IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
LATRINA COTHRON, Individually ) and on behalf of similarly situated ) individuals, ) ) Plaintiff, ) No. 19 CV 00382 ) v. ) Judge John J. Tharp, Jr. ) WHITE CASTLE SYSTEM, INC. ) D/B/A WHITE CASTLE, ) ) Defendant.
MEMORANDUM OPINION AND ORDER Despite numerous recent suits concerning Illinois’ Biometric Information Privacy Act (BIPA), important questions of statutory interpretation remain unresolved. This case presents two such questions: what acts violate BIPA Section 15(b) and Section 15(d) and when do claims premised on such violations accrue? Plaintiff Latrina Cothron alleges that, in 2007, her employer, White Castle System, Inc. (“White Castle”), implemented a system that involved capturing her fingerprint data and disclosing it to third parties. After BIPA’s enactment in mid-2008, White Castle continued to operate its system but did not obtain the newly required consent of its employees, thereby violating BIPA Section 15(b) and Section 15(d).1 White Castle has moved for judgment on the pleadings pursuant to Federal Rule of Civil Procedure 12(c), arguing that Ms. Cothron’s claims accrued in 2008 and are therefore barred by the statute of limitations. Because
1 Ms. Cothron’s second amended complaint included alleged violations of Section 15(a), but the Court dismissed her claims under that provision for lack of Article III standing. See Mem. Op. Order 5-6, ECF No. 117. the Court finds that Ms. Cothron’s claims under both Section 15(b) and Section 15(d) are timely, White Castle’s motion is denied. BACKGROUND2 The facts set forth below are largely the same as those described in the Court’s prior opinion in this case. See Mem. Op. Order 2-3, ECF No. 117. Latrina Cothron began working for White
Castle in 2004 and is still employed by the restaurant-chain as a manager. Sec. Am. Compl. ¶ 39, ECF No. 44. Roughly three years after Ms. Cothron was hired, White Castle introduced a fingerprint-based computer system that required Ms. Cothron, as a condition of continued employment, to scan and register her fingerprint in order “to access the computer as a manager and access her paystubs as an hourly employee.” Id. ¶ 40. According to Ms. Cothron, White Castle’s system involved transferring the fingerprints to two third-party vendors—Cross Match and Digital Persona—as well as storing the fingerprints at other separately owned and operated data-storage facilities. Id. ¶¶ 28-31. Perhaps unsurprisingly—given that the Illinois Biometric Information Privacy Act (“BIPA”) did not exist yet—White Castle did not receive a written release
from Ms. Cothron to collect her fingerprints or to transfer them to third parties before implementing the system. Id. ¶ 41. When the Illinois legislature enacted BIPA in mid-2008, the legal landscape changed but White Castle’s practices did not—at least not for roughly ten years. Id. ¶¶ 27-28. White Castle continued to use its fingerprint system in the years following BIPA’s passage and continued to disseminate that data to the same third parties. Id. ¶¶ 28-31. It was not until October 2018 that
2 On a motion for judgment on the pleadings, the Court must accept all well-pleaded facts in the second amended complaint as true and draw all permissible inferences in favor of the plaintiffs. Pisciotta v. Old Nat. Bancorp, 499 F.3d 629, 633 (7th Cir. 2007). 2 White Castle provided Ms. Cothron with the required disclosures or a consent form. Id. ¶¶ 45, 48- 49. On December 6, 2018, Ms. Cothron filed her class action complaint in the Circuit Court of Cook County, Illinois and the case was subsequently removed to this Court by Cross Match Technologies, Inc. (since dismissed from the case). Mot. J. Pleadings 2, ECF No. 120. After the Court denied White Castle’s motion to dismiss Ms. Cothron’s second amended complaint, White
Castle filed an answer. Id. In the answer, White Castle raised a statute of limitations defense and subsequently moved for judgment on the pleadings on that basis. Id. DISCUSSION
