White Castle could face multibillion-dollar judgment in Illinois privacy lawsuit

Feb 17 (Reuters) – Illinois’ highest courtroom on Friday mentioned corporations violate the state’s distinctive biometric privateness legislation every time they misuse an individual’s non-public data, not simply the primary time, a ruling that would expose companies to billions of {dollars} in penalties.

The Illinois Supreme Courtroom in a 4-3 decision mentioned quick meals chain White Citadel System Inc should face claims that it repeatedly scanned fingerprints of almost 9,500 workers with out their consent, which the corporate says might price it greater than $17 billion.

The Illinois Biometric Information Privacy Act (BIPA) imposes penalties of $1,000 per violation and $5,000 for reckless or intentional violations. The legislation requires corporations to acquire permission earlier than gathering fingerprints, retinal scans and different biometric data from staff and customers.

White Citadel had argued that it might solely be sued for initially gathering every employee’s fingerprint, and never each time they had been scanned to entry an organization pc system.

The corporate was backed by a dozen main enterprise teams together with the U.S. Chamber of Commerce, the nation’s largest enterprise foyer. The Chamber in a quick filed final yr mentioned a ruling in opposition to White Citadel would spur litigation that might be financially ruinous for some corporations.

The courtroom on Friday mentioned BIPA broadly prohibits “gathering” or “capturing” biometric data with out consent, and White Citadel needed to gather staff’ fingerprints each time they used the pc system.

A Chicago-based U.S. appeals courtroom had requested the Illinois Supreme Courtroom to determine the difficulty. The lawsuit in opposition to White Citadel now goes again to that courtroom to use Friday’s determination.

Ohio-based White Citadel in an announcement supplied by a spokesperson mentioned it was dissatisfied with the ruling and was contemplating its choices.

James Zouras, a lawyer for the named plaintiff, mentioned the choice means corporations can’t shirk their authorized obligations to safeguard non-public data.

“Hopefully, in the present day’s determination will encourage employers and different biometric knowledge collectors to lastly begin taking the legislation significantly,” he mentioned.

Two weeks in the past, the Illinois Supreme Courtroom held in a separate case that plaintiffs have 5 years to sue for violations of BIPA, rejecting a one-year window pushed by enterprise teams.

Collectively, the 2 selections will enable staff and customers to file lawsuits alleging many extra violations of BIPA over an extended time period. This might probably result in billions of {dollars} in penalties and raises strain on corporations to settle instances.

Practically 2,000 lawsuits alleging violations of BIPA have been filed since 2017, yielding a sequence of huge settlements and judgments.

Meta Platforms Inc’s Fb in 2020 agreed to pay $650 million to settle a BIPA class motion involving its use of facial recognition software program. The corporate denied wrongdoing.

In October, following the first-ever trial in a BIPA case, a jury ordered BNSF Railway Co to pay $228 million for gathering truck drivers’ fingerprints with out their consent. The railroad has moved for a brand new trial.

The case is Cothron v. White Citadel System Inc, Illinois Supreme Courtroom, No. 128004.

Reporting by Daniel Wiessner in Albany, New York, Enhancing by Alexia Garamfalvi and David Gregorio

Our Requirements: The Thomson Reuters Trust Principles.