# Oral argument — Latrina Cothron v. White Castle System, Inc. > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/argument%3A77586 ## Record - **Collection:** Oral argument - **Document type:** Oral argument - **Published:** September 14, 2021 ## Text The Honorable Judges of the United States Court of Appeals in and for the Seventh Judicial Circuit. Hear ye, hear ye, hear ye. All persons having business before this honorable court are admonished to draw near and give their attention. As the court is now sitting, God save the United States and this honorable court. And good morning. I see both counsels, so we can proceed with our first case this morning, Cothron v. White Castle. Ms. Siebert. I'm sorry, Mr. Seabert. Good morning. Yes. All right. Very good. Yes. Ms. Siebert, with that interruption, you may proceed. Thank you. Good morning, and may it please the court. Melissa Siebert for White Castle. Information Privacy Act, which discourts a person's right to privacy. In this case, the lower court found that BIPA claims accrued each time counsel. I would be particularly appreciative if you used real English words rather than initialisms, which are not in common use. We're a bunch of generalists. Certainly. Why don't you just call it the act? I will attempt to do so. Thank you, Your Honor. Here, the lower court found that claims accrue under the act each time an employee uses the same biometric technology and each time their data is disclosed to the same third parties. The opinion incorrectly changes the act from a remedial statute to a punitive one, is contrary to the legislature's intent, and imposes potentially catastrophic damages on employers such as White Castle. To determine when a claim accrues under the act, one first has to look at case law establishing what an injury is under the act and when that injury occurs. In Rosenbach, the Illinois Supreme Court explains that the act confers a statutory right to privacy and control over biometric data. Precedential decisions from this court establish that the injury occurs under the act at the time one loses control over or secrecy in one's biometric data before there has been compliance with the act's informed consent regime. Distilling Rosenbach to its essence, the act provides the power to say no by withholding consent. Counsel, I appreciate your relying on Rosenbach and West Bend, but neither of them deals with the period of limitations or when a claim accrues. Does any Illinois appellate decision address when a claim accrues for limitations purposes? No, Your Honor, it doesn