A motion for judgment on the pleadings under Rule 12(c) is evaluated using the same standard as a motion to dismiss under Rule 12(b)(6): to survive the motion, “a complaint must state a claim to relief that is plausible on its face.” Bishop v. Air Line Pilots Ass’n, Int’l, 900 F.3d 388, 397 (7th Cir. 2018) (citations omitted). A claim has “facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Wagner v. Teva Pharm. USA, Inc., 840 F.3d 355, 358 (7th Cir. 2016) (quoting Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)). In assessing a motion for judgment on the pleadings, the Court draws “all reasonable inferences and facts in favor of the nonmovant, but need not accept as true any legal assertions.” Id. Ms. Cothron provides two arguments for rejecting White Castle’s statute of limitations defense: first, that White Castle waived its statute of limitations defense by not asserting it in its previously filed motion to dismiss; second, that her claims are timely. I. Waiver In making her waiver argument, Ms. Cothron ignores the basic framework provided by the Federal Rules of Civil Procedure as well as the language of Rule 12(g)(2), on which she relies. 3 The Rules provide that a defendant may respond to a complaint by filing a responsive pleading or, alternatively, by filing a motion to dismiss under Rule 12(b). Fed. R. Civ. P. 12(a). A Rule 12(b) motion, which must be made before a responsive pleading, is the proper vehicle for challenging the sufficiency of the complaint. Fed. R. Civ. P. 12(b). And White Castle, in its previously filed motion to dismiss, properly raised arguments under Rule 12(b)(6) that targeted the sufficiency of
the complaint. Affirmative defenses (such as the defense of statute of limitations), on the other hand, are “external” to the complaint. Brownmark Films, LLC v. Comedy Partners, 682 F.3d 687, 690 n.1 (7th Cir. 2012). Per Rule 8(c), the proper time to identify affirmative defenses is in a defendant’s responsive pleading. Fed. R. Civ. P. 8(c). Then, “[a]fter pleadings are closed,” a party may subsequently file a motion for judgment on the pleadings and seek judgment based on the previously raised affirmative defense. Fed. R. Civ. P. 12(c). In keeping with these rules, the Seventh Circuit has “repeatedly cautioned that the proper heading for such motions is Rule 12(c).” Brownmark Films LLC, 682 F.3d at 690 n.1; see also Burton v. Ghosh, 2020 WL 3045954, at *3 (7th Cir. 2020) (“The proper way to seek a dismissal based on an affirmative defense under most
circumstances is not to move to dismiss under Rule 12(b)(6) for failure to state a claim. Rather, the defendant should answer and then move under Rule 12(c) for judgment on the pleadings.” (citation omitted)). Contrary to Ms. Cothron’s argument, White Castle did not waive its right to assert a statute of limitations defense in a motion for judgment on the pleadings; Rule 12(g)(2) expressly states that its limitation on further motions is applicable “except as provided in Rule 12(h)(2).” And Rule 12(h)(2)(B), in turn, expressly provides that failure to state a claim may be raised “by a motion under Rule 12(c)”—a motion which, again, may only be made “after the
4 pleadings are closed.”3 Far from having waived its statute of limitations defense, White Castle has raised the affirmative defense at precisely the procedural posture envisioned by the Rules. Ms. Cothron’s argument to the contrary is entirely off-base. II. Timeliness Ms. Cothron’s second argument for denying the motion—that, considered on the merits,
White Castle’s statute of limitations defense fails—is substantially stronger; indeed, the Court concludes that it is correct. A statute of limitations defense is an argument about the timeliness of a claim, and timeliness is a function of both the accrual date of a cause of action and the applicable statute of limitations. Nonetheless, in asserting its defense, White Castle limits itself to the issue of accrual and the Court does the same. See Reply Br. 5 n.2, ECF No. 124 (“White Castle has argued that Plaintiff’s claims are untimely no matter what statute of limitations applies. Should the Court wish to determine the applicable limitations period, White Castle requests additional briefing on the issue.”).4
