In a pair of decisions issued in late December, both the Illinois Appellate Court and the Seventh Circuit Court of Appeals considered whether claims brought under the Illinois Biometric Information Privacy Act (“BIPA”) accrue only when a defendant first violates the statute or each time the statute is violated. The Illinois Appellate Court found that each BIPA violation triggers the running of the statute of limitations anew, while the Seventh Circuit certified the question of when BIPA claims accrue to the Illinois Supreme Court.

• The Illinois Appellate Court case—Watson v. Legacy Healthcare Financial Services, LLC—was brought by a certified nursing assistant who worked at two Chicago-area facilities owned by the same company. Plaintiff asserted that, between 2012 and 2019 while he was employed by defendants, he was required to provide a full handprint to access his timecard and punch in and out of work. Plaintiff brought suit in March 2019, claiming—on behalf of himself and a putative class of similarly situated individuals—that the defendants’ practices concerning these handprints violated BIPA in four distinct ways.
• The defendants moved to dismiss, arguing that plaintiff’s claims were time-barred because they accrued on the first day he provided a handprint to them. The trial court agreed and dismissed the plaintiff’s claims against two of the defendants on statute of limitations grounds.
• The plaintiff appealed to the Illinois Appellate Court, which reversed. The court first considered BIPA’s plain text. It focused on the lack of a “temporal limitation on” BIPA’s command that private entities not “collect” or “capture” biometric information without the subject's informed consent. The court reasoned that the statute’s plain language “thereby appl[ies] to the first, as well as the last, collection or capture.”
• Both in its discussion of BIPA’s text and in a separate discussion about the law’s legislative history, the court emphasized BIPA’s goals of allaying fears of a public “skeptical” about the collection of biometric data and giving individuals the opportunity to seek “recourse” for the unlawful collection of such data. The court suggested that these purposes supported its conclusion that claims under the statute accrue upon each violation of BIPA, not the first such violation.
• The Seventh Circuit case— Cothron v. White Castle System, Inc.—was decided just days after Watson. The plaintiff in that case worked for a White Castle hamburger restaurant for more than a decade, beginning in 2004. Though the plaintiff was required to scan her fingerprint to access White Castle computers for most or all of that time, White Castle did not seek the plaintiff’s written informed consent to collect her biometric data until 2018. The plaintiff brought BIPA claims on behalf of herself and a putative class based on White Castle’s alleged (1) failure to obtain this written consent and (2) sharing of biometric data with a vendor White Castle used to authenticate that data. White Castle moved for judgment on the pleadings, making the same primary argument as the Watson defendants: that the plaintiff’s claims were untimely because they accrued only when she first provided biometric data to White Castle more than a decade before bringing suit. The Northern District of Illinois found that a new BIPA claim accrued each time White Castle collected and shared the plaintiff’s information, but it certified its order on that issue for interlocutory appeal.
• The Seventh Circuit accepted the interlocutory appeal. Regarding when a BIPA claim accrues, the court reviewed the party’s arguments, pointing out that both the statute’s plain text and the precedent interpreting it could be fairly read to allow for one or multiple claim accrual points. The court also discussed the parties’ policy-related arguments in some detail. White Castle argued that finding that a new claim accrues with each BIPA violation could result in “staggering damages awards,” as the conduct underlying BIPA claims often occurs frequently (e.g., White Castle employees scan their fingerprints multiple times per day to access company computers) and the statute allows for between $1,000 and $5,000 in statutory damages for each violation. The plaintiff argued that if BIPA claims accrued only once, a company would suffer no legal consequences for repeated violations and would have little incentive to improve their practices around biometric data.
• Notwithstanding the Watson decision issued by Illinois’s intermediate appellate court just a few days earlier, the Seventh Circuit concluded that the strong arguments on all sides of the accrual issue—and its importance to resolving the ever-growing docket of BIPA cases—warranted certifying that issue to the Illinois Supreme Court.
• Now that the Illinois Supreme Court is poised to take up Cothron, it appears that Watson will not be the Illinois appellate courts’ last word on the hotly contested issue of when BIPA claims accrue. Both Watson and Cothron demonstrate that the accrual issue is a close one on which the Illinois Supreme Court could go either way. And the policy arguments that the parties articulated in Cothron demonstrate that the Supreme Court’s resolution of that issue could have a major impact on BIPA litigation going forward.

You can read the Illinois Appellate Court’s full decision in Watson v. Legacy Healthcare Financial Services, LLC here and the Seventh Circuit’s full decision in Cothron v. White Castle System, Inc. here.