The Illinois Supreme Court recently ruled that companies are violating the state's biometric privacy law every time they misuse a person's information, which could result in billions of dollars in penalties. In a 4-3 decision, the court stated that White Castle System Inc must face claims that it repeatedly scanned the fingerprints of nearly 9,500 employees without their consent, which the company claims could cost over $17 billion.
Penalties for Biometric Information Privacy Act (BIPA) Violations
The Illinois Biometric Information Privacy Act (BIPA) imposes penalties of $1,000 per violation and $5,000 for reckless or intentional violations. The law requires companies to obtain permission before collecting biometric information such as fingerprints or retinal scans from workers and consumers.
White Castle Arguments Rejected
White Castle had argued that it could only be sued for the initial collection of each worker's fingerprint and not every time they were scanned to access the company computer system. However, the court stated that BIPA broadly prohibits the "collecting" or "capturing" of biometric information without consent, and White Castle had to collect workers' fingerprints every time they used the computer system.
Business Groups Support White Castle
The company was backed by a dozen major business groups, including the U.S. Chamber of Commerce, the largest business lobby in the country. The lawsuit against White Castle goes back to the Chicago-based U.S. appeals court to apply the recent decision.
White Castle's Statement and the Decision's Implications
White Castle expressed disappointment with the ruling and is considering its options. The decision means companies cannot forget their legal obligations to protect private information, which could lead to billions of dollars in penalties and pressure companies to settle cases. Additionally, the Illinois Supreme Court held in a separate case two weeks ago that plaintiffs have five years to sue for BIPA violations, allowing workers and consumers to file lawsuits for many more violations over a longer period.
Previous BIPA Settlements and Judgments
Nearly 2,000 lawsuits alleging violations of BIPA have been filed since 2017, yielding a series of settlements and judgments. In 2020, Facebook agreed to pay $650 million to settle a BIPA class action involving its use of facial recognition software, while in October, a jury ordered BNSF Railway Co to pay $228 million for collecting truck drivers' fingerprints without their consent.
