Cothron v. White Castle Sys., Inc., 20-3202

CourtUnited States Courts of Appeals. United States Court of Appeals (7th Circuit)
Writing for the CourtSykes, Chief Judge.
Citation20 F.4th 1156
Parties Latrina COTHRON, individually and on behalf of all others similarly situated, Plaintiff-Appellee, v. WHITE CASTLE SYSTEM, INC., Defendant-Appellant.
Docket NumberNo. 20-3202,20-3202
Decision Date20 December 2021

20 F.4th 1156

Latrina COTHRON, individually and on behalf of all others similarly situated, Plaintiff-Appellee,
v.
WHITE CASTLE SYSTEM, INC., Defendant-Appellant.

No. 20-3202

United States Court of Appeals, Seventh Circuit.

Argued September 14, 2021
Decided December 20, 2021


Teresa M. Becvar, Andrew C. Ficzko, Ryan F. Stephan, James B. Zouras, Attorneys, Stephan Zouras, LLP, Chicago, IL, for Plaintiff-Appellee.

Melissa A. Siebert, Erin Bolan Hines, William F. Northrip, Attorneys, Shook, Hardy & Bacon LLP, Chicago, IL, for Defendant-Appellant.

Meredith C. Slawe, Attorney, Cozen O'Connor, Philadelphia, PA, for Amici Curiae Retail Litigation Center, Inc., Restaurant Law Center.

Debra Rae Bernard, Attorney, Perkins Coie LLP, Chicago, IL, Sopen B. Shah, Attorney, Perkins Coie LLP, Madison, WI, for Amicus Curiae LeadingAge Illinois.

Jed Wolf Glickstein, Attorney, Mayer Brown LLP, Chicago, IL, for Amicus Curiae Internet Association.

Randall D. Schmidt, Attorney, Mandel Legal Aid Clinic, Chicago, IL, for Amicus Curiae American Association for Justice.

Catherine Simmons-Gill, Attorney, Office of Catherine Simmons-Gill, LLC, Chicago, IL, for Amicus Curiae NELA/Illinois.

Alan Butler, Attorney, Alan Butler, Washington, DC, for Amicus Curiae Electronic Privacy Information Center.

Before Sykes, Chief Judge, and Easterbrook and Brennan, Circuit Judges.

Sykes, Chief Judge.

Latrina Cothron works as a manager at an Illinois White Castle hamburger restaurant where she must scan her fingerprint to access the restaurant's computer system. With each scan her fingerprint is collected and transmitted to a third-party vendor for authentication. Cothron alleges that White Castle did not obtain her written consent before implementing the fingerprint-scanning system, violating the Illinois Biometric Information Privacy Act. She brought this proposed class-action lawsuit on behalf of all Illinois White Castle employees.

White Castle moved for judgment on the pleadings based on the statute of limitations. The restaurant argued that a claim accrued under the Act the first time Cothron scanned her fingerprint into the system after the law took effect in 2008. That was more than a decade before she sued, making her suit untimely under the longest possible limitations period. Cothron responded that every unauthorized fingerprint

20 F.4th 1159

scan amounted to a separate violation of the statute, so a new claim accrued with each scan. That would make her suit timely for the scans within the limitations period.

The district judge rejected White Castle's "one time only" theory of claim accrual and denied the motion. But he found the question close enough to warrant an interlocutory appeal under 28 U.S.C. § 1292(b). Cothron now asks us to certify the question to the Illinois Supreme Court.

We agree that this issue is best decided by the Illinois Supreme Court. Whether a claim accrues only once or repeatedly is an important and recurring question of Illinois law implicating state accrual principles as applied to this novel state statute. It requires authoritative guidance that only the state's highest court can provide.

I. Background

Cothron has worked for White Castle since 2004. She alleges that not long after she began, White Castle introduced a system that requires its employees to scan their finger-prints to access pay stubs and work computers. Each scan is sent to a third-party vendor that authenticates it and gives her access to the restaurant's computer system. Cothron contends that White Castle implemented this system without properly obtaining her consent in violation of the Illinois Biometric Information Privacy Act ("BIPA" or "the Act"), 740 ILL. COMP. STAT. 14/1 et seq.

The Illinois General Assembly adopted the Act in 2008 in response to increased commercial use of biometric data. Biometrics are "biologically unique" personal identifiers, id. § 14/5(c), and include iris scans, face geometry, and, relevant here, fingerprints, id. § 14/10. Unlike other sensitive personal information, like social security numbers, once compromised biometrics cannot be changed. § 14/5(c). The legislative findings note growing concern among members of the public about the use and collection of biometrics. See id. § 14/5(d)–(e).

To address these concerns, the Act regulates how private entities may collect and handle biometric data and provides a private cause of action for any person "aggrieved by" a violation of the statute. Id. § 14/20. A plaintiff can recover the greater of actual damages or statutory damages of $1,000 for each negligent violation and $5,000 for each reckless or willful violation. Id.