3 See 5C FED. PRAC. & PROC. CIV. § 1392 (3d ed.): The operation of Rule 12(h)(2) is relatively simple. The three defenses protected by the rule may be asserted by motion before serving a responsive pleading. Unlike the Rule 12(h)(1) defenses, however, if a party makes a preliminary motion under Rule 12 and fails to include one of the Rule 12(h)(2) objections, she has not waived it, even though, under Rule 12(g), the party may not assert the defense by a second pre-answer motion. As the rule explicitly provides, a defending litigant also may interpose any of the Rule 12(h)(2) defenses in the responsive pleading or in any pleading permitted or ordered by the court under Rule 7(a). Moreover, even if these defenses are not interposed in any pleading, they may be the subject of a motion under Rule 12(c) for judgment on the pleadings or of a motion to dismiss at trial. 4 As noted, the Court accepts, for present purposes, White Castle’s position that the statute of limitations for BIPA claims has not been definitively resolved and that such claims are 5 As a general matter, under Illinois law, a cause of action accrues and the “limitations period begins to run when facts exist that authorize one party to maintain an action against another.” Feltmeier v. Feltmeier, 207 Ill. 2d 263, 278, 798 N.E.2d 75, 85 (Ill. 2003). On the same facts, however, the parties put forth accrual dates that differ by roughly 10 years: White Castle argues that the claims accrued in mid-2008, while Ms. Cothron contends that at least a portion of her
claims accrued in 2018. How so far apart? The ten-year delay stems from accepting either of Ms. Cothron’s two theories of accrual. First, Ms. Cothron contends that the alleged BIPA violations can be understood as falling under an exception to the general rule governing accrual, the continuing violation exception. “[U]nder the ‘continuing tort’ or ‘continuing violation’ rule, ‘where a tort involves a continuing or repeated injury, the limitations period does not begin to run until the date of the last injury or the date the tortious acts cease.’” Id. (quoting Belleville Toyota, Inc. v. Toyota Motor Sales, U.S.A., Inc., 199 Ill.2d 325, 345, 770 N.E.2d 177 (Ill. 2002)). Applying this doctrine, Ms. Cothron argues that the statute of limitations did not begin to run on any portion of her claim until the final violation (the last time White Castle collected and
disseminated her fingerprint before she received BIPA notice and provided her consent). In the alternative, Ms. Cothron contends that each post-BIPA scan of her fingerprint constituted a separate violation of Section 15(b) and each disclosure to a third-party over that same period a separate violation of Section 15(d), with each violation accruing at the time of occurrence. Under this theory, at least a portion of Ms. Cothron’s claims did not accrue until 2018 and would therefore
potentially subject to a “one-, two-, or five-year statute of limitations.” Mot. J. Pleadings 1, ECF No. 120. Nonetheless, the Court also acknowledges Ms. Cothron’s argument that “[e]very trial court that has decided the issue has unanimously held the five-year ‘catch-all’ limitations period applies.” Pl.’s Resp. 8, ECF No. 123. 6 be timely under any statute of limitations. White Castle rejects both theories, arguing instead that the complaint describes a single violation of Section 15(b) and a single violation of Section 15(d), both of which occurred and accrued “in 2008, during the first post-BIPA finger-scan that she alleges violated BIPA.” Mot. J. Pleadings 10, ECF No. 120. The Court considers each argument in turn.
