ILLINOIS COURTS: “DOORS ARE OPEN, NO INJURY REQUIRED”
Biometric Information Privacy Act
2023 was a year of seminal rulings by the Illinois Supreme Court that will reshape the legal climate in the state for years to come. Illinois lawmakers enacted the Biometric Information Privacy Act (BIPA) in 2008, but it lied dormant until 2015 when plaintiffs’ lawyers discovered its business potential. BIPA provides a private right of action to a person whose fingerprint, voiceprint, hand or facial scan, or similar information is collected, used, sold, disseminated, or stored in a manner that does not meet the law’s requirements.
BIPA requires companies to inform an individual in writing and receive a written release prior to obtaining or retaining his or her biometric data. If a company fails to follow this procedure or meet other requirements, then any “aggrieved” person can seek the greater of $1,000 or actual damages for each negligent violation, and the greater of $5,000 or actual damages for each violation they allege was recklessly or intentionally committed.
The Court issued two rulings that, in the span of just a few short months, have already led to a dramatic increase in BIPA filings.
In February, the Illinois Supreme Court ruled that BIPA lawsuits are subject to the state’s “catch-all” statute of limitations, which provides five years to file claims with no defined period, as opposed to the state’s one-year default statute of limitations for privacy actions. The high court agreed with the Cook County Circuit Court, which had held that the five-year period applied.
Five years is an exceptionally long statute of limitations. It will make no-injury BIPA claims especially lucrative for plaintiffs’ lawyers because the longer the statute of limitations, the larger the classes and number of alleged violations subject to civil penalties. Most state consumer protection laws, for example, set a statute of limitations of two or three years.
As noted by the Illinois Chamber of Commerce in its brief in the case, Tims v. Black Horse Carriers, additional time does not protect workers or promote BIPA compliance. “Allowing plaintiffs five years to bring Privacy Act claims will effectively delay compliance with the statute and risk compromising more individuals’ privacy rights.” A one-year statute of limitations would allow employers in the state to “focus on hiring employees, keeping stores and warehouses open, and staying in business, as opposed to litigating expensive class actions.” Extending the statute of limitations will impose severe costs on businesses that must now defend themselves against claims previously thought to be barred. BIPA lawsuits are also especially time-consuming and expensive to litigate, which will only worsen with a longer limitations period.
Just a few weeks later, the Illinois Supreme Court issued yet another ruling that expanded liability for businesses under BIPA. In Cothron v. White Castle, the Court ruled that a BIPA claim accrues each time a business scans a person’s biometric information and each time it’s transmitted to a third party, not only upon the first scan and first transmission.
Employees sued their ex-employer, White Castle, in Cook County Circuit Court for failing to obtain permission before collecting their fingerprints to use as log-in credentials for accessing work computers and collecting paychecks. White Castle filed a motion to dismiss, arguing that the statute of limitations on the claims had expired, as the injury – collecting the employee’s data without written consent – occurred in 2008.
The plaintiffs’ lawyers countered by arguing that it was a new BIPA violation each time the improperly collected BIPA data was utilized, and therefore, it was a violation every time an employee logged in to the system.
As pointed out in an amicus brief, under the plaintiff’s rule “damages in these cases reach truly stratospheric levels” – collection and use of one employee’s biometric information could lead to thousands of distinct claims against the employer.
The dissent recognized the punitive nature of this decision and the severe impact it would have on businesses. Justice David Overstreet, joined by Chief Justice Mary Jane Theis and Justice Holder White, observed that “the legislature never intended the Act to be a mechanism to impose extraordinary damages on businesses or a vehicle for litigants to leverage the exposure of exorbitant statutory damages to extract massive settlements.” Subsequent scans after the first collection do not violate that privacy further, as no new information is collected. The dissent continued, “the majority’s construction of the Act does not give effect to the legislature’s true intent but instead eviscerates the legislature’s remedial purpose of the Act and impermissibly recasts the Act as one that is penal in nature rather than remedial.”
