American burger-slinging giant White Castle is almost certainly regretting its decisions about employee oversight after the Illinois Supreme Court issued an advisory Friday opening the fast-food company to potentially multibillion-dollar fines.
In what we imagine was a heartbreaking decision for the White Castle legal team, the court ruled [PDF] in a 4-3 decision that White Castle could be held responsible for every time it scanned the fingerprints of its 9,500 employees without their consent.
Since 2008, Illinois has required companies to obtain consent before collecting or transmitting an individual’s biometric data. The fine for failing to do so was between $1,000 and $5,000 per violation, depending on the circumstances.
The case, brought by an Illinois woman who began working at White Castle in 2004, involves the use of employee fingerprints to access pay slips and company computers, which she says were implemented shortly after she joined the company.
The potentially costly issue at the heart of the case is whether private entities – in this case the citizen chain – are liable whenever they have collected a person’s biometric data without their consent. According to court documents, White Castle was not allowed to use its employees’ fingerprints until 2018, a decade after the bill was signed.
In court, White Castle argued that it was only the first time it collected its employees’ fingerprints, not every time an employee swiped their finger to sign up for work or access credentials.
However, the plaintiffs in the case had maintained that the company should be held accountable for every fingerprint it collected in the 10 years it violated state law. That can leave a bad taste in the mouth.
Any hope that the court would drop the issue was dashed after the judges found White Castle’s interpretation of the law distasteful. The company estimates it could pay as much as $17 billion as a result of the decision — or 23 billion classic sliders by our estimate.
However, there remains a chance that White Castle will shrug off the worst fines. Although the state Supreme Court has issued an advisory opinion on the case, the case is not over. And as the judges noted in their analysis, the presiding judge would have the power to draft damages that fairly compensate classmates while deterring future violations, without the threat of what White Castle’s lawyers describe as “damaging liability ‘.
The court also suggested that the state legislature review the law to determine whether changes should be made regarding potentially excessive damages.
This isn’t the first time a company has breached state biometric privacy protections. In 2020, Facebook — since renamed Meta — agreed to pay $650 million to settle a class action lawsuit for applying facial recognition software to Illinois residents without their consent. ®
Leave a Reply