Title: Cothron v. White Castle System, Inc.
Citation: 2023 IL 128004
Docket Number: 128004
State: Illinois
Issuer: Illinois Supreme Court
Date: July 18, 2023

2023 IL 128004 
 
IN THE 
SUPREME COURT 
OF 
THE STATE OF ILLINOIS 
 
 
 
(Docket No. 128004) 
LATRINA COTHRON, Appellee, v. WHITE CASTLE SYSTEM, INC., Appellant. 
 
 
Opinion filed February 17, 2023.—Rehearing denied July 18, 2023. 
 
 
JUSTICE ROCHFORD delivered the judgment of the court, with opinion. 
 
Justices Neville, Cunningham, and O’Brien concurred in the judgment and 
opinion. 
 
Justice Overstreet dissented, with opinion, joined by Chief Justice Theis and 
Justice Holder White. 
 
Justice Overstreet dissented upon denial of rehearing, with opinion, joined by 
Chief Justice Theis and Justice Holder White.  
OPINION 
 
¶ 1 
 
This case requires us to construe section 15(b) and 15(d) of the Biometric 
Information Privacy Act (Act) (740 ILCS 14/15(b), (d) (West 2018)) in an action 
alleging that an employer violated the Act when it repeatedly collected fingerprints 
 
 
 
 
 
- 2 - 
from an employee and disclosed that biometric information to a third party without 
consent. Specifically, the United States Court of Appeals for the Seventh Circuit 
certified the following question of law to this court: “Do section 15(b) and 15(d) 
claims accrue each time a private entity scans a person’s biometric identifier and 
each time a private entity transmits such a scan to a third party, respectively, or only 
upon the first scan and first transmission?” Cothron v. White Castle System, Inc., 
20 F.4th 1156, 1167 (7th Cir. 2021). We hold that a separate claim accrues under 
the Act each time a private entity scans or transmits an individual’s biometric 
identifier or information in violation of section 15(b) or 15(d). 
 
¶ 2 
 
 
 
 
 
I. BACKGROUND 
¶ 3 
 
We recite the facts as provided by the Seventh Circuit in its certification ruling. 
See, e.g., In re Hernandez, 2020 IL 124661, ¶ 5. The controversy arises from a 
proposed class action filed by plaintiff, Latrina Cothron, on behalf of all Illinois 
employees of defendant, White Castle System, Inc. (White Castle). Plaintiff 
originally filed her action in the circuit court of Cook County against White Castle 
and its third-party vendor, Cross Match Technologies. Cross Match Technologies 
removed the case to federal court under the Class Action Fairness Act of 2005 (28 
U.S.C. §§ 1332(d), 1453 (2018)). Plaintiff later voluntarily dismissed Cross Match 
Technologies from her action and proceeded solely against White Castle in the 
United States District Court for the Northern District of Illinois.  
¶ 4 
 
According to her complaint, plaintiff is a manager of a White Castle restaurant 
in Illinois, where she has been employed since 2004. Shortly after her employment 
began, White Castle introduced a system that required its employees to scan their 
fingerprints to access their pay stubs and computers. A third-party vendor then 
verified each scan and authorized the employee’s access. 
¶ 5 
 
Generally, plaintiff’s complaint alleged that White Castle implemented this 
biometric-collection system without obtaining her consent in violation of the Act 
(740 ILCS 14/1 et seq. (West 2018)), which became effective in 2008 (see Pub. Act 
95-994, § 1 (eff. Oct. 3, 2008)). Section 15(b) of the Act provides that a private 
entity may not “collect, capture, purchase, receive through trade, or otherwise 
obtain” a person’s biometric data without first providing notice to and receiving 
consent from the person. 740 ILCS 14/15(b) (West 2018). Section 15(d) provides 
 
 
 
 
 
- 3 - 
that a private entity may not “disclose, redisclose, or otherwise disseminate” 
biometric data without consent. Id. § 15(d).  
¶ 6 
 
Plaintiff asserted that White Castle did not seek her consent to acquire her 
fingerprint biometric data until 2018, more than a decade after the Act took effect. 
Accordingly, plaintiff claimed that White Castle unlawfully collected her biometric 
data and unlawfully disclosed her data to its third-party vendor in violation of 
section 15(b) and 15(d), respectively, for several years. 
¶ 7 
 
In relevant part, White Castle moved for judgment on the pleadings, arguing 
that plaintiff’s action was untimely because her claim accrued in 2008, when White 
Castle first obtained her biometric data after the Act’s effective date. Plaintiff 
responded that a new claim accrued each time she scanned her fingerprints and 
White Castle sent her biometric data to its third-party authenticator, rendering her 
action timely with respect to the unlawful scans and transmissions that occurred 
within the applicable limitations period. 
¶ 8 
 
The district court agreed with plaintiff and denied White Castle’s motion. 
Cothron v. White Castle System, Inc., 477 F. Supp. 3d 723, 734 (N.D. Ill. 2020). 
The court later certified its order for immediate interlocutory appeal, finding that 
its decision involved a controlling question of law on which there is substantial 
ground for disagreement. 
¶ 9 
 
The United States Court of Appeals for the Seventh Circuit accepted the 
certification. After determining that plaintiff had standing to bring her action in 
federal court under article III of the United States Constitution (U.S. Const., art. 
III), the Seventh Circuit addressed the parties’ respective arguments on the accrual 
of a claim under the Act. Cothron, 20 F.4th at 1162-65. Ultimately, the Seventh 
Circuit found the parties’ competing interpretations of claim accrual reasonable 
under Illinois law, and it agreed with plaintiff that “the novelty and uncertainty of 
the claim-accrual question” warranted certification of the question to this court. Id. 
at 1165-66. The Seventh Circuit observed that the answer to the claim-accrual 
question would determine the outcome of the parties’ dispute, this court could 
potentially side with either party on the question, the question was likely to recur, 
and it involved a unique Illinois statute regularly applied by federal courts. Id. at 
 
 
 
 
 
- 4 - 
1166. Thus, finding the relevant criteria favored certification of the question, the 
Seventh Circuit certified the question to this court.1 Id. at 1166-67. 
¶ 10 
 
We chose to answer that question. See Ill. S. Ct. R. 20(a) (eff. Aug. 1, 1992). 
The Illinois Chamber of Commerce, Chamber of Commerce of the United States, 
Retail Litigation Center, Inc., Restaurant Law Center, National Retail Federation, 
Illinois Manufacturers’ Association, National Association of Manufacturers, 
Illinois Health and Hospital Association, Illinois Retail Merchants Association, 
Chemical Industry Council of Illinois, Illinois Trucking Association, Mid-West 
Truckers Association, and Chicagoland Chamber of Commerce were granted leave 
to file amicus curiae briefs in support of White Castle’s position. Ill. S. Ct. R. 345 
(eff. Sept. 20, 2010). The American Association for Justice, Employment Law 
Clinic of the University of Chicago Law School’s Edwin F. Mandell Legal Aid 
Clinic, NELA/Illinois National Employment Law Project, Raise the Floor Alliance, 
and Electronic Privacy Information Center (EPIC) were granted leave to file 
amicus curiae briefs in support of plaintiff’s position. Id. 
 
¶ 11 
 
 
 
 
 
II. ANALYSIS 
¶ 12 
 
The certified question asks: “Do section 15(b) and 15(d) claims accrue each 
time a private entity scans a person’s biometric identifier and each time a private 
entity transmits such a scan to a third party, respectively, or only upon the first scan 
and first transmission?” When answering this question, we assume, without 
deciding, that White Castle’s alleged collection of plaintiff’s fingerprints and 
transmission to a third party was done in violation of the Act.  
¶ 13 
 
Section 15(b) of the Act provides: 
 
 
1Several federal district courts have stayed proceedings pending a final decision from the 
Seventh Circuit in Cothron in connection with the accrual question. See, e.g., Callendar v. Quality 
Packaging Specialists International, Inc., No. 21-cv-505-SMY, 2021 WL 4169967 (S.D. Ill. Aug. 
27, 2021); Hall v. Meridian Senior Living, LLC, No. 21-cv-55-SMY, 2021 WL 2661521 (S.D. Ill. 
June 29, 2021); Roberson v. Maestro Consulting Services, LLC, No. 20-CV-00895-NJR, 2021 WL 
1017127 (S.D. Ill, Mar. 17, 2021); Roberts v. Graphic Packaging International, LLC, No. 21-CV-
750-DWD, 2021 WL 3634172 (S.D. Ill. Aug. 17, 2021); Starts v. Little Caesar Enterprises, Inc., 
No. 19-cv-1575, 2021 WL 4988317 (N.D. Ill. Oct. 19, 2021); Treadwell v. Power Solutions 
International, Inc., No. 18-cv-8212, 2021 WL 5712186 (N.D. Ill. Dec. 2, 2021).  
 
