would allow long-time, repeat BIPA offenders off the hook. EPIC also said that the Illinois Supreme Court should decide the legal question. EPIC has participated as amicus in other BIPA cases, including Patel v. Facebook and Rosenbach v. Six Flags.