A. Continuing Violation Exception At the outset, it is worth noting that Ms. Cothron’s invocation of the continuing violation exception is ambiguous: it is unclear whether, in her view, White Castle’s alleged course of conduct amounts to a single ongoing violation of each of the two BIPA provisions at issue or whether her argument is that White Castle violated the statute’s terms repeatedly but the violations should be viewed as a continuous whole for prescriptive purposes only. Under either interpretation, however, the argument fails. The continuing violation doctrine is a well-established, but limited exception to the general rule of accrual. In Feltmeier, the Illinois Supreme Court limned the doctrine’s scope: “A
continuing violation or tort is occasioned by continuing unlawful acts and conduct, not by continual ill effects from an initial violation.” 207 Ill. 2d at 278, 798 N.E.2d at 85. And those unlawful acts must produce a certain sort of injury for the doctrine to apply: the purpose of the doctrine is “to allow suit to be delayed until a series of wrongful acts blossoms into an injury on which suit can be brought.” Limestone Dev. Corp. v. Vill. of Lemont, Ill., 520 F.3d 797, 801 (7th Cir. 2008). Thus, the continuing violation doctrine is “misnamed”—“it is [ ] a doctrine not about a continuing, but about a cumulative, violation.” Id. See also Rodrigue v. Olin Employees Credit Union, 406 F.3d 434, 442 (7th Cir. 2005) (“Where a cause of action arises not from individually identifiable wrongs but rather from a series of acts considered collectively, the Illinois Supreme 7 Court has deemed application of the continuing violation rule appropriate.”). By contrast, “the continuing violation rule does not apply to a series of discrete acts, each of which is independently actionable, even if those acts form an overall pattern of wrongdoing.” Id. at 443. Compare Cunningham v. Huffman, 154 Ill. 2d 398, 406, 609 N.E.2d 321, 324-325 (Ill. 1993) (“When the cumulative results of continued negligence is the cause of the injury, the statute of repose cannot
start to run until the last date of negligent treatment.”), with Belleville Toyota, 199 Ill. 2d at 349, 770 N.E.2d at 192 (“Rather, each allocation constituted a separate violation of section 4 of the Act, each violation supporting a separate cause of action. Based on the foregoing, we agree with defendants that the appellate court erred in affirming the trial court’s application of the so-called continuing violation rule.”). BIPA claims do not fall within the limited purview of this exception. The Illinois Supreme Court has held that a person is “‘aggrieved within the meaning of Section 20 of the [BIPA] and entitled to seek recovery under that provision” whenever “a private entity fails to comply with one of section 15’s requirements.” Rosenbach v. Six Flags Entm’t Corp., 432 Ill. Dec. 654, 663, 129
N.E.3d 1197, 1206 (Ill. 2019). And, as relevant here, Sections 15(b) and 15(d) impose obligations that are violated through discrete individual acts, not accumulated courses of conduct. Section 15(b) provides that no private entity “may collect, capture, purchase, receive through trade, or otherwise obtain” a person’s biometric information unless it first receives that person’s informed consent. 740 ILCS 14/15(b). This requirement is violated—fully and immediately—when a party collects biometric information without the necessary disclosure and consent. Similarly, Section 15(d) states that entities in possession of biometric data may only disclose or “otherwise disseminate” a person’s data upon obtaining the person’s consent or in limited other circumstances inapplicable here. 740 ILCS 14/15(d). Like Section 15(b), an entity violates this obligation the 8 moment that, absent consent, it discloses or otherwise disseminates a person’s biometric information to a third party. The injuries resulting from these violations do not need time to blossom or accumulate. Time may exacerbate them, but an injury occurs immediately upon violation.5 Cf. Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 627 (7th Cir. 2020), as amended on denial of reh’g and reh’g en banc (June 30, 2020) (by failing to obtain informed consent,
defendant “inflicted the concrete injury BIPA intended to protect against, i.e. a consumer’s loss of the power and ability to make informed decisions about the collection, storage, and use of her biometric information.”). On the facts set forth in the pleadings, White Castle violated Section 15(b) when it first scanned Ms. Cothron’s fingerprint and violated Section 15(d) when it first disclosed her biometric information to a third party. At that point, Ms. Cothron’s injuries stemming from those actions were immediately and independently actionable. Even if White Castle repeatedly violated BIPA’s terms—a possibility discussed below—that would not transform the violations into a continuing violation. See Belleville Toyota, 199 Ill. 2d at 348-49, 770 N.E.2d at 192 (“Although we recognize
that the allocations were repeated, we cannot conclude that defendants’ conduct somehow constituted one, continuing, unbroken, decade-long violation of the Act.”). This case presents a substantially similar question to the one confronted in Belleville Toyota and the Court views it as a good “indicator of how the [Illinois Supreme] Court would decide this case.” Rodrigue, 406 F.3d at 444.