 
 
 
 
- 5 - 
 
“No private entity may collect, capture, purchase, receive through trade, or 
otherwise obtain a person’s or a customer’s biometric identifier or biometric 
information, unless it first: 
 
(1) informs the subject or the subject’s legally authorized representative 
in writing that a biometric identifier or biometric information is being 
collected or stored; 
 
(2) informs the subject or the subject’s legally authorized representative 
in writing of the specific purpose and length of term for which a biometric 
identifier or biometric information is being collected, stored, and used; and 
 
(3) receives a written release executed by the subject of the biometric 
identifier or biometric information or the subject’s legally authorized 
representative.” 740 ILCS 14/15(b) (West 2018).  
¶ 14 
 
Section 15(d) of the Act provides, in relevant part, that  
“[n]o private entity in possession of a biometric identifier or biometric 
information may disclose, redisclose, or otherwise disseminate a person’s or a 
customer’s biometric identifier or biometric information unless:  
 
*** the subject of the biometric identifier or biometric information or 
the subject’s legally authorized representative consents to the disclosure or 
redisclosure[.]” Id. § 15(d)(1).  
¶ 15 
 
Relevant to this case, the Act further defines the term “biometric identifier” to 
include a fingerprint and the term “biometric information” to include any 
information based on an individual’s biometric identifier used to identify that 
person. Id. § 10. The Act provides a private right of action for any person aggrieved 
by a violation of the Act. Id. § 20. 
¶ 16 
 
White Castle argues that section 15(b) and 15(d) claims can accrue only once—
when the biometric data is initially collected or disclosed. Section 15(b) provides 
that no private entity “may collect, capture, purchase, receive through trade, or 
otherwise obtain a person’s or a customer’s biometric identifier or biometric 
information, unless it first” provides notice and receives consent as outlined in the 
rest of section 15(b). (Emphasis added.) Id. § 15(b). According to White Castle, the 
 
 
 
 
 
- 6 - 
“unless it first” phrase refers to a singular point in time; notice and consent must 
precede, or occur before, collection. The active verbs used in section 15(b)—
collect, capture, purchase, receive, and obtain—all mean to gain control, an action 
that White Castle argues can only happen once under the plain meaning of those 
terms.  
¶ 17 
 
White Castle advances a similar argument for section 15(d), noting that it 
provides that no private entity “in possession of a biometric identifier or biometric 
information may disclose, redisclose, or otherwise disseminate a person’s or a 
customer’s biometric identifier or biometric information unless” the private entity 
has obtained consent or certain exceptions apply. Id. § 15(d). Thus, section 15(d) 
requires consent in order for a private entity to “disclose, redisclose, or otherwise 
disseminate” an individual’s biometrics. According to White Castle, the plain 
meaning of each verb used in section 15(d) “implicates the disclosure of biometrics 
by one party to a new, third party—said differently, a party that has not previously 
possessed the relevant biometric identifier or biometric information.” As it argues 
for section 15(b) claims, White Castle contends that occurs only on the first instance 
of disclosure or dissemination.  
¶ 18 
 
Plaintiff responds that the plain meaning of the statutory language demonstrates 
that claims under section 15(b) and 15(d) accrue every time a private entity collects 
or disseminates biometrics without prior informed consent. According to plaintiff, 
this construction is consistent with the plain meaning of the statutory language, 
gives effect to every word in the provision, and directly reflects legislative intent to 
provide an individual with a meaningful and informed opportunity to decline the 
collection or dissemination of their biometrics. It also provides an incentive for 
private entities that collect biometric information to take action to mitigate their 
conduct if they neglected to comply at first.  
¶ 19 
 
Plaintiff maintains that section 15(b) applies to every instance when a private 
entity collects biometric information without prior consent. According to plaintiff, 
the word “first” in section 15(b) modifies the words “informs” and “receives.” 
Thus, according to plaintiff, an entity violates section 15(b) when it collects, 
captures, or otherwise obtains a person’s biometrics without prior informed 
consent. Plaintiff observes that our appellate court reached the same conclusion in 
Watson v. Legacy Healthcare Financial Services, LLC, 2021 IL App (1st) 210279, 
 
 
 
 
 
- 7 - 
¶ 53. Similarly, section 15(d) prohibits the disclosure, redisclosure, or 
dissemination of biometrics by a private entity “unless” that entity receives prior 
consent. Thus plaintiff argues that, under the plain language of both section 15(b) 
and 15(d), a claim accrues each time that biometric identifiers or information are 
collected or disseminated by a private entity without prior informed consent. 
¶ 20 
 
To resolve the parties’ dispute and answer the certified question, we focus on 
the language of the Act itself. The cardinal principle and primary objective in 
construing a statute is to ascertain and give effect to the intention of the legislature. 
Roberts v. Alexandria Transportation, Inc., 2021 IL 126249, ¶ 29. The best 
indicator of legislative intent is the statutory language itself, given its plain and 
ordinary meaning. In re Hernandez, 2020 IL 124661, ¶ 18. Where the language is 
clear and unambiguous, we must apply the statute without resort to further aids of 
statutory construction. Krohe v. City of Bloomington, 204 Ill. 2d 392, 395 (2003). 
Only if the statutory language is ambiguous may we look to other sources to 
ascertain the legislature’s intent. Id.  
 
¶ 21 
 
 
 
 
 
Section 15(b) 
¶ 22 
 
Section 15(b) mandates informed consent from an individual before a private 
entity collects biometric identifiers or information. Specifically, section 15(b) 
provides that “[n]o private entity may collect, capture, purchase, receive through 
trade, or otherwise obtain a person’s or a customer’s biometric identifier or 
biometric information unless it first” obtains informed consent from the individual 
or the individual’s legally authorized representative. 740 ILCS 14/15(b) (West 
2018). 
¶ 23 
 
We agree with plaintiff that the plain language of the statute supports her 
interpretation. “Collect” means to “to receive, gather, or exact from a number of 
persons or other sources.” Webster’s Third New International Dictionary 444 
(1993). “Capture” means “to take, seize, or catch.” Id. at 334. We disagree with 
defendant that these are things that can happen only once. As plaintiff explains in 
her complaint, White Castle obtains an employee’s fingerprint and stores it in its 
database. The employee must then use his or her fingerprint to access paystubs or 
White Castle computers. With the subsequent scans, the fingerprint is compared to 
the stored copy of the fingerprint. Defendant fails to explain how such a system 
 
 
 
 
 
- 8 - 
could work without collecting or capturing the fingerprint every time the employee 
needs to access his or her computer or pay stub. As the district court explained, 
“[e]ach time an employee scans her fingerprint to access the system, the system 
must capture her biometric information and compare that newly captured 
information to the original scan (stored in an off-site database by one of the third-
parties with which White Castle contracted).” Cothron, 477 F. Supp. 3d at 732. To 
the extent White Castle is suggesting that “collection” or “capture” occurs only 
when an entity first obtains a print to store in its database—and subsequent 
authentication scans therefore cannot be collections or captures—this argument is 
belied by the position White Castle took below. White Castle acknowledges that it 
argued in its motion for judgment on the pleadings that plaintiff’s claim accrued, if 
ever, in 2008 with her first scan after the Act’s enactment. And White Castle argues 
in its brief that “there was no ‘loss of control’ under [the Act] until 2008, the first 
time she used the finger-scan technology in 2008 following [the Act’s] effective 
date.” Because White Castle first obtained a copy of plaintiff’s fingerprint years 
before this, the first scan after the Act went into effect would have been a routine 
authentication scan. A claim could have accrued upon the taking of this 
authentication scan only if it were a collection or a capture under section 15(b). 
Moreover, section 15(b)(2) of the Act distinguishes between collection and storage. 
This section provides that the private entity must notify the subject of the “length 
of term for which a biometric identifier or biometric information is being collected, 
stored, and used.” 740 ILCS 14/15(b)(2) (West 2008). That the subject must be 
notified how long his or her biometric data will be collected shows that the 
legislature contemplated collection as being something that would happen more 
than once.  
¶ 24 
 
We agree with the federal district court that “[a] party violates Section 15(b) 
when it collects, captures, or otherwise obtains a person’s biometric information 
without prior informed consent. This is true the first time an entity scans a 
fingerprint or otherwise collects biometric information, but it is no less true with 
each subsequent scan or collection.” Cothron, 477 F. Supp. 3d at 732. Our appellate 
court has reached the same conclusion, determining that “the plain language of 
[section 15(b)] establishes that it applies to each and every capture and use of 
plaintiff’s fingerprint or hand scan. Almost every substantive section of the Act 
supports this finding.” Watson, 2021 IL App (1st) 210279, ¶ 46. 
 