Two of the Act's provisions are relevant here. Section 15(b) provides that a private entity may not "collect, capture, purchase, receive through trade, or otherwise obtain" a person's biometric data without first providing notice to and receiving consent from the person. Id. § 14/15(b). Section 15(d) provides that a private entity may not "disclose, redisclose, or otherwise disseminate" biometric data without consent. Id. § 14/15(d).

Cothron alleges that White Castle did not attempt to obtain her consent until 2018—a decade after the Act took effect—and therefore unlawfully collected her fingerprints and unlawfully disclosed them to its third-party vendor in violation of sections 15(b) and 15(d), respectively. She sued White Castle and Cross Match Technologies, Inc., the third-party vendor, in Illinois state court seeking to represent White Castle employees whose rights were violated. Cross Match removed the case to federal court under the Class Action Fairness Act of 2005. See 28 U.S.C. §§ 1332(d), 1453. (Cothron later voluntarily dismissed Cross Match from the suit, so we mention it no further.)

The district judge sua sponte addressed subject-matter jurisdiction, examining whether Cothron alleged a concrete and particularized injury as required for Article III standing.

20 F.4th 1160

Cothron v. White Castle Sys., Inc. , 467 F. Supp. 3d 604 (N.D. Ill. 2020). Based on our reasoning in Bryant v. Compass Group USA, Inc. , 958 F.3d 617 (7th Cir. 2020), the judge determined that jurisdiction is secure. Cothron , 467 F. Supp. 3d at 611–13.

White Castle then moved for judgment on the pleadings, see FED. R. CIV. P. 12(c), arguing that the suit is untimely. (The duration of the limitations period is disputed, but all agree that it is no longer than five years.) White Castle maintained that Cothron filed suit too late because her claim accrued in 2008 with her first fingerprint scan after the Act's effective date. Cothron countered that a new claim accrued each time she scanned her fingerprint and White Castle sent it to the third-party authenticator—not just the first time—so her suit is timely with respect to the unlawful scans and transmissions that occurred within the limitations period.

The judge agreed with Cothron and denied White Castle's motion. Cothron v. White Castle Sys., Inc. , 477 F. Supp. 3d 723, 734 (N.D. Ill. 2020). Because the decision involved a controlling question of law on which there is substantial ground for disagreement, the judge certified his order for immediate appeal, see § 1292(b), and we accepted the certification. Cothron in turn asks us to certify the question to the Illinois Supreme Court.

II. Discussion

Though no one challenges the judge's jurisdictional ruling, "[s]ubject-matter jurisdiction is the first issue in any case," Miller v. Sw. Airlines Co. , 926 F.3d 898, 902 (7th Cir. 2019), so we begin with our "independent duty to ensure" that this case is properly in federal court, Dexia Crédit Loc. v. Rogan , 602 F.3d 879, 883 (7th Cir. 2010). After confirming Cothron's standing, we turn to the controlling legal question—whether section 15(b) and 15(d) claims accrue just once or repeatedly—as well as Cothron's request to certify the question to the Illinois Supreme Court.

A. Article III Standing and Section 15(d)

Article III of the Constitution limits the jurisdictional reach of the federal courts to "Cases" and "Controversies." U.S. CONST. art. III, § 2. Essential to this limitation is the requirement that a plaintiff have standing to sue in federal court. DaimlerChrysler Corp. v. Cuno , 547 U.S. 332, 342, 126 S.Ct. 1854, 164 L.Ed.2d 589 (2006). At the pleading stage, standing requires allegations of a concrete and particularized injury in fact that is traceable to the defendant's conduct and redressable by judicial relief. Lujan v. Defs. of Wildlife , 504 U.S. 555, 560–61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ; Bryant , 958 F.3d at 620–21.

Our decision in Bryant resolved the standing question for claims under section 15(b) of the Act, see 958 F.3d at 624, but we have yet to decide whether a violation of section 15(d) inflicts a concrete and particularized Article III injury. We do so here.

Concrete injuries encompass harms that are "real, and not abstract." Spokeo, Inc. v. Robins , 578 U.S. 330, 340, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016) (quotation marks omitted). Tangible harms like physical and monetary injuries are the most obvious, but certain intangible harms, most...