5 The Court notes that BIPA provides for either liquidated or actual damages, whichever is greater. 740 ILCS 14/20. While actual damages might not be immediately obvious and could emerge at any point after an unlawful scan or disclosure, there is nothing cumulative about the damages that would require treating a series of violations as a continuous whole. 9 In sum, the Court finds that the continuing violation doctrine does not apply to BIPA violations—at least not to those at issue here—and, as a result, Ms. Cothron’s right to sue for those violations accrued when the violations occurred. The next question is: when did the alleged violations occur? II. BIPA Violations Alleged in the Second Amended Complaint
As an alternative argument, Ms. Cothron contends that each post-BIPA scan of her fingerprint constituted an independent violation of Section 15(b) and each disclosure to a third party over that same period violated Section 15(d). Because Ms. Cothron has alleged scans and disclosures occurring within a year of filing suit, this alternative theory would also render at least some of her claims timely.6 The question of what constitutes a violation of BIPA’s terms is a pure question of statutory interpretation, and the Illinois Supreme Court has counseled that the “most reliable indicator” of legislative intent is “the language of the statute.” Michigan Ave. Nat. Bank v. Cty. of Cook, 191 Ill. 2d 493, 504, 732 N.E.2d 528, 535 (Ill. 2000). “The statutory language must be given its plain and
ordinary meaning, and, where the language is clear and unambiguous, we must apply the statute without resort to further aids of statutory construction.” Id. Therefore, the analysis must begin with the text of Sections 15(b) and 15(d). In full, Section 15(b) provides: No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier or biometric information, unless it first:
6 As noted supra note 4, the shortest potentially applicable statute of limitations is one year. 10 (1) informs the subject or the subject’s legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored;
(2) informs the subject or the subject’s legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and
(3) receives a written release executed by the subject of the biometric identifier or biometric information or the subject’s legally authorized representative.
740 ILCS 14/15(b). In the Court’s view, this text is unambiguous and therefore dispositive. A party violates Section 15(b) when it collects, captures, or otherwise obtains a person’s biometric information without prior informed consent. This is true the first time an entity scans a fingerprint or otherwise collects biometric information, but it is no less true with each subsequent scan or collection. Consider a fingerprint-based system like the one described in Ms. Cothron’s complaint. Each time an employee scans her fingerprint to access the system, the system must capture her biometric information and compare that newly captured information to the original scan (stored in an off-site database by one of the third-parties with which White Castle contracted).7 In other words, the biometric information acts like an account password—upon each use, the information must be provided to the system so that the system can verify the user’s identity.
7 One fact question that may be of particular significance to liability under Section 15(d) is where the comparison takes place. Must White Castle send the newly collected fingerprint scan to one of the third parties in order for the comparison to be made at an off-site location or does White Castle retrieve the information from the off-site location such that the comparison takes place at the White Castle location? It is entirely unclear, however, why the statute is designed such that this distinction should matter to the question of liability; the privacy concerns are implicated equally whether the new data is sent off-site for comparison or the old data is retrieved from an off-site location so that the comparison can take place on-site. 11 In its only text-based argument to the contrary, White Castle points to the statute’s language requiring that informed consent be acquired before collection. That means, White Castle urges, that it is the failure to provide notice that is the violation, not the collection of the data. But that reading simply ignores the required element of collection. There is no violation of Section 15(b) without collection; unlike Section 15(a), a failure to disclose information is not itself a violation.