 
 
 
 
- 9 - 
¶ 25 
 
White Castle’s suggestion that the “unless it first” phrase in section 15(b) refers 
only to the first collection of biometric information is inaccurate. Contrary to White 
Castle’s position, the “unless it first” phrase refers to the private entity’s statutory 
obligation to obtain consent or a release. See 740 ILCS 14/15(b) (West 2018) 
(prohibiting a private entity from collecting, capturing, purchasing, receiving, or 
otherwise obtaining biometric information “unless it first” obtains consent or a 
release as described by the statute). As our appellate court correctly determined, the 
“unless it first” phrase “modifies the entity’s obligations, not the triggering 
actions.” Watson, 2021 IL App (1st) 210279, ¶ 53. 
 
¶ 26 
 
 
 
 
 
Section 15(d) 
¶ 27 
 
Similar to section 15(b), section 15(d) mandates consent or legal authorization 
before a specific action is taken. It provides that “[n]o private entity in possession 
of a biometric identifier or biometric information may disclose, redisclose, or 
otherwise disseminate a person’s or a customer’s biometric identifier or biometric 
information unless” it obtains informed consent from the individual or their legal 
representative or has other legal authorization to disclose that information. 740 
ILCS 14/15(d) (West 2018).  
¶ 28 
 
As with section 15(b), we conclude that the plain language of section 15(d) 
applies to every transmission to a third party. White Castle argues that a disclosure 
is something that can happen only once. The Seventh Circuit asserted that the plain 
meaning of “disclose” connotes a new revelation. See Cothron, 20 F.4th at 1163; 
see also Webster’s Third New International Dictionary 645 (1993) (defining 
“disclose” as “to make known” or “to reveal *** something that is secret or not 
generally known”). In determining that an entity violates section 15(d) every time 
it discloses or otherwise disseminates biometric data, the district court focused on 
this section’s use of the term “redisclose.” Cothron, 477 F. Supp. 3d at 733. The 
district court agreed with plaintiff that repeated transmissions to the same third 
party are “redisclosures.” Id. As the Seventh Circuit court pointed out, however, 
the issue is not quite so simple: 
“[Cothron] reads the term ‘redisclose’ as used in section 15(d) to include 
repeated disclosures of the same biometric data to the same third party. For its 
part, White Castle offers a different interpretation of the term: a downstream 
 
 
 
 
 
- 10 - 
disclosure carried out by a third party to whom information was originally 
disclosed. That reading is consistent with the term ‘redisclose’ as used in other 
Illinois statutes.[2] Countering again, Cothron argues that this usage would make 
‘redisclose’ meaningless surplusage. Section 15(d) applies to any ‘private entity 
in possession of a biometric identifier or biometric information.’ As such, a 
violation by a down-stream entity can just be called a ‘disclosure,’ making 
‘redisclose’ redundant under White Castle’s reading. Maybe so; or maybe 
‘redisclose’ serves to make certain that down-stream entities are subject to 
section 15(d). See Reid Hosp. & Health Care Servs., Inc. v. Conifer Revenue 
Cycle Sols., LLC, 8 F.4th 642, 652 (7th Cir. 2021) (noting the tension between 
the anti-surplusage canon and the belt-and-suspenders drafting approach).” 
Cothron, 20 F.4th at 1164. 
¶ 29 
 
We note that, even in the dictionary relied upon by White Castle, the principal 
meaning of “redisclose” is “[t]o disclose again.” See WordSense Dictionary, 
https://www.wordsense.eu/redisclose/ (last visited Jan. 7, 2023) [https://perma.cc/
63VU-RRTK]. Nevertheless, we do not believe that we have to specifically 
determine the meaning of “redisclose” in section 15(d) because the other terms in 
that section are broad enough to include repeated transmissions to the same party. 
“Disclose” also means to “expose to view” (Webster’s Third New International 
Dictionary 645 (1993)), and Webster’s gives as an example something happening 
more than once: “the curtain rises to [disclose] once again the lobby” (emphasis 
added) (id.). A fingerprint scan system requires a person to expose his or her 
fingerprint to the system so that the print may be compared with the stored copy, 
and this happens each time a person uses the system. Moreover, section 15(d) has 
a catchall provision that broadly applies to any way that an entity may “otherwise 
disseminate” a person’s biometric data. “Disseminate” means “to spread or send 
out freely or widely.” Id. at 656. White Castle asserts that this is something that can 
happen only once but provides no definitional support for that assertion. Thus, we 
 
 
2See, e.g., section 35.3(b) of the Children and Family Services Act (20 ILCS 505/35.3(b) (West 
2020) (“[a] person to whom disclosure of a foster parent’s name, address, or telephone number is 
made under this Section shall not redisclose that information except as provided in this Act or the 
Juvenile Court Act of 1987”)) and section 5 of the Mental Health and Developmental Disabilities 
Confidentiality Act (740 ILCS 110/5(d) (West 2020) (“[n]o person or agency to whom any 
information is disclosed under this Section may redisclose such information unless the person who 
consented to the disclosure specifically consents to such redisclosure”)). In its reply brief, White 
Castle lists several other Illinois statutes that use the term “redisclose” in the same manner. 
 
 
 
 
 
- 11 - 
find that the plain language of section 15(d) supports the conclusion that a claim 
accrues upon each transmission of a person’s biometric identifier or information 
without prior informed consent.  
¶ 30 
 
We agree with the district court’s explanation of how sections 15(b) and (d) are 
violated: 
“Section 15(b) provides that no private entity ‘may collect, capture, purchase, 
receive through trade, or otherwise obtain’ a person’s biometric information 
unless it first receives that person’s informed consent. 740 ILCS 14/15(b). This 
requirement is violated—fully and immediately—when a party collects 
biometric information without the necessary disclosure and consent. Similarly, 
Section 15(d) states that entities in possession of biometric data may only 
disclose or ‘otherwise disseminate’ a person’s data upon obtaining the person’s 
consent or in limited other circumstances inapplicable here. 740 ILCS 14/15(d). 
Like Section 15(b), an entity violates this obligation the moment that, absent 
consent, it discloses or otherwise disseminates a person’s biometric information 
to a third party.” Cothron, 477 F. Supp. 3d at 730-31. 
We believe that the plain language of section 15(b) and 15(d) demonstrates that 
such violations occur with every scan or transmission.  
 
¶ 31 
 
 
 
 
 
White Castle’s Other Arguments 
¶ 32 
 
We are not persuaded by White Castle’s nontextual arguments in support of its 
single-accrual interpretation. Citing Feltmeier v. Feltmeier, 207 Ill. 2d 263 (2003), 
White Castle maintains that under Illinois law a claim accrues when a legal right is 
invaded and an injury inflicted. White Castle maintains that this court’s decisions 
interpreting the Act define a right to secrecy in and control over biometric data and 
define the “injury” as loss of control or secrecy.  
¶ 33 
 
Citing Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, ¶¶ 33-34, 
White Castle contends that the Act allows a claim for an individual’s loss of the 
“right to control” biometric information and that, once an individual loses control 
over the secrecy in his or her biometric information, it cannot be recreated, resulting 
in the loss of any confidentiality. See also West Bend Mutual Insurance Co. v. 
 
 
 
 
 
- 12 - 
Krishna Schaumburg Tan, Inc., 2021 IL 125978, ¶ 46 (explaining that the Act 
protects a “secrecy interest”); McDonald v. Symphony Bronzeville Park, LLC, 2022 
IL 126511, ¶ 24 (reiterating that the Act protect an individual’s “ ‘right to privacy 
in and control over their biometric identifiers and biometric information’ ” (quoting 
Rosenbach, 2019 IL 123186, ¶ 33)).  
¶ 34 
 
Relying on this precedent, White Castle contends that, when a party collects or 
discloses biometric information without complying with the Act’s notice and 
consent requirements, an individual’s rights have been invaded, an injury has 
occurred, and the plaintiff may immediately sue. In other words, “the invasion and 
injury are one and the same and occurred upon [p]laintiff’s initial loss of control of 
her biometrics.” For purposes of claim accrual under sections 15(b) and 15(d), 
White Castle argues that the claim accrues only on the initial scan or transmission 
of biometric information. Because a person cannot keep information secret from 
another entity that already has it, White Castle contends that the loss of an 
individual’s right to control his or her biometrics is a “single overt act” that 
encompasses both the invasion of the interest and the infliction of the injury. See 
Feltmeier, 207 Ill. 2d at 279. Thus, a claim under section 15(b) or 15(d) can accrue 
only the first time the information is collected or disclosed. We disagree.  
¶ 35 
 
White Castle misreads our decisions in Rosenbach, West Bend Mutual 
Insurance Co., and McDonald. As a preliminary observation, we note that none of 
those decisions involved, let alone analyzed, the question of claim accrual under 
the Act. 
¶ 36 
 
In fact, we find that Rosenbach supports our construction of sections 15(b) and 
15(d). This court recognized in Rosenbach that the Act operates to codify an 
individual’s right to privacy in and control over his or her biometric identifiers and 
information. Rosenbach, 2019 IL 123186, ¶ 33. Importantly, we determined in 
Rosenbach that a person is “aggrieved” or injured under the Act “when a private 
entity fails to comply with one of section 15’s requirements.” Id.  
¶ 37 
 
Focusing on the section 15 violation in Rosenbach, the same provision at issue 
in this case, we determined that, “[w]hen a private entity fails to comply with one 
of section 15’s requirements, that violation constitutes an invasion, impairment, or 
denial of the statutory rights of any person or customer whose biometric identifier 
or biometric information is subject to the breach.” Id. Critically, Rosenbach 
 
 
 
 
 
- 13 - 
explains that an individual raising a section 15 claim is not required to plead or 
prove actual damages because the statutory violation, “in itself, is sufficient to 
support the individual’s or customer’s statutory cause of action.” Id.  
¶ 38 
 
Thus, contrary to White Castle’s position, Rosenbach does not stand for the 
proposition that the “injury” for a section 15 claim is predicated on, or otherwise 
limited to, an initial loss of control or privacy. Instead, Rosenbach clearly 
recognizes the statutory violation itself is the “injury” for purposes of a claim under 
the Act, which is entirely consistent with our decision here. Our subsequent 
decisions in West Bend Mutual Insurance Co. and McDonald adhered to 
Rosenbach’s construction of the Act and similarly recognized that a claim under 
the Act is a private cause of action based exclusively on a statutory violation. West 
Bend Mutual Insurance Co., 2021 IL 125978, ¶ 46 (citing Rosenbach); McDonald, 
2022 IL 126511, ¶ 23 (citing Rosenbach).  
¶ 39 
 
Put simply, our caselaw holds that, for purposes of an injury under section 15 
of the Act, the court must determine whether a statutory provision was violated. 
Consequently, we reject White Castle’s argument that we should limit a claim under 
section 15 to the first time that a private entity scans or transmits a party’s biometric 
identifier or biometric information. No such limitation appears in the statute. We 
cannot rewrite a statute to create new elements or limitations not included by the 
legislature. Zahn v. North American Power & Gas, LLC, 2016 IL 120526, ¶ 15.  
¶ 40 
 
White Castle and amici supporting White Castle’s position caution this court 
against construing section 15(b) and section 15(d) to mean that a claim accrues for 
each scan or transmission of biometric information made in violation of those 
provisions. They assert that, because section 20 of the Act sets forth liquidated 
damages that a party may recover for “each violation,” allowing multiple or 
repeated accruals of claims by one individual could potentially result in punitive 
and “astronomical” damage awards that would constitute “annihilative liability” 
not contemplated by the legislature and possibly be unconstitutional. For example, 
White Castle estimates that if plaintiff is successful and allowed to bring her claims 
on behalf of as many as 9500 current and former White Castle employees, class-
wide damages in her action may exceed $17 billion. We have found, however, that 
the statutory language clearly supports plaintiff’s position. As the district court 
observed, this court has repeatedly held that, where statutory language is clear, it 
 
 
 
 
 
- 14 - 
must be given effect, “ ‘even though the consequences may be harsh, unjust, absurd 
or unwise.’ ” (Emphasis omitted.) Cothron, 477 F. Supp. 3d at 734 (quoting 
Peterson v. Wallach, 198 Ill. 2d 439, 447 (2002)). 
¶ 41 
 
This court has repeatedly recognized the potential for significant damages 
awards under the Act. Rosenbach, 2019 IL 123186, ¶¶ 36-37; McDonald, 2022 IL 
126511, ¶ 48. This court explained that the legislature intended to subject private 
entities who fail to follow the statute’s requirements to substantial potential 
liability. Rosenbach, 2019 IL 123186, ¶ 36. The purpose in doing so was to give 
private entities “the strongest possible incentive to conform to the law and prevent 
problems before they occur.” Id. ¶ 37. As the Seventh Circuit noted, private entities 
would have “little incentive to course correct and comply if subsequent violations 
carry no legal consequences.” Cothron, 20 F.4th at 1165.  
¶ 42 
 
All of that said, we generally agree with our appellate court’s recognition that 
“[a] trial court presiding over a class action—a creature of equity—would certainly 
possess the discretion to fashion a damage award that (1) fairly compensated 
claiming class members and (2) included an amount designed to deter future 
violations, without destroying defendant’s business.” Century Mutual Insurance 
Co. v. Tracy’s Treasures, Inc., 2014 IL App (1st) 123339, ¶ 72. It also appears that 
the General Assembly chose to make damages discretionary rather than mandatory 
under the Act. See 740 ILCS 14/20 (West 2018) (detailing the amounts and types 
of damages that a “prevailing party may recover” (emphasis added)); see also 
Watson, 2021 IL App (1st) 210279, ¶ 66 n.4 (concluding that damages under the 
Act are discretionary rather than mandatory). While we explained in Rosenbach 
that “subjecting private entities who fail to follow the statute’s requirements to 
substantial potential liability, including liquidated damages, injunctions, attorney 
fees, and litigation expenses ‘for each violation’ of the law” is one of the principal 
means that the Illinois legislature adopted to achieve the Act’s objectives of 
protecting biometric information (Rosenbach, 2019 IL 123186, ¶ 36 (quoting 740 
ILCS 14/20 (West 2016))), there is no language in the Act suggesting legislative 
intent to authorize a damages award that would result in the financial destruction 
of a business.  
¶ 43 
 
Ultimately, however, we continue to believe that policy-based concerns about 
potentially excessive damage awards under the Act are best addressed by the 
 
 
 
 
 
- 15 - 
legislature. See McDonald, 2022 IL 126511, ¶¶ 48-49 (observing that violations of 
the Act have the potential for “substantial consequences” and large damage awards 
but concluding that “whether a different balance should be struck *** is a question 
more appropriately addressed to the legislature”). We respectfully suggest that the 
legislature review these policy concerns and make clear its intent regarding the 
assessment of damages under the Act. 
 
¶ 44 
 
 
 
 
 
III. CONCLUSION 
¶ 45 
 
In sum, we conclude that the plain language of section 15(b) and 15(d) shows 
that a claim accrues under the Act with every scan or transmission of biometric 
identifiers or biometric information without prior informed consent. 
 
¶ 46 
 
Certified question answered. 
 
¶ 47 
 
JUSTICE OVERSTREET, dissenting: 
¶ 48 
 
I respectfully disagree with my colleagues’ answer to the certified question. The 
majority’s interpretation cannot be reconciled with the plain language of the statute, 
the purposes behind the Biometric Information Privacy Act (Act) (740 ILCS 14/1 
et seq. (West 2018)), or this court’s case law, and it will lead to consequences that 
the legislature could not have intended. Moreover, the majority’s interpretation 
renders compliance with the Act especially burdensome for employers. This court 
should answer the certified question by saying that a claim accrues under section 
15(b) or 15(d) of the Act (id. § 15(b), (d)) only upon the first scan or transmission. 
¶ 49 
 
The principles guiding our analysis are set forth in Feltmeier v. Feltmeier, 207 
Ill. 2d 263, 278-79 (2003). This court held that, generally, “a limitations period 
begins to run when facts exist that authorize one party to maintain an action against 
another.” Id. at 278. Moreover, “where there is a single overt act from which 
subsequent damages may flow, the statute begins to run on the date the defendant 
invaded the plaintiff’s interest and inflicted injury.” Id. at 279. Thus, to resolve the 
question of when claims accrue under section 15(b) and (d), we must consider 
 
 
 
 
 
- 16 - 
whether plaintiff has alleged a single overt act from which subsequent damages 
may flow. 
¶ 50 
 
Two considerations inform this inquiry: (1) what interests does the Act seek to 
protect and (2) what constitutes a violation of section 15(b) or (d) under the plain 
language of those provisions? This court has addressed the first question several 
times. In Rosenbach, this court explained that “[t]he Act vests in individuals and 
customers the right to control their biometric information by requiring notice before 
collection and giving them the power to say no by withholding consent.” Rosenbach 
v. Six Flags Entertainment Corp., 2019 IL 123186, ¶ 34. This court further 
explained that the “precise harm” the legislature sought to prevent was an 
individual’s loss of the right to maintain biometric privacy. Id. In West Bend Mutual 
Insurance Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978, ¶ 46, this court 
stated that the Act “protects a secrecy interest,” such as an individual’s right to 
“keep his or her personal identifying information like fingerprints secret.” Finally, 
in McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511, ¶ 24 (quoting 
Rosenbach, 2019 IL 123186, ¶ 33), this court reiterated that the Act protects an 
individual’s “ ‘right to privacy in and control over their biometric identifiers and 
biometric information.’ ”  
¶ 51 
 
Turning to the language of the statute, section 15(b) requires certain disclosures 
to be made, and a written release obtained, before that entity may “collect, capture, 
purchase, receive through trade, or otherwise obtain a person’s or a customer’s 
biometric identifier or biometric information.” 740 ILCS 14/15(b) (West 2018). 
The statute thus broadly applies to any way that a private entity obtains a person’s 
or customer’s biometric information without consent. It is axiomatic, however, that 
a private entity may obtain any one type of a person’s biometric information only 
once, at least until that biometric identifier or information is destroyed. With 
subsequent authentication scans, the private entity is not obtaining anything it does 
not already have. The majority commits the same analytical error as the appellate 
court in Watson v. Legacy Healthcare Financial Services, LLC, 2021 IL App (1st) 
210279.  
¶ 52 
 
The Watson court held that section 15(b) means that “an entity must inform a 
subject and receive a release ‘before’ it collects or captures. *** [T]here is no 
temporal limitation on ‘collects’ or ‘captures,’ thereby applying to the first, as well 
 
 
 
 
 
- 17 - 
as the last, collection or capture.” Id. ¶ 57. Watson’s error is in assuming that the 
private entity is collecting or capturing a person’s biometric information with every 
scan. The majority makes the same error, equating every scan with a “collection.” 
Supra ¶ 24. But this is not correct. Again, section 15(b) broadly applies to any way 
that a private entity obtains a person’s biometric identifier or information. But this 
can happen only once. Here, White Castle obtains an employee’s biometric 
identifier the first time that a fingerprint is scanned. White Castle is obviously not 
obtaining it with subsequent scans—White Castle already has it. As plaintiff 
acknowledges in her complaint, White Castle obtains an employee’s fingerprint and 
stores it in its database. The employee is then required to use his or her fingerprint 
to access paystubs or White Castle computers. With the subsequent scans, the 
fingerprint is not being obtained, it is being compared to the fingerprint that White 
Castle already has. This fact is made plain in plaintiff’s complaint. Plaintiff states, 
“Plaintiff was required to scan and register her fingerprint(s) so White Castle could 
use them as an authentication method for Plaintiff to access the computer as a 
manager and to access her paystubs as an hourly employee as a condition of her 
employment with White Castle.” (Emphasis added.) The subsequent scans did not 
collect any new information from plaintiff, and she suffered no additional loss of 
control over her biometric information.  
¶ 53 
 
The above reading of the statute is the only one consistent with the purposes of 
the Act. As this court explained in Rosenbach, the “precise harm” the legislature 
was addressing was an individual’s loss of the right to maintain biometric privacy. 
Rosenbach, 2019 IL 123186, ¶¶ 33-34; McDonald, 2022 IL 125611, ¶ 24. And in 
Krishna, 2021 IL 125978, ¶ 46, this court stated that the Act “protects a secrecy 
interest,” such as an individual’s right to “keep his or her personal identifying 
information like fingerprints secret.”3 An individual loses his or her privacy in and 
 
 
3The majority denies that our prior cases support White Castle’s argument. The majority states 
that  
“Rosenbach does not stand for the proposition that the ‘injury’ for a section 15 claim is 
predicated on, or otherwise limited to, an initial loss of control or privacy. Instead, Rosenbach 
clearly recognizes the statutory violation itself is the ‘injury’ for purposes of a claim under the 
Act, which is entirely consistent with our decision here.” Supra ¶ 38.  
The majority assumes what it seeks to prove. The majority never explains how there is more than 
one loss of control or privacy with subsequent scans or how subsequent scans are a “statutory 
violation.” 
 
 
 
 
 
- 18 - 
control over biometric information upon the first scan. At this point his or her 
secrecy interest is lost—he or she may no longer keep his or her personally 
identifying information a secret from the private entity. Once that entity has the 
fingerprint, there is no additional loss of control, loss of privacy, or loss of secrecy 
from subsequent scans of the same finger. This is true whether the same finger is 
scanned a few times or one million times. The individual loses control over it only 
once. Accordingly, under Feltmeier, a section 15(b) claim accrues the first time a 
scan is taken without the required disclosures and consent. There was a single overt 
act from which damages flow, because the employer did not obtain anything with 
subsequent scans that it did not already have, and the employee did not lose control 
over and privacy in her biometric information with subsequent scans. 
¶ 54 
 
Thus, I agree with White Castle’s argument on appeal: “Plaintiff’s injury under 
[section] 15(b) occurred, if at all, the first time that her biometrics were collected 
by White Castle without her consent, not each subsequent time that her finger was 
rescanned.” There is only one loss of control or privacy, and this happens when the 
information is first obtained. Indeed, the legislative findings in the Act confirm this. 
See 740 ILCS 14/5(c) (West 2018) (“[S]ocial security numbers, when 
compromised, can be changed. Biometrics, however, are biologically unique to the 
individual; therefore, once compromised, the individual has no recourse ***.” 
(Emphasis added.)). The majority tellingly never explains how there is any 
additional loss of control or privacy with subsequent scans that are used to compare 
the employee’s fingerprint with the fingerprint that White Castle already possesses. 
The majority simply asserts that every scan is a collection and therefore a violation 
of the Act. Supra ¶ 24. And this is the key flaw in the majority’s analysis: it begs—
rather than answers—the most important question before the court.  
¶ 55 
 
The analysis is the same for section 15(d) claims. Under section 15(d), a private 
entity in possession of a person’s biometric identifier or information must obtain 
that person’s consent before it may “disclose, redisclose, or otherwise disseminate 
a person’s or a customer’s biometric identifier or biometric information.” 740 ILCS 
14/15(d) (West 2018). With respect to any one party to whom the biometric 
information is disclosed, the person loses control of her biometric identifier or 
information only once. There is no further loss of control, privacy, or secrecy with 
subsequent provision of the identical biometric information to the same party.  
 
 
 
 
 
- 19 - 
¶ 56 
 
The majority reaches the conclusion that section 15(d) includes repeated 
transmission to the same party (supra ¶ 28) only when willing to ignore (1) the 
plain meaning of the word “disclose” and (2) the way in which the Illinois 
legislature consistently uses the word “redisclose.” The word “disclose” means “to 
make known” or “to reveal *** something that is secret or not generally known” 
(Webster’s Third New International Dictionary 645 (1993)) or “[t]o make 
(something) known or public,” “to reveal” (Black’s Law Dictionary 583 (11th ed. 
2019)); see also Cothron v. White Castle System, Inc., 20 F.4th 1156, 1163 (7th Cir. 
2021) (explaining that “the ordinary meaning of ‘disclose’ connotes a new 
revelation” (citing Black’s Law Dictionary (11th ed. 2019))). With respect to a 
disclosure to any one party, this is obviously something that can happen only once. 
You can tell someone your middle name an unlimited number of times, but you can 
disclose it to them only once. Therefore, when something is “redisclosed” or 
“disclosed again,” it must be to a different party. As the Seventh Circuit explained, 
“[r]epeated transmissions of the same biometric identifier to the same third party 
are not new revelations.” Cothron, 20 F.4th at 1163.  
¶ 57 
 
Although the majority holds that it need not determine the meaning of 
“redisclose” in section 15(d) (supra ¶ 28), the definition of “redisclose” found in 
the WordSense Dictionary, https://www.wordsense.eu/redisclose/ (last visited Jan. 
7, 2023) [https://perma.cc/63VU-RRTK] (“[t]o disclose again; to disclose what has 
been disclosed to the discloser” (emphasis added)) is consistent with how the term 
is used by the Illinois legislature. See Cothron, 20 F.4th at 1164. As noted by the 
majority, the Seventh Circuit gave two examples: section 35.3(b) of the Children 
and Family Services Act (20 ILCS 505/35.3(b) (West 2020) (“[a] person to whom 
disclosure of a foster parent’s name, address, or telephone number is made under 
this Section shall not redisclose that information except as provided in this Act or 
the Juvenile Court Act of 1987”)) and section 5 of the Mental Health and 
Developmental Disabilities Confidentiality Act (740 ILCS 110/5(d) (West 2020) 
(“[n]o person or agency to whom any information is disclosed under this Section 
may redisclose such information unless the person who consented to the disclosure 
specifically consents to such redisclosure”)). Supra ¶ 28 n.2; Cothron, 20 F.4th at 
1164. In its reply brief, defendant lists several other Illinois statutes that use the 
term “redisclose” in the same manner.  
 
 
 
 
 
- 20 - 
¶ 58 
 
Thus, if we consider the plain meaning of the word “disclose” and the manner 
in which the legislature consistently uses the term “redisclose,” it is clear that 
section 15(d)’s use of the word “redisclose” does not mean repeated disclosures to 
the same party (a logical impossibility) but rather refers to downstream disclosures 
to third parties. In other words, if the party in possession of biometric information 
discloses it to a third party, consent is required before that third party rediscloses 
the information to anyone else. Plaintiff’s only response to this argument is to claim 
that this interpretation renders the word “redisclose” in section 15(d) superfluous 
or redundant, as any disclosure to a new party would be covered by the word 
“disclose.” But all that plaintiff can demonstrate with this argument is that the word 
“redisclose” is probably unnecessary in the English language (perhaps why 
Webster’s does not define it). In the other statutes quoted above, the legislature 
could have used “disclose” instead of “redisclose,” and the meaning of the 
provisions would not change. But the reality that plaintiff cannot avoid is that 
(1) the legislature consistently uses the term “redisclose” to mean “to disclose what 
has been disclosed to the discloser” and (2) a “redisclosure” to the same party is a 
logical impossibility.  
¶ 59 
 
The majority acknowledges that, in construing the Act as it has, the 
consequences may be harsh, unjust, absurd, or otherwise unwise. Supra ¶ 40. In 
doing so, the majority ignores that the construction of a statute that leads to an 
absurd result must be avoided. Mulligan v. Joliet Regional Port District, 123 Ill. 2d 
303, 312-13 (1988). Instead, a court construing the language of a statute should  
“ ‘assume that the legislature did not intend to produce an absurd or unjust 
result’ (State Farm Fire & Casualty Co. v. Yapejian, 152 Ill. 2d 533, 541 
(1992)), and [should] avoid a construction leading to an absurd result, if 
possible (City of East St. Louis v. Union Electric Co., 37 Ill. 2d 537, 542 
(1967)).” Hubble v. Bi-State Development Agency of the Illinois-Missouri 
Metropolitan District, 238 Ill. 2d 262, 283 (2010).  
¶ 60 
 
In considering the consequences of construing the Act one way or another and 
giving each word of the statute a reasonable meaning (Haage v. Zavala, 2021 IL 
125918, ¶ 44), two significant consequences militate against the majority’s 
construction. First, under the majority’s rule, plaintiffs would be incentivized to 
delay bringing their claims as long as possible. If every scan is a separate, 
 
 
 
 
 
- 21 - 
actionable violation, qualifying for an award of liquidated damages, then it is in a 
plaintiff’s interest to delay bringing suit as long as possible to keep racking up 
damages. Because there is no additional loss of privacy, secrecy, or control once a 
private entity has obtained a person’s biometric information, the plaintiff loses 
nothing by waiting to bring suit until as many scans as possible are accumulated. 
This point, all by itself, should convince the majority that its interpretation is wrong. 
If, indeed, a party was losing control over his or her biometric information with 
every scan, this incentive would simply not exist.  
¶ 61 
 
Next, the majority’s construction of the Act could easily lead to annihilative 
liability for businesses. As the Seventh Circuit explained: 
“White Castle reminds us that the Act provides for statutory damages of $1,000 
or $5,000 for ‘each violation’ of the statute. § 14/20. Because White Castle’s 
employees scan their fingerprints frequently, perhaps even multiple times per 
shift, Cothron’s interpretation could yield staggering damages awards in this 
case and others like it. If a new claim accrues with each scan, as Cothron argues, 
violators face potentially crippling financial liability.” Cothron, 20 F.4th at 
1165. 
The majority acknowledges White Castle’s estimate that, if plaintiff is successful 
in her claims on behalf of as many as 9500 current and former White Castle 
employees, damages in this action may exceed $17 billion. Supra ¶ 40. 
Nevertheless, the majority brushes this concern aside by stating that “policy-based 
concerns about potentially excessive damage awards under the Act are best 
addressed by the legislature.” Supra ¶ 43. 
¶ 62 
 
However, we are not being asked to render a decision on the damages in this 
case or to make a policy-based decision about excessive damages. Rather, we are 
being asked to determine legislative intent by considering the consequences of 
construing the statute one way or another. Surely the potential imposition of 
crippling liability on businesses is a proper consequence to consider. When the 
plaintiff argued in the Seventh Circuit that the calculation of damages is separate 
from claim accrual, that court pointed out that plaintiff “does not explain how 
alternative theories of calculating damages might be reconciled with the text of 
section 20.” Cothron, 20 F.4th at 1165. Given that plaintiff argues that every scan 
is a violation and the statute sets forth what an aggrieved person may recover for 
 
 
 
 
 
- 22 - 
“every violation,” it is certainly proper to consider the consequences of plaintiff’s 
interpretation of the statute.  
¶ 63 
 
Imposing punitive, crippling liability on businesses could not have been a goal 
of the Act, nor did the legislature intend to impose damages wildly exceeding any 
remotely reasonable estimate of harm. Rather, the legislature recognizes that the 
use of biometrics is an emerging area whose ramifications are not completely 
known and that it is in the public interest to regulate the “collection, use, 
safeguarding, handling, storage, retention, and destruction of biometric identifiers 
and information.” 740 ILCS 14/5 (West 2018). Indeed, the statute’s provision of 
liquidated damages of between $1000 and $5000 is itself evidence that the 
legislature did not intend to impose ruinous liability on businesses. Moreover, the 
majority’s interpretation would lead to the absurd result that an entity that commits 
what most people would probably consider the worst type of violation of the Act—
intentionally selling their biometric information to a third party with no knowledge 
of what the third party intended to do with it—would be subject to liquidated 
damages of $5000, while an employer with no ill intent that used that same person’s 
fingerprint as an authentication method to allow access to his or her computer could 
be subject to damages hundreds or thousands of times that amount. This could not 
have been the legislature’s intent.  
¶ 64 
 
The majority fails to set forth any similar dire consequences with White Castle’s 
interpretation. With respect to control, the individual does not lose all control over 
his or her biometric data. Consent is still required before the private entity may 
disclose it to anyone else (id. § 15(d)), and that is the real concern once an 
individual has consented to a private entity collecting a biometric identifier or 
information. With respect to postcollection, White Castle correctly explains: 
“[T]he Privacy Act itself contains numerous provisions that serve its 
prophylactic goals even after the first collection or disclosure. Specifically, 
White Castle has a duty to safeguard information it has collected. 740 ILCS 
14/15(a), (e). White Castle has an ongoing duty to destroy any biometric data 
that current employees have already scanned, once the data’s purpose is 
fulfilled. Id. at 15(a). Section 15(c) prohibits the sale of biometrics, so any sale 
of biometrics would give rise to a new claim. Id. at 15(c). Section 15(d) 
prohibits the disclosure of biometrics to a third party without consent. Id. at 
 
 
 
 
 
- 23 - 
15(d). So disclosure of biometrics to a new third party would give rise to a new 
claim—a straightforward reading of the statute that has always been White 
Castle’s position ***.” (Emphases in original.)  
Thus, the Act very tightly regulates what private entities may do with the biometric 
information they collect, and individuals maintain a measure of control over their 
biometric data.  
¶ 65 
 
While discussing the strengths and weaknesses of each side’s argument, the 
Seventh Circuit suggested two potential problems with a single accrual rule. First, 
that court speculated that the premise that “two violations aren’t worse than one” 
may “simply be wrong.” Cothron, 20 F.4th at 1165. The court speculated that 
“[r]epeated collections or disclosures of biometric data, even if by or to the same 
entity, might increase the risk of misuse or mishandling of biometric data.” Id. This 
assumes, however, that repeated scans of the same biometric identifier by the same 
entity are repeated “collections” or “disclosures,” which is a dubious proposition. 
Indeed, the Seventh Circuit itself had earlier explained that a disclosure is a “new 
revelation” and that “[r]epeated transmissions of the same biometric identifier to 
the same third party are not new revelations.” Id. at 1163. Moreover, there is no 
reason to believe that subsequent scans of the same biometric identifier used for 
authentication purposes against a stored copy would increase the risk of misuse or 
mishandling of biometric data. Second, the Seventh Circuit speculated that, under 
a single accrual rule, “[o]nce a private entity has violated the Act, it would have 
little incentive to course correct and comply if subsequent violations carry no legal 
consequences.” Id. at 1165. The Act, however, provides for injunctive relief. See 
740 ILCS 14/20(4) (West 2018); see also McDonald, 2022 IL 126511, ¶ 6 
(“McDonald and the putative class sought (1) injunctive and equitable relief to 
protect their interests by requiring Bronzeville to comply with the Privacy Act’s 
requirements.”). Moreover, there is no reason to believe that an employer would 
rather be on the hook for liquidated damages to every new employee it hires rather 
than simply providing the notice and obtaining the consent that the Act requires. 
Finally, as White Castle points out: 
“Plaintiff purports to allege two violations of the Act, for up to 9,500 current 
and former White Castle employees. Even under a single accrual method, 
damages could equate to between $19 million and $95 million if Plaintiff’s 
 
 
 
 
 
- 24 - 
claims had been timely made, assuming that Plaintiff could recover separately 
under Section 15(b) and 15(d). Even under a ‘one violation per employee’ 
calculation of $1,000 per employee, damages could equal $9.5 million. These 
numbers, in and of themselves, are sufficient to incentivize [Act] compliance.”  
The consequences of construing the statute to provide multiple accruals are severe, 
and neither plaintiff nor the majority has identified similar severe consequences to 
White Castle’s interpretation.  
¶ 66 
 
In sum, the Act’s legislative findings and intent show that the legislature 
recognized the utility of biometric technology and wanted to facilitate its safe use 
by private entities by regulating how it is used. See 740 ILCS 14/5(a) (West 2018) 
(“The use of biometrics is growing in the business and security screening sectors 
and appears to promise streamlined financial transactions and security 
screenings.”). The Act thus requires notice and consent before biometric 
information is collected or disclosed. To encourage compliance and to prevent and 
deter violations, the Act provides for injunctive relief and liquidated damages. I see 
nothing in the Act indicating that the legislature intended to impose cumbersome 
requirements or punitive, crippling liability on corporations for multiple 
authentication scans of the same biometric identifier. The legislature’s intent was 
to ensure the safe use of biometric information, not to discourage its use altogether.  
 