To continue reading

Request your trial
27 practice notes
  • Patterson v. Respondus, Inc., 20 C 7692
    • United States
    • United States District Courts. 7th Circuit. United States District Court (Northern District of Illinois)
    • March 23, 2022
    ...types of violations, and those differences bear on the question of Article III standing. 11 See Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1160-61 (7th Cir. 2021) (summarizing the Seventh Circuit's standing rules for different BIPA provisions). Section 15(a). Section 15(a) of BIPA r......
  • In re Clearview AI, Inc. Consumer Privacy Litig., 21-cv-0135
    • United States
    • United States District Courts. 7th Circuit. United States District Court (Northern District of Illinois)
    • February 14, 2022
    ...the defendants' conduct; and (3) that is likely to be redressed by a favorable judicial decision. Cothron v. White Castle System, Inc., 20 F.4th 1156, 1160 (7th Cir. 2021). Under the first requirement, an injury-in-fact must be “concrete and particularized” and “actual or imminent.” Prosser......
  • Cont'l W. Ins. Co. v. Cheese Merchants of Am., LLC, 21-cv-1571
    • United States
    • United States District Courts. 7th Circuit. United States District Court (Northern District of Illinois)
    • September 27, 2022
    ...choices about to whom and for what purpose they will relinquish control of that information.”); Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1161 (7th Cir. 2021) (noting that at least one section of BIPA “protect[s] a person's privacy interest in his unique biometric data, so a noncom......
  • Johnson v. Soo Line R.R. Co., 17-cv-7828
    • United States
    • United States District Courts. 7th Circuit. United States District Court (Northern District of Illinois)
    • February 23, 2022
    ...he was not, as discussed below), the record lacks evidence that he knew that Plaintiff's concerns related to protected conduct. Miller, 20 F.4th at 1156. Nor could a reasonable juror infer retaliatory intent from the fact that Harwick checked in consistently with crew foreman Campbell about......
  • Request a trial to view additional results
13 cases
  • Patterson v. Respondus, Inc., 20 C 7692
    • United States
    • United States District Courts. 7th Circuit. United States District Court (Northern District of Illinois)
    • March 23, 2022
    ...types of violations, and those differences bear on the question of Article III standing. 11 See Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1160-61 (7th Cir. 2021) (summarizing the Seventh Circuit's standing rules for different BIPA provisions). Section 15(a). Section 15(a) of BIPA r......
  • In re Clearview AI, Inc. Consumer Privacy Litig., 21-cv-0135
    • United States
    • United States District Courts. 7th Circuit. United States District Court (Northern District of Illinois)
    • February 14, 2022
    ...the defendants' conduct; and (3) that is likely to be redressed by a favorable judicial decision. Cothron v. White Castle System, Inc., 20 F.4th 1156, 1160 (7th Cir. 2021). Under the first requirement, an injury-in-fact must be “concrete and particularized” and “actual or imminent.” Prosser......
  • Cont'l W. Ins. Co. v. Cheese Merchants of Am., LLC, 21-cv-1571
    • United States
    • United States District Courts. 7th Circuit. United States District Court (Northern District of Illinois)
    • September 27, 2022
    ...choices about to whom and for what purpose they will relinquish control of that information.”); Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1161 (7th Cir. 2021) (noting that at least one section of BIPA “protect[s] a person's privacy interest in his unique biometric data, so a noncom......
  • Marszalek v. Kelly, 20-cv-4270
    • United States
    • United States District Courts. 7th Circuit. United States District Court (Northern District of Illinois)
    • January 26, 2022
    ...claim. [95]. As a jurisdictional matter, the issue of standing comes first in this Court's analysis. Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1160 (7th Cir. 2021). 1. Article III Standing Article III of the Constitution limits federal judicial jurisdiction to the adjudication of “......
  • Request a trial to view additional results
14 firm's commentaries
  • Biometric Privacy Trends In The United States
    • United States
    • Mondaq United States
    • November 21, 2022
    ...White Castle Sys., Inc., No. 128004, filed pursuant to an order of certification from the U.S. Court of Appeals for the Seventh Circuit, 20 F.4th 1156 (7th Cir. 2021). The Illinois Supreme Court's decision will establish the law going forward but is unlikely to affect the jury's finding in ......
  • Illinois Supreme Court Holds Workers' Compensation Act Does Not Bar BIPA Claims
    • United States
    • Mondaq United States
    • February 7, 2022
    ...McDonald. For example, the U.S. Court of Appeals for the Seventh Circuit recently issued a decision in Cothron v. White Castle Systems, 20 F.4th 1156 (7th Cir. 2021), certifying to the Illinois Supreme Court the question whether claims asserted under Sections 15(b) and 15(d) of the BIPA acc......
  • Federal Court Stays Suit Implicating Accrual of Claims Under the Illinois Biometric Information Privacy Act
    • United States
    • LexBlog United States
    • July 14, 2022
    ...such a scan to a third party, respectively, or only upon the first scan and first transmission.” Cothron v. White Castle System, Inc., 20 F.4th 1156, 1167 (7th Cir. 2021) (certifying the question). A five-year statute of limitations governs claims brought under BIPA sections 15(a) and 15(b)......
  • Federal Court Stays Suit Implicating Accrual of Claims Under the Illinois Biometric Information Privacy Act
    • United States
    • LexBlog United States
    • July 14, 2022
    ...such a scan to a third party, respectively, or only upon the first scan and first transmission.” Cothron v. White Castle System, Inc., 20 F.4th 1156, 1167 (7th Cir. 2021) (certifying the question). A five-year statute of limitations governs claims brought under BIPA sections 15(a) and 15(b)......
  • Request a trial to view additional results

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT