Questions Regarding the Extent of Damages Available Under BIPA Remain Following Recent Rulings by Illinois Supreme Court and District Court for the Northern District of Illinois

ABSTRACT: Recently, the Illinois Supreme Court declined to revisit its holding in Cothron v. White Castle System. While that case garnered significant attention due to the court’s ruling that BIPA violations accrue, and the statute of limitations runs separately, each time a defendant violates an individual’s rights under the Act, another important aspect of the case involved the amount of damages available under BIPA. In refusing to grant White Castle’s petition for rehearing, the court provided no additional guidance on this issue. An Illinois District Court, relying on the Cothron opinion, recently vacated a damages award and ordered a new trial on the issue of damages in the first BIPA lawsuit to go to trial. 

Cothron v. White Castle System, Inc.:

As discussed here, on February 17, 2023, the Illinois Supreme Court issued its long-awaited opinion in the case Cothron v. White Castle System, Inc., 2023 IL 128004. In that case, the court held that: 1) an entity violates Section 15(b) of the Biometric Information Privacy Act (“BIPA”) each time it collects, captures, or otherwise obtains a person’s biometric information without prior informed consent; and 2) a claim under Section 15(d) accrues upon each transmission of a person’s biometric information without prior informed consent. The court rejected the defendant’s argument that an individual’s claims under Sections 15(b) and (d) accrue only once – and the statute of limitations, therefore, begins running solely – at the time a defendant first violates the individual’s rights under those sections.

While, on its face, Cothron addressed when claims under BIPA accrue for purposes of the statute of limitations, the court also discussed the scope of damages available under BIPA.  White Castle argued that the court’s ruling would result in “astronomical” damages awards tantamount to “annihilative liability.”  Specifically, White Castle reasoned that the court’s interpretation of BIPA would result in plaintiffs seeking separate awards of $1,000 or $5,000 – the liquidated damages amounts provided for by BIPA – for each individual violation of the Act.  In rejecting this argument, the court explained that the Illinois legislature made damages discretionary rather than mandatory under BIPA.  The court further noted that there is no language in BIPA suggesting a legislative intent to authorize damages that would result in the financial destruction of a business.  Simultaneously, however, the court stated that the legislature intended for entities who violate BIPA to face “substantial potential liability,” even if the consequences may be harsh, unjust, absurd, or unwise.

Subsequently, White Castle filed a petition for rehearing.  On July 17, 2023, the Illinois Supreme Court denied White Castle’s petition without issuing an opinion.  Justice David Overstreet, who dissented from the original opinion, issued a separate dissenting opinion upon the denial of White Castle’s petition.  The dissent was joined by Justices Theis and Holder White.  In the dissent, Justice Overstreet indicated that he would have allowed rehearing to address White Castle’s argument that the court’s opinion resulted in an erroneous interpretation of BIPA that subverted the intent of the Illinois legislature, threatened the survival of businesses in Illinois, and raised significant constitutional due process concerns.

Justice Overstreet explained that the Illinois legislature intended BIPA to be a remedial, as opposed to penal, statute.  To that end, damages under BIPA are the greater of actual damages or liquidated damages.  Justice Overstreet thought the damages provision indicative of the fact that liquidated damages are to be awarded where actual damages are too small and difficult to prove, not as a multiplier by thousands for each time technology is used.  He noted, however, that the majority’s construction of BIPA, where a claim accrues under the Act with each scan of a finger and each transmission of biometric information to technology vendors, will lead to results that “vastly exceed reasonable ratios between the damages awarded and the offense at issue.” 

The dissent examined the plaintiff’s potential damages to illustrate its point.  The plaintiff scanned her finger each time she accessed a work computer and each time she accessed her weekly pay stub.  Assuming she worked 5 days per week for 50 weeks per year and scanned her finger 6 times per week, her total scans equaled at least 1,500 over the five-year statute of limitations period.  If she was awarded $5,000 per scan, her total damages would exceed $7 million despite the fact that the plaintiff had not alleged a data breach or any damages associated with identity theft or compromised data.  The dissent noted that the excessive nature of the plaintiff’s damages was exacerbated in the class-action context.  Thus, the dissent believed that the majority interpreted BIPA in such a way that the Act was converted from a remedial statute to a penal one, in violation of Illinois law.  See, People v. Nastasio, 19 Ill.2d 524, 529 (Ill. 1960) (it is the court’s duty to interpret a statute so as to promote its essential purpose and to avoid, if possible, a construction that would raise doubts as to its validity).