In the two months following the White Castle decision, BIPA lawsuit filings jumped 65%. The lawsuits are brought primarily by small- and medium-sized law firms, with a sizable portion brought by Chicago-based firm Justicia Laboral LLC. This onslaught of litigation does not appear to have an end in sight, as the Illinois legislature has not yet taken any steps to amend the statute and prevent this “annihilative liability” from being imposed. The Illinois Supreme Court has made it clear they do not see this issue as some- thing they can remedy, saying that “we continue to believe that policy-based concerns about potentially excessive damage awards under the Act are best addressed by the legislature.” As two defense attorneys put it, “Absent legislative intervention, BIPA will remain a significant issue for the foreseeable future.”
Companies targeted by BIPA litigation range from large national companies like Flowers.com and Krispy Kreme to local Chicago small businesses. A recent report by Illinois Citizens Against Lawsuit Abuse shows that a total of 1,141 BIPA cases are currently pending in Illinois state and federal courts, with seven law firms representing plaintiffs in more than two-thirds of those cases. This litigation has proven lucrative for these firms. In one case, plaintiffs’ lawyers received a nearly $100 million payday while their clients each received just over $400. As Illinois businesses continue to suffer from the unintended con- sequences of this law, it is a small group of law firms that are profiting at their expense.
Cases to Watch
There are two important pending cases, both of which originated in Cook County. In Mosby v. Ingalls Memorial Hospital, the Illinois Supreme Court will decide whether healthcare providers are exempt from BIPA liability. Section 10 of the Act provides that “biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996.”
Heath care providers argue that the “or” before information establishes an entire category of information that is not limited to patients. Under this category, they argue that collection, use, and storage of their workers’ information is related to the treatment of their patients. The lower court disagreed and found that healthcare providers could still be held liable under BIPA.
Upholding this decision would have a detrimental impact on medical providers in the state and would impose significant costs. As pointed out in an amicus brief, regulatory compliance already imposes high costs on healthcare providers. Allowing a private cause of action for alleged privacy violations is inconsistent with HIPAA’s statutory scheme and, given the intangible harms associated with privacy interests, would leave hospitals vulnerable to abusive litigation practices.
Given recent decisions by the Court in White Castle and Black Horse Carriers, imposing liability on healthcare providers in this context would be disastrous and discourage these entities from collecting biometric data in ways that promote patient health and safety.
The other case to watch, Palacios v. H&M Hennes, is the first class action following the White Castle decision. The case was originally filed in 2018 but was held until the Illinois Supreme Court’s ruling. The class includes any Illinois H&M worker who was required to use a fingerprint scanner between 2014 and 2019.
Genetic Information Privacy Act
While the state continues to grapple (unsuccessfully) with the BIPA litigation abuses, another wave of class actions is on the horizon. Illinois’ Genetic Information Privacy Act (GIPA), enacted in 1998, addresses the disclosure and use of an individual’s genetic information. It restricts employers from requiring genetic testing as a condition of employment and states that the results of genetic testing cannot be used to affect the terms of employment. Given their immense success under BIPA, plaintiffs’ lawyers will look to exploit GIPA’s broad definition of “genetic information” and large damages provision. Already, in 2023, it is estimated that nearly 40 cases have been filed in the state under the Act, with more and more plaintiff firms bringing these cases. The statute provides damages between $2,500 and $15,000 for each violation, depending on if the violation is deemed negligent or willful, respectively.
In August, plaintiffs’ lawyers filed two GIPA class actions in Cook County Circuit Court:
- Mendoza v. Advocate Health Care and Hospitals Corp.: An employee alleges that Advocate violated GIPA when asking questions during pre-employment physicals related to families’ medical history. The class action includes all who have applied for a job with the company within the past five years.
- Berry Chicago Transit Authority: This class action lawsuit similarly alleges that the Chicago Transit Authority violated GIPA by requesting that applicants complete a pre-employment physical that asks questions about family medical history.
More recently, GIPA class actions brought in Cook County have targeted life insurance providers and pharmaceutical companies.
Food & Beverage Litigation
The rate of consumer class actions targeting the marketing of food and beverage products in Illinois remained steadfast in 2022 (42), following a 450% increase in 2021 (45). Illinois was third in filings for the second consecutive year behind New York and California. Illinois is a magnet for these types of lawsuits because it has one of the “broadest, most flexible” consumer protection laws. The vast majority of these cases are filed in federal court in the Northern District of Illinois, which includes Cook County.
This jump in lawsuits is aided by a prolific filer of no-injury consumer class actions, Spencer Sheehan, who continues to file in Illinois after a string of defeats in New York’s federal courts. However, he may soon be looking to a new jurisdiction following a strong rebuke by an Illinois federal judge.
In a May 15 opinion dismissing a lawsuit claiming that consumers expected more olive oil in a jar of mayonnaise, Judge Steven Seeger wrote that, “The shelf life of the complaint has long since expired. In fact, the theory of the case was past its prime from the very moment that it arrived in the federal courthouse. Plaintiff’s counsel has peddled this theory time and again, in case after case, without much success in this district. The complaint joins a warehouse of complaints filed by plaintiff’s counsel that are not fit for public consumption.”
In Guzman v. Walmart, Sheehan alleged that the Great Value reduced-fat mayonnaise labeled “with olive oil” was deceptively labeled as it only contains a “de minimis” amount of olive oil.
Judge Seeger further stated, “At this point, this Court has gone round and round the carousel a number of times with plaintiff’s counsel in cases about deceptive product labeling. The case at hand is yet another spin on an increasingly unpleasant ride. It is time for the carousel to come to a halt.”
Noting a lawyer’s obligation to file claims in good faith, Judge Seeger required Sheehan to provide the court with a spreadsheet showing each case that he has brought alleging a product contained a “de minimis” amount of an ingredient, indicating the outcome of any motion to dismiss stage. The ruling challenged Sheehan, who had become “a wrecking ball when it comes to imposing attorneys’ fees on other people,” to explain why he should not be required to pay the defendant’s attorney’s fees. “Plaintiff’s counsel has taken everyone on a ride, and Plaintiff’s counsel must show who should pay for the ticket.”
Days after the olive oil ruling, another federal judge in Illinois dismissed a lawsuit claiming that con- sumers expect gum to contain actual mint or peppermint because a blue leaf appears on the package. Judge Iain D. Johnston observed that “mint” didn’t even appear on the Trident package and requested a copy of the spreadsheet requested by Judge Seeger.
Following these rulings, another target of Sheehan’s meritless lawsuits, Sazerac, urged another federal judge to impose sanctions on the attorney. This came after the court dismissed a claim alleging that the packaging of its Fireball Malt mini bottles misleads consumers to believe it is whiskey when it is a malt beverage. The core problem with that lawsuit was that, contrary to the complaint’s allegations, the product isn’t sold in Illinois.
According to one attorney’s count, “Between January 1, 2020 and April 7, 2023, Mr. Sheehan filed 553 complaints. Of those, 120 (21.6%) were dismissed outright and 35 (6.3% survived a motion to dismiss at least in part. The remaining 398 (roughly 72%) were either settled or are still pending. Mr. Sheehan’s filings have slowly been increasing in number each year, and were it not for [Judge Seeger’s] order, which appears to have chilled his filing pace, he was on pace in 2023 to surpass his prior record of 187 complaints in 2022.”
The prevalence of no-injury lawsuits in Cook County has propelled the county near the top of this year’s list. Litigation brought under the state’s Biometric Information Privacy Act (BIPA) continues to flood the state’s court system, with some of the most notable cases brought in Cook County. Rather than rein in abuse, Illinois Supreme Court rulings have only incentivized more filings.
for the most food and beverage class actions in the country due to the state’s reputation for allowing no-injury lawsuits and plaintiff-friendly consumer protection laws. Lawyers file most of these cases in federal court in the Northern District of Illinois, which includes Cook County.
A recent U.S. Chamber 
country for asbestos litigation, with filings surging in the first half of