Section 15(b) is violated only where there is both a failure to provide specific information about collection of biometric data and collection of that data. A statutory requirement indicating when certain information must be provided, moreover, is different than a requirement indicating for which collections that provision of information is required. The text of Section 15(b) does indicate when consent must be acquired, but it does not differentiate between the first collection and subsequent collections: for any and all collections, consent must be obtained “first.” 740 ILCS 14/15(b). This understanding of the consent requirement is entirely consistent with the possibility of consent covering multiple future scans (e.g., all scans in the context of employment). Section 15(b)
provides for consent through “written release,” which is defined elsewhere in the statute as “informed written consent or, in the context of employment, a release executed by an employee as a condition of employment.” 740 ILCS 14/10. To comply with Section 15(b), White Castle could have provided Ms. Cothron with a release informing her of “the specific purpose and length of term” for which her information was being used and requiring her consent to all future scans consistent with those uses as a condition of employment. 740 ILCS 14/15(b). On the facts alleged, however, it did not do so until 2018 at the earliest; as for the intervening years, the only possible conclusion is that White Castle violated Section 15(b) repeatedly when it collected her biometric data without first having obtained her informed consent. 12 The language of Section 15(d) requires the same result. In relevant part, Section 15(d) provides: No private entity in possession of a biometric identifier or biometric information may disclose, redisclose, or otherwise disseminate a person’s or a customer's biometric identifier or biometric information unless:
(1) the subject of the biometric identifier or biometric information or the subject’s legally authorized representative consents to the disclosure or redisclosure
740 ILCS 14/15(d). Again, each time an entity discloses or otherwise disseminates biometric information without consent, it violates the statute. This conclusion is especially unavoidable where, as here, the statute includes “redisclose” in the list of actions that cannot be taken without consent. As a result, even where an entity transmits the biometric information to a third party to which it has previously transmitted that same information, the redisclosure requires consent. Here, White Castle does not provide a single text-based argument to the contrary. And again, the Court notes that, as with Section 15(b), it is consistent with the statutory language to obtain consent for multiple future disclosures through a single written release. But it is also once again true that White Castle failed to do so until 2018 at the earliest. Therefore, each time that White Castle disclosed Ms. Cothron’s biometric information to a third party without consent, it violated Section 15(d). Instead of providing a plausible alternative reading of the statutory text, White Castle maintains that reading Section 15(b) and Section 15(d) this way would lead to absurd results because the statutory damages for each violation—if defined as every unauthorized scan or disclosure of Ms. Cothron’s fingerprint—would be crippling. And the Court fully acknowledges the large damage awards that may result from this reading of the statute. But, as an initial matter, such results are not necessarily “absurd,” as White Castle insists; as the Illinois Supreme Court explained in Rosenbach, “subjecting private entities who fail to follow the statute’s requirements 13 to substantial potential liability, including liquidated damages, injunctions, attorney fees, and litigation expenses ‘for each violation’ of the law” is one of the principal means that the Illinois legislature adopted to achieve BIPA’s objectives of protecting biometric information. Rosenbach, 432 Ill. Dec. at 663, 129 N.E.3d at 1207. And absurd or not, the Illinois Supreme Court has repeatedly held that, where statutory language is clear, it must be given effect:
Where the words employed in a legislative enactment are free from ambiguity or doubt, they must be given effect by the courts even though the consequences may be harsh, unjust, absurd or unwise. Such consequences can be avoided only by a change of the law, not by judicial construction.
Petersen v. Wallach, 198 Ill. 2d 439, 447, 764 N.E.2d 19, 24 (Ill. 2002) (cleaned up) (emphasis added). As a result, the Court is bound by the clear text of the statute. If the Illinois legislature agrees that this reading of BIPA is absurd, it is of course free to modify the statute to make its intention pellucid. But it is not the role of a court—particularly a federal court—to rewrite a state statute to avoid a construction that may penalize violations severely. In any event, this Court’s ruling is unlikely to be the last word on this subject. On appeal—and possibly upon certification to the Illinois Supreme Court8—White Castle will have ample opportunity to explain why it is absurd to suppose that the legislature sought to impose harsh sanctions on Illinois businesses that ignored the requirements of BIPA for more than a decade. In sum, the Court concludes that Ms. Cothron has alleged multiple timely violations of both Section 15(b) and Section 15(d). According to BIPA Section 20, she can recover “for each violation.” 740 ILCS 14/20. The number of those timely violations will be resolved at a future point when, in accordance with White Castle’s request, further briefing is devoted to the issue of
8 The Illinois Supreme Court accepts certified questions from federal courts of appeals but not from federal district courts. See Ill. S. Ct. Rule 20. 14 the applicable statute of limitations. For the present, however, it is clear that at least some of her claims survive under this reading of the statute and, therefore, White Castle’s motion for judgment on the pleadings is denied.
f / / Jf Sf, NY Set nf \ / \ Date: August 7, 2020 John J. Tharp, Jr. United States District Judge