Judge set to approve $9.4M settlement over White Castle’s biometric timekeeping practices

Update: 

• A federal judge in Illinois preliminarily approved a $9.4 million settlement ending claims White Castle violated state biometric privacy laws with fingerprint time clocks.
• Per the settlement, each of an estimated 9,705 class members will receive around $968 in compensation regardless of how long they worked for White Castle. 
• The agreement resolves claims the restaurant violated the Illinois Biometric Information Privacy Act by failing to gain permission from employees to collect their fingerprint data. 
• In June 2020, Judge John Tharp denied an attempt by White Castle to dismiss the complaint. 

(June 22, 2020)

Claims that White Castle violated Illinois biometric laws with fingerprint time clocks were recently preserved by a federal judge.

U.S. District Judge John J. Tharp Jr. moved forward a White Castle class action lawsuit, which claims the fast food restaurant violated Illinois’ Biometric Information Privacy Act (BIPA) by failing to gain permission from employees to collect fingerprint data.

The fast food chain had previously argued for dismissal, arguing that plaintiff Latrina Cothron gave up her right to sue the company with a signed consent form in 2018. However, Judge Tharp found that the consent form did not count as a “knowing, voluntary, and intentional” choice to waive BIPA liability.

“Nothing in Ms. Cothron’s complaint or in the 2018 form indicates that Ms. Cothron knew she was waiving her right to bring suit against White Castle for past violations of BIPA,” Judge Tharp noted.

Judge Tharp also denied White Castle’s arguments claiming Cothron failed to show that the corporation’s intentions at the time of the alleged BIPA violations were against the law. According to the judge, these facts are irrelevant until it is time to determine any damages.

In addition to preserving Cothron’s BIPA claims, Judge Tharp also denied White Castle’s attempts to dismiss her claims under the Illinois Worker’s Compensation Act. The fast food chain previously argued that Cothron’s claims were barred by the law.

Judge Tharp denied this argument, noting that the company used “a frequent argument in BIPA cases” which hasn’t been successful after courts have “unanimously rejected it — and for good reason.”

“Multiple courts in this district have found that the IWCA does not preempt BIPA injuries — even if those injuries happen in the workplace,” the judge wrote in his motion.

Although Judge Tharp did preserve several of Cothron’s claims, he decided to dismiss one of her allegations under BIPA. Cothron had claimed that White Castle violated a BIPA provision, which requires companies to provide a policy for their retention and destruction of biometric data. The law also requires companies to destroy this data after it is used for “initial purpose for collecting or obtaining” or “within three years” of the last interaction with the person whose data was collected.

Since Cothron still works at White Castle, Judge Tharp found that her interactions with the fast food chain have not yet concluded. Based on this, she is not eligible for action under BIPA’s data destruction requirement. The judge also noted that Cothron hadn’t suffered an individual injury from the lack of a retention and destruction schedule.

“Although the provision of a publicly available retention and destruction policy is a collective right, the second requirement arguably creates an individual right to have personal data deleted,” Judge Tharp concluded.

“Nonetheless, the Court need not address this novel issue because Ms. Cothron has pleaded facts indicating that no violation occurred.”

Cothron filed her White Castle class action lawsuit in January 2019, arguing that she had been forced to use her fingerprints to clock in and out of work at the fast food chain.

According to Cothron, White Castle failed to follow the proper BIPA procedures for collecting and storing her biometric information.

Unlike other forms of identification, biometric markers cannot be changed if they are compromised.

If a Social Security number is compromised by a data breach, an individual is able to take action and get it changed – although the process may be arduous. The same cannot be said of fingerprints, retina scans, handprints, and other biometric identifiers.

“Unlike ID badges – which can be changed or replaced if stolen or compromised – fingerprints are unique, permanent biometric identifiers associated with each employee,” the White Castle class action explained. “This exposes White Castle’s employees to serious and irreversible privacy risks.”

In response to this unique security challenge, Illinois passed BIPA in 2008 as an attempt to protect Illinois residents from harm. However, White Castle allegedly failed to follow these regulations for around 10 years.

The White Castle class action lawsuit argues that it was not until 2018 that the company provided Cothron with a consent form, despite using a fingerprint system since BIPA’s passing.

Were you a White Castle employee in Illinois? Were you required to use your fingerprint to clock in and out of work? Share your experiences in the comments section below.

The plaintiffs and proposed Class Members are represented by Ryan F. Stephan, James B. Zouras and Andrew C. Ficzko of Stephan Zouras LLP.

The White Castle fingerprint class action lawsuit is Latrina Cothron, et al. v. White Castle System Inc., et al., Case No. 1:19-cv-00382, in the U.S. District Court for the Northern District of Illinois.

Read About More Class Action Lawsuits & Class Action Settlements:

• Amazon class action says workers’ face scans were illegally collected
• Target class action alleges violation of Illinois biometric privacy law
• Wingstop class action alleges company captured, stored customer voiceprints from phone orders
• Dating app class action alleges company illegally stores biometric data