The dissent also believed that the majority’s interpretation of BIPA raised serious due process concerns.  As the dissent explained, a statute violates the Due Process Clause when it authorizes an award that is so severe and oppressive as to be wholly disproportioned to the offense and obviously unreasonable.  Turning again to the facts of Cothron, the dissent noted that White Castle estimated that if the plaintiff was successful and allowed to bring her claims on behalf of as many as 9,500 current and former employees, damages could exceed $17 billion.  The dissent suggested that such damages “could toll the death knell for even large, financially successful businesses.” 

The dissent next addressed the practical effect of the majority’s opinion.  For example, it noted that the lead plaintiff in Rogers v. BNSF Ry. Co., the first BIPA lawsuit tried to verdict, which resulted in a $228 million verdict, argued that the verdict amount should be multiplied based on the majority’s holding in Cothron.  Additionally, cases alleging violations of BIPA had increased 65 percent since the Cothron ruling. 

Moreover, the dissent believed that the astronomical damages potentially available based on the majority’s holding would be grossly disproportionate to the alleged harm BIPA seeks to redress.  In fact, the risk of harm BIPA was enacted to prevent appears not to have materialized yet.  According to amici, in the more than 1,700 BIPA lawsuits filed since 2019, no case involved a plaintiff alleging that his or her biometric data had been subject to a data breach or led to identity theft.

The dissent next addressed what it considered the majority’s “inconsistent conclusions” concerning the legislative intent underlying BIPA.  According to the dissent, the majority determined that BIPA’s language was clear while simultaneously suggesting the need for clarification by the legislature.  The majority specifically suggested that the legislature review the policy concerns raised by White Castle and make clear its intent regarding the assessment of damages under BIPA.  The dissent, however, believed that the legislature’s intent regarding the assessment of damages under BIPA was clear.  Namely, the dissent opined that the legislature’s intent was for a “one-time scan” interpretation of BIPA. 

Ultimately, the dissent believed a rehearing should have been granted to determine if the resulting penalty to Illinois businesses would pass constitutional scrutiny.  At a minimum, the dissent believed White Castle’s petition for rehearing should have been allowed in order to clarify paragraphs 40 through 43 of the majority’s opinion.  Those paragraphs contained the majority’s discussion of White Castle’s policy arguments regarding damages, and, according to the dissent, highlighted the conflicts resulting from the majority’s construction of BIPA. 

The dissent ended by highlighting the need for a rehearing to provide clarity to Illinois courts and to litigants.  As the dissent explained, “no guidance or criteria remain for who pays nothing and who suffers annihilative liability.”  Additionally, without guidance regarding the standard for setting damages, defendants, in class actions especially, remain unable to assess their realistic potential exposure.     

Rogers v. BNSF Ry. Co.:

Perhaps illustrating the dissent’s concerns in Cothron, in Rogers v. BNSF Ry. Co., No. 19 C 3083, 2023 U.S. Dist. LEXIS 113278 (N.D. Ill. June 30, 2023), the District Court for the Northern District of Illinois ordered a new trial on damages following the first jury verdict in a BIPA lawsuit. In October 2022, the jury returned a verdict in favor of the plaintiff class, finding that BNSF had recklessly or intentionally committed 45,600 violations of BIPA. The court did not submit the question of the amount of damages to the jury. Rather, the court found that a monetary award under BIPA is a liquidated amount that depends on the jury’s findings regarding intent (i.e., whether the defendant acted negligently or recklessly/intentionally). In other words, the court did not believe it, or the jury, had discretion regarding the amount of damages available if the jury found for the plaintiff class. Thus, the court instructed the jury to determine the number of BIPA violations and the question of intent. Following the jury’s verdict, the court entered a judgment in favor of the plaintiff class in the amount of $228 million (45,600 times $5,000).

In its motion, BNSF argued that the jury should have decided the amount of damages.  BNSF further argued that the $1,000 and $5,000 liquidated damages amounts referenced in BIPA were not mandatory.  Rather, BNSF claimed that courts or juries could award any amount up to $1,000 for a negligent violation and any amount up to $5,000 for an intentional or reckless violation. 

While the court noted that no Illinois court had squarely addressed BNSF’s argument, the court cited the Illinois Supreme Court’s opinion in Cothron, specifically its language that “it also appears that the General Assembly chose to make damages discretionary rather than mandatory under [BIPA].”  Although the plaintiff claimed that this language was dicta, the court reasoned that dicta from the Illinois Supreme Court was “good evidence” of how the court would rule on the issue. 

Based upon the language from Cothron, the court determined that damages under BIPA are discretionary and, therefore, a question for the jury.  Thus, the court partially granted BNSF’s motion for a new trial, vacated the award of damages, and ordered a new trial limited to the question of damages.