Cothron v. White Castle Sys., Inc.

• Decision Date: 20 December 2021
• Docket Number: No. 20-3202,20-3202
• Parties: Latrina COTHRON, individually and on behalf of all others similarly situated, Plaintiff-Appellee, v. WHITE CASTLE SYSTEM, INC., Defendant-Appellant.
• Court: U.S. Court of Appeals — Seventh Circuit

20 F.4th 1156

Latrina COTHRON, individually and on behalf of all others similarly situated, Plaintiff-Appellee,

v.WHITE CASTLE SYSTEM, INC., Defendant-Appellant.

No. 20-3202

United States Court of Appeals, Seventh Circuit.

Argued September 14, 2021

Decided December 20, 2021

Teresa M. Becvar, Andrew C. Ficzko, Ryan F. Stephan, James B. Zouras, Attorneys, Stephan Zouras, LLP, Chicago, IL, for Plaintiff-Appellee.

Melissa A. Siebert, Erin Bolan Hines, William F. Northrip, Attorneys, Shook, Hardy & Bacon LLP, Chicago, IL, for Defendant-Appellant.

Meredith C. Slawe, Attorney, Cozen O'Connor, Philadelphia, PA, for Amici Curiae Retail Litigation Center, Inc., Restaurant Law Center.

Debra Rae Bernard, Attorney, Perkins Coie LLP, Chicago, IL, Sopen B. Shah, Attorney, Perkins Coie LLP, Madison, WI, for Amicus Curiae LeadingAge Illinois.

Jed Wolf Glickstein, Attorney, Mayer Brown LLP, Chicago, IL, for Amicus Curiae Internet Association.

Randall D. Schmidt, Attorney, Mandel Legal Aid Clinic, Chicago, IL, for Amicus Curiae American Association for Justice.

Catherine Simmons-Gill, Attorney, Office of Catherine Simmons-Gill, LLC, Chicago, IL, for Amicus Curiae NELA/Illinois.

Alan Butler, Attorney, Alan Butler, Washington, DC, for Amicus Curiae Electronic Privacy Information Center.

Before Sykes, Chief Judge, and Easterbrook and Brennan, Circuit Judges.

Sykes, Chief Judge.

Latrina Cothron works as a manager at an Illinois White Castle hamburger restaurant where she must scan her fingerprint to access the restaurant's computer system. With each scan her fingerprint is collected and transmitted to a third-party vendor for authentication. Cothron alleges that White Castle did not obtain her written consent before implementing the fingerprint-scanning system, violating the Illinois Biometric Information Privacy Act. She brought this proposed class-action lawsuit on behalf of all Illinois White Castle employees.

White Castle moved for judgment on the pleadings based on the statute of limitations. The restaurant argued that a claim accrued under the Act the first time Cothron scanned her fingerprint into the system after the law took effect in 2008. That was more than a decade before she sued, making her suit untimely under the longest possible limitations period. Cothron responded that every unauthorized fingerprint scan amounted to a separate violation of the statute, so a new claim accrued with each scan. That would make her suit timely for the scans within the limitations period.

The district judge rejected White Castle's "one time only" theory of claim accrual and denied the motion. But he found the question close enough to warrant an interlocutory appeal under 28 U.S.C. § 1292(b). Cothron now asks us to certify the question to the Illinois Supreme Court.

We agree that this issue is best decided by the Illinois Supreme Court. Whether a claim accrues only once or repeatedly is an important and recurring question of Illinois law implicating state accrual principles as applied to this novel state statute. It requires authoritative guidance that only the state's highest court can provide.

I. Background

Cothron has worked for White Castle since 2004. She alleges that not long after she began, White Castle introduced a system that requires its employees to scan their finger-prints to access pay stubs and work computers. Each scan is sent to a third-party vendor that authenticates it and gives her access to the restaurant's computer system. Cothron contends that White Castle implemented this system without properly obtaining her consent in violation of the Illinois Biometric Information Privacy Act ("BIPA" or "the Act"), 740 ILL. COMP. STAT. 14/1 et seq.

The Illinois General Assembly adopted the Act in 2008 in response to increased commercial use of biometric data. Biometrics are "biologically unique" personal identifiers, id. § 14/5(c), and include iris scans, face geometry, and, relevant here, fingerprints, id. § 14/10. Unlike other sensitive personal information, like social security numbers, once compromised biometrics cannot be changed. § 14/5(c). The legislative findings note growing concern among members of the public about the use and collection of biometrics. See id. § 14/5(d)–(e).

To address these concerns, the Act regulates how private entities may collect and handle biometric data and provides a private cause of action for any person "aggrieved by" a violation of the statute. Id. § 14/20. A plaintiff can recover the greater of actual damages or statutory damages of $1,000 for each negligent violation and $5,000 for each reckless or willful violation. Id.