¶ 67 
 
CHIEF JUSTICE THEIS and JUSTICE HOLDER WHITE join in this dissent. 
 
¶ 68 
 
 
 SEPARATE OPINION UPON DENIAL OF REHEARING 
¶ 69 
 
JUSTICE OVERSTREET, dissenting: 
¶ 70 
 
I respectfully dissent upon my colleagues’ denial of White Castle’s petition for 
rehearing. Pursuant to Illinois Supreme Court Rule 367(b) (eff. Nov. 1, 2017), 
White Castle has successfully asserted claims overlooked or misapprehended by 
the majority’s opinion. Filing amicus curiae briefs in support of White Castle’s 
petition, the Illinois Chamber of Commerce; Chamber of Commerce of the United 
States; Retail Litigation Center, Inc.; Restaurant Law Center; National Retail 
Federation; Illinois Restaurant Association; Illinois Manufacturers’ Association; 
 
 
 
 
 
- 25 - 
National Association of Manufacturers; Illinois Health and Hospital Association; 
Illinois Retail Merchants Association; Chemical Industry Council of Illinois; 
Illinois Trucking Association; Mid-West Truckers Association; Chicagoland 
Chamber of Commerce; American Trucking Associations, Inc.; and American 
Property Casualty Insurance Association have provided support for those claims. I 
would allow rehearing to address White Castle’s argument that this court’s opinion 
cemented an erroneous interpretation of the Biometric Information Privacy Act 
(Act) (740 ILCS 14/1 et seq. (West 2018)) that subverted the intent of the Illinois 
General Assembly, threatens the survival of businesses in Illinois, and consequently 
raises significant constitutional due process concerns. The legislature never 
intended the Act to be a mechanism to impose extraordinary damages on businesses 
or a vehicle for litigants to leverage the exposure of exorbitant statutory damages 
to extract massive settlements. Yet, this court construed the Act to allow these 
unintended consequences, and as a result, this construction raises serious issues as 
to the Act’s validity. 
¶ 71 
 
As argued in White Castle’s initial briefing before this court, the legislature 
intended the Act to be a remedial statute that implemented prophylactic measures 
to prevent the compromise of biometrics by allowing individuals to choose to 
provide (or not to provide) their data after being advised that it is being collected, 
stored, and potentially disclosed. See McDonald v. Symphony Bronzeville Park, 
LLC, 2022 IL 126511, ¶ 48; Rosenbach v. Six Flags Entertainment Corp., 2019 IL 
123186, ¶ 36 (discussing General Assembly’s goal, through the Act, of preventing 
problems “before they occur” by imposing safeguards to protect an individual’s 
privacy rights in their biometric identifiers and information). Remedial statutes “are 
designed to grant remedies for the protection of rights, introduce regulation 
conducive to the public good, or cure public evils.” Standard Mutual Insurance Co. 
v. Lay, 2013 IL 114617, ¶ 31. Remedial statutes are distinct from penal statutes, 
which operate as “punishment for the nonperformance of an act or for the 
performance of an unlawful act” and “require[ ] the transgressor to pay a penalty 
without regard to proof of any actual monetary injury sustained.” (Internal 
quotation marks omitted.) Goldfine v. Barack, Ferrazzano, Kirschbaum & 
Perlman, 2014 IL 116362, ¶ 28. 
¶ 72 
 
Damages under the Act are the greater of actual damages or liquidated damages. 
740 ILCS 14/20 (West 2018). Arguably, this consideration is indicative of the fact 
 
 
 
 
 
- 26 - 
that liquidated damages were intended to be awarded where actual damages were 
too small and difficult to prove, not as a multiplier by thousands for each time 
technology is used. Yet, pursuant to this court’s per-scan construction of the Act, 
where claims and damages accrue under the Act with each scan of a finger and each 
transmission to the same technology vendors, the results will vastly exceed 
reasonable ratios between the damages awarded and the offense at issue.  
¶ 73 
 
The goal of construing a statute is to give effect to the intent of the legislature. 
Roberts v. Alexandria Transportation, Inc., 2021 IL 126249, ¶ 29. For the 
majority’s flawed construction of the Act to prevail, it must be presumed that our 
legislature resolutely passed the Act for the purpose of establishing a statutory 
landmine, destroying commerce in its wake when negligently triggered. This 
flawed presumption of the legislature’s intent is required under the majority’s 
construction because, under the majority’s view, the legislature intended for Illinois 
businesses to be subject to cataclysmic, jobs-killing damages, potentially up to 
billions of dollars, for violations of the Act. No reported case has ever made a 
similar assumption about our legislature’s intent in passing legislation, likely 
because it does not withstand reason to believe the legislature intended this absurd 
result. The majority’s construction of the Act does not give effect to the 
legislature’s true intent but instead eviscerates the legislature’s remedial purpose of 
the Act and impermissibly recasts the Act as one that is penal in nature rather than 
remedial. This construction not only violates basic and fundamental principles of 
statutory construction but also raises serious due process concerns that, I believe, 
must be addressed by this court on rehearing.  
¶ 74 
 
Plaintiff alleges that she scanned her finger each time she accessed a work 
computer and each time she accessed her weekly pay stub. Assuming plaintiff 
worked 5 days per week for 50 weeks per year and accessed the computer each day 
and her pay stub weekly, her total scans would exceed 1500 over a five-year 
limitations period, which may result in damages exceeding $7 million for this single 
employee despite the fact that plaintiff has not alleged a data breach or any costs or 
other damages associated with identity theft or compromised data. The excessive 
nature of plaintiff’s potential damages is exacerbated in the class-action context. 
Thus, as a result of this court’s construction of the Act in this case, this court has 
undermined any connection between potential damages and actual monetary injury 
sustained and has thus arguably mutated the Act’s provisions into ones that are 
 
 
 
 
 
- 27 - 
penal in nature. In doing so, this court failed to interpret the Act to avoid a 
construction that would raise doubts as to its validity. People v. Nastasio, 19 Ill. 2d 
524, 529 (1960) (it is our duty to interpret a statute so as to promote its essential 
purposes and to avoid, if possible, a construction that would raise doubts as to its 
validity). 
¶ 75 
 
The legislature’s authority to set a statutory penalty is limited by the 
requirements of due process. In re Marriage of Miller, 227 Ill. 2d 185, 197 (2007); 
St. Louis, Iron Mountain & Southern Ry. Co. v. Williams, 251 U.S. 63, 66 (1919). 
When a statute authorizes an award that is so severe and oppressive as to be wholly 
disproportioned to the offense and obviously unreasonable, it does not further a 
legitimate government purpose, runs afoul of the due process clause, and is 
unconstitutional. See St. Louis, Iron Mountain & Southern Ry. Co., 251 U.S. at 67; 
see also People v. Bradley, 79 Ill. 2d 410, 417 (1980) (pursuant to due process 
clause of the Illinois Constitution, the legislature properly exercises its police power 
when its statute is “ ‘reasonably designed to remedy the evils which the legislature 
has determined to be a threat to the public health, safety[,] and general welfare’ ” 
(quoting Heimgaertner v. Benjamin Electric Manufacturing Co., 6 Ill. 2d 152, 159 
(1955)). 
¶ 76 
 
The implications of the majority’s opinion are severe and arguably oppressive, 
wholly disproportioned to the violations addressed in the Act, and unreasonable. 
As noted in the majority’s opinion, White Castle estimates that if plaintiff is 
successful and allowed to bring her claims on behalf of as many as 9500 current 
and former White Castle employees, class-wide damages in her action may exceed 
$17 billion. Supra ¶ 40. White Castle and amici note hundreds of pending cases 
involve similarly gigantic damages claims that could toll the death knell for even 
large, financially successful businesses.  
¶ 77 
 
