CHICAGO – The Seventh Circuit Court of Appeals must decide whether years of failure to protect privacy of biometric data should count as a violation of Illinois law worth $1,000 or many violations that could add up to $1 million.
The judges await an appeal brief from White Castle, which lost the argument before Northern District of Illinois Judge John Tharp last August.
Tharp found claims under the Biometric Privacy Act accrued at each violation.
White Castle argued that daily damages under the Biometric Privacy Act would produce an “absurd” result, but Tharp found the Act required the result.
“The court fully acknowledges the large damage awards that may result from this reading of the statute,” Tharp wrote.
He also wrote that subjecting private entities to substantial liability for each violation was one of the principal means for achieving objectives of the Act, and that if Illinois legislators agree that his reading was absurd, they were free to modify the statute.
“But it is not the role of a court, particularly a federal court, to rewrite a state statute to avoid a construction that may penalize violations severely,” Tharp wrote.
On appeal, White Castle would have ample opportunity to explain why it’s absurd to impose harsh sanctions on businesses that ignore the Act, according to Tharp.
He wrote that he could not certify the question to the Illinois Supreme Court, but the Seventh Circuit could.
He further wrote that the number of violations would be resolved at a future point as briefing is devoted to the applicable statute of limitations. Options range from a year to two to five.
Tharp ultimately certified the question to the Seventh Circuit, identifying three state courts that treated allegations such as White Castle plaintiff Latrina Cothron’s as single violations.
He wrote that reasonable minds differ as to the clarity of the Act and the extent to which suppositions about legislative intent should shape its application.
According to background in Tharp’s ruling, Cothron has worked for White Castle since 2004.
In 2007, White Castle introduced a system requiring her to scan and register her fingerprint in order to access a computer as a manager.
Legislators passed the Act in 2008, but White Castle didn’t comply until 2018.
Cothron sued in 2019, proposing to lead a class action.
If a limit of five years applies, her suit covers more than 1,000 days on the job.
Daily violation at $1,000 would result in damages greater than $1 million.
On parallel tracks, Illinois appellate courts in the First and Third districts must decide when claims accrue under the Act.
The triple tension caused Chief District Judge Nancy Rosenstengel of East St. Louis to suspend her proceedings in a potential class action against nursing homes.
Former Sycamore Village employee Saroya Roberson filed the suit in St. Clair County in 2017.
In 2019, Associate Judge Kevin Hoerner certified her to lead a class action against all homes of the Symphony Acute Care Network.
Fifth District appellate judges found Roberson could represent only employees of Sycamore Village.
Roberson added plaintiffs, and Symphony removed the suit to district court.
Rosenstengel stayed it on March 17, finding the First and Third districts could decide whether claims are subject to limits of one, two or five years.
She found the decisions could control the issue and guide the positions of parties.
She also found the Seventh Circuit would determine whether a private entity violates the Act only when it first collects information or each time it collects or discloses data in violation of the Act.
“This issue is crucial because defendants argue that plaintiffs’ claims are time barred as plaintiffs’ claims accrued when they were hired by Symphony,” she wrote.
The legislative remedy that Tharp suggested began taking shape last month, when House Minority Leader Jim Durkin introduced two bills to modify the Act.
House Bill 559 would specify a limit of a year and require 30 days notice. It would bar any action for damages if the entity cures the violation in 30 days.
It would provide recovery of actual damages rather than liquidated damages.
The judiciary committee on March 9 passed the bill, 10-5.
Six Republicans and four Democrats voted for it, five Democrats against.
Under House Bill 560, the labor department would resolve employee complaints and the Attorney General or state’s attorney would resolve other complaints.
The judiciary committee planned to take it up on March 23, but no action was taken according to the General Assembly’s website.