Two of the Act's provisions are relevant here. Section 15(b) provides that a private entity may not "collect, capture, purchase, receive through trade, or otherwise obtain" a person's biometric data without first providing notice to and receiving consent from the person. Id. § 14/15(b). Section 15(d) provides that a private entity may not "disclose, redisclose, or otherwise disseminate" biometric data without consent. Id. § 14/15(d).

Cothron alleges that White Castle did not attempt to obtain her consent until 2018—a decade after the Act took effect—and therefore unlawfully collected her fingerprints and unlawfully disclosed them to its third-party vendor in violation of sections 15(b) and 15(d), respectively. She sued White Castle and Cross Match Technologies, Inc., the third-party vendor, in Illinois state court seeking to represent White Castle employees whose rights were violated. Cross Match removed the case to federal court under the Class Action Fairness Act of 2005. See 28 U.S.C. §§ 1332(d), 1453. (Cothron later voluntarily dismissed Cross Match from the suit, so we mention it no further.)

The district judge sua sponte addressed subject-matter jurisdiction, examining whether Cothron alleged a concrete and particularized injury as required for Article III standing.

Cothron v. White Castle Sys., Inc. , 467 F. Supp. 3d 604 (N.D. Ill. 2020). Based on our reasoning in Bryant v. Compass Group USA, Inc. , 958 F.3d 617 (7th Cir. 2020), the judge determined that jurisdiction is secure. Cothron , 467 F. Supp. 3d at 611–13.

White Castle then moved for judgment on the pleadings, see FED. R. CIV. P. 12(c), arguing that the suit is untimely. (The duration of the limitations period is disputed, but all agree that it is no longer than five years.) White Castle maintained that Cothron filed suit too late because her claim accrued in 2008 with her first fingerprint scan after the Act's effective date. Cothron countered that a new claim accrued each time she scanned her fingerprint and White Castle sent it to the third-party authenticator—not just the first time—so her suit is timely with respect to the unlawful scans and transmissions that occurred within the limitations period.

The judge agreed with Cothron and denied White Castle's motion. Cothron v. White Castle Sys., Inc. , 477 F. Supp. 3d 723, 734 (N.D. Ill. 2020). Because the decision involved a controlling question of law on which there is substantial ground for disagreement, the judge certified his order for immediate appeal, see § 1292(b), and we accepted the certification. Cothron in turn asks us to certify the question to the Illinois Supreme Court.

II. Discussion

Though no one challenges the judge's jurisdictional ruling, "[s]ubject-matter jurisdiction is the first issue in any case," Miller v. Sw. Airlines Co. , 926 F.3d 898, 902 (7th Cir. 2019), so we begin with our "independent duty to ensure" that this case is properly in federal court, Dexia Crédit Loc. v. Rogan , 602 F.3d 879, 883 (7th Cir. 2010). After confirming Cothron's standing, we turn to the controlling legal question—whether section 15(b) and 15(d) claims accrue just once or repeatedly—as well as Cothron's request to certify the question to the Illinois Supreme Court.

A. Article III Standing and Section 15(d)

Article III of the Constitution limits the jurisdictional reach of the federal courts to "Cases" and "Controversies." U.S. CONST. art. III, § 2. Essential to this limitation is the requirement that a plaintiff have standing to sue in federal court. DaimlerChrysler Corp. v. Cuno , 547 U.S. 332, 342, 126 S.Ct. 1854, 164 L.Ed.2d 589 (2006). At the pleading stage, standing requires allegations of a concrete and particularized injury in fact that is traceable to the defendant's conduct and redressable by judicial relief. Lujan v. Defs. of Wildlife , 504 U.S. 555, 560–61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ; Bryant , 958 F.3d at 620–21.

Our decision in Bryant resolved the standing question for claims under section 15(b) of the Act, see 958 F.3d at 624, but we have yet to decide whether a violation of section 15(d) inflicts a concrete and particularized Article III injury. We do so here.

Concrete injuries encompass harms that are "real, and not abstract." Spokeo, Inc. v. Robins , 578 U.S. 330, 340, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016) (quotation marks omitted). Tangible harms like physical and monetary injuries are the most obvious, but certain intangible harms, most particularly those closely related to harms "traditionally recognized as providing a basis for lawsuits in American courts," also qualify. TransUnion LLC v. Ramirez , ––– U.S. ––––, 141 S. Ct. 2190, 2204, 210 L.Ed.2d 568 (2021) ; see also Spokeo , 578 U.S. at 340–41, 136 S.Ct. 1540. These include, for example, "reputational harms, disclosure of private information, and intrusion upon seclusion." TransUnion , 141 S. Ct. at 2204.

Particularized injuries are those that "affect the plaintiff in a personal and individual way." Lujan , 504 U.S. at 560 n.1, 112 S.Ct. 2130. They must be distinguished from "generalized grievances" that affect the public generally and for which an individual cannot seek relief in federal court. DaimlerChrysler , 547 U.S. at 348, 126 S.Ct. 1854.

Our application of these principles to section 15(d) is streamlined by the reasoning in Bryant and related circuit precedent regarding other ...