This court’s opinion has only exacerbated the confusion regarding the potential 
for exorbitant damages. In Rogers v. BNSF Ry. Co., No. 1:19-cv-03083 (May 7, 
2019), for example, the jury found in favor of a class of 45,600 truck drivers 
alleging that the defendant violated the Act on 45,600 occasions, despite no 
evidence that class members’ alleged biometric data was compromised or 
improperly used. Notification of Docket Entry, ECF No. 223, Rogers v. BNSF Ry. 
Co., No. 1:19-cv-03083 (N.D. Ill. Oct. 12, 2022). The federal district court entered 
 
 
 
 
 
- 28 - 
judgment on the verdict and assessed damages of $228 million against the 
defendant based on the Act’s provision for statutory damages of $5000 for each 
intentional or reckless violation of the Act identified by the jury. Id. After this 
court’s decision in this case, the plaintiff argued that the amount should be 
multiplied. See Response at 2, ECF No. 256, Rogers v. BNSF Ry. Co., No. 1:19-
cv-03083 (N.D. Ill. Mar. 3, 2023) (stating that the language in this court’s opinion 
regarding the “discretionary” nature of damages “is dictum stacked upon dictum 
and is not precedential”); Plaintiff’s Rule 59 Motion to Amend Judgment at 1, ECF 
No. 236, Rogers v. BNSF Ry. Co., No. 1:19-cv-03083 (N.D. Ill. Nov. 9, 2022) 
(“The sole purpose of this [m]otion is to ask the [c]ourt to adjust the statutory 
damages to conform to the undisputed evidence that there were actually 136,800 
violations ***.”). Likewise, cases alleging violations of the Act reportedly jumped 
65% in Illinois circuit courts in the two months since this court’s ruling. See, e.g., 
Stephen Joyce & Skye Witley, Illinois Biometric Privacy Cases Jump 65% After 
Seminal Ruling, Bloomberg L. (May 2, 2023), https://news.bloomberglaw.com/
privacy-and-data-security/illinois-biometric-privacy-cases-jump-65-after-seminal-
ruling [https://perma.cc/BQT8-7QKR] (noting that many smaller companies 
implemented the biometric technology to gain efficiencies with fewer resources, 
now those resources are being spent defending litigation, and growing liability risks 
may push more businesses into settlement agreements). 
¶ 78 
 
The parties’ pleadings highlight that the potential ramifications for businesses 
operating in Illinois may be catastrophic. If an employee scans his finger (or hand, 
face, retina, etc.) on a timeclock four times per day—once at the beginning and end 
of each day and again to clock in and clock out for one meal break—over the course 
of a year, a single employee would have scanned alleged biometric identifiers or 
information more than 1000 times. Where a new claim accrues each time the 
employee scans on the system and the employee can recover a separate award of 
statutory liquidated damages for each scan, the potential damages for a single 
employee over the course of a year against a business negligently violating the Act 
would approximate $1 million. The potential damages against a defendant acting 
intentionally or recklessly would approximate $5 million. A small business with 50 
such employees would face staggering statutory liquidated damages.  
¶ 79 
 
Moreover, an employer who employs 100 employees in a given year and who 
secures consent forms from 95% of its employees before using a biometric time 
 
 
 
 
 
- 29 - 
clock could face statutory liquidated damages of $100,000 if the remaining five 
employees use the timeclock for a single week before the employer secures consent 
forms from them. Multiplied over a five-year period, the potential exposure would 
be $500,000 for an employer who is working diligently to ensure compliance with 
the Act while also juggling staffing issues and high turnover during a volatile labor 
market. 
¶ 80 
 
Amici note that the risk of harm the Act was enacted to prevent has not 
materialized in the 15 years since it was passed into law: in the more than 1700 
cases filed since 2019, no case involved a plaintiff alleging that his or her biometric 
data has been subject to a data breach or led to identity theft. Thus, the potential 
astronomical damages awards under the majority’s construction of the Act would 
be grossly disproportionate to the alleged harm the Act seeks to redress. 
¶ 81 
 
In egregiously expanding a business’s potential liability, this court suggested 
that the legislature review these policy concerns and clarify its intent regarding the 
assessment of damages under the Act. See supra ¶ 43. As I noted in my initial 
dissent, the legislature’s intent regarding the assessment of damages involved a 
one-time scan interpretation and was clear. Supra ¶ 65. Notwithstanding the 
majority’s inconsistent conclusions that the Act’s language was clear and 
simultaneously in need of clarification by the legislature (supra ¶ 43), it was the 
majority’s interpretation that caused the ambiguity for which it needed clarification 
by the legislature. It was the majority’s interpretation that raised constitutional 
issues contemplated by White Castle during initial briefing before this court but not 
addressed in this court’s opinion. 
¶ 82 
 
In this court’s opinion, the majority acknowledged that the consequences of its 
holding were “harsh, unjust, absurd[,] or unwise” (internal quotation marks 
omitted) (supra ¶ 40) and that no language in the Act suggested a legislative intent 
to authorize a damages award that would result in the financial destruction of a 
business (supra ¶ 42). In nevertheless holding as appropriate a per-scan 
interpretation of the Act, which thereby authorized exorbitant damages awards 
threatening financial ruin for some businesses, this court has raised constitutional 
due process concerns threatening the Act’s validity. Considering that the damage 
awards will now be arbitrary, unclear, and potentially exorbitant, is the statute 
reasonably designed to remedy the evils that the legislature determined to be a 
 
 
 
 
 
- 30 - 
threat to the public health, safety, and general welfare? See Heimgaertner, 6 Ill. 2d 
at 159.  
¶ 83 
 
Accordingly, I would vote to grant rehearing to determine if the resulting 
penalty to Illinois businesses passes constitutional scrutiny. See Bradley, 79 Ill. 2d 
at 418 (holding statute violated due process where penalty was “not reasonably 
designed to remedy the evil” the legislature identified); People v. Morris, 136 Ill. 
2d 157, 162 (1990) (holding statutory penalty unconstitutional where it did not 
advance legislature’s stated purpose in enacting statute).  
¶ 84 
 
At a minimum, I would grant White Castle’s request for rehearing to allow this 
court to clarify paragraphs 40 through 43 of the opinion and provide guidance to 
the lower courts regarding the imposition of damages under the Act. These 
paragraphs highlight the conflicts that result from the opinion’s accrual 
construction: Section 20 permits recovery for “each violation,” damages 
“appear[ ]” to be discretionary, class members should be compensated and future 
violations deterred “without destroying defendant’s business,” and policy concerns 
exist over “excessive damage awards.” Supra ¶¶ 40-43. As noted by White Castle 
in its petition for rehearing, no guidance or criteria remain for who pays nothing 
and who suffers annihilative liability. See supra ¶ 40.  
¶ 85 
 
Although the majority recognized that it “appear[ed]” that these awards would 
be discretionary, such that lower courts may award damages lower than the 
astronomical amounts permitted by its construction of the Act (supra ¶ 42), the 
court did not provide lower courts with any standards to apply in making this 
determination. This court should clarify, under both Illinois and federal 
constitutional principles, that statutory damages awards must be no larger than 
necessary to serve the Act’s remedial purposes and should explain how lower courts 
should make that determination. Without any guidance regarding the standard for 
setting damages, defendants, in class actions especially, remain unable to assess 
their realistic potential exposure. 
¶ 86 
 
Despite legislative language suggesting otherwise, this court’s opinion 
authorized the Act’s imposition of damages wildly exceeding any remotely 
reasonable estimate of harm. As noted by amici, for businesses facing this 
draconian exposure, it is cold comfort that this job-destroying liability only “may” 
be imposed—if the actual amount depends on the decisions of individual trial 
 
 
 
 
 
- 31 - 
judges applying their own standards, formulated without any guidance from this 
court or the legislature.  
¶ 87 
 
This court’s opinion leaves a staggering degree of uncertainty for courts and 
defendants. “Elementary notions of fairness enshrined in our constitutional 
jurisprudence dictate that a person receive fair notice not only of the conduct that 
will subject him to punishment, but also of the severity of the penalty that a State 
may impose.” BMW of North America, Inc. v. Gore, 517 U.S. 559, 574 (1996). This 
court has been willing to reconsider its earlier decision in circumstances where the 
result of the prior decision would amount to “legalized extortion and a crippling of 
*** commerce as we know it.” American Telephone & Telegraph Co. v. Village of 
Arlington Heights, 156 Ill. 2d 399, 409 (1993). Accordingly, I implore my 
colleagues to reconsider the court’s earlier decision and allow White Castle’s 
petition for rehearing. 
 
¶ 88 
 
CHIEF JUSTICE THEIS and JUSTICE HOLDER WHITE join in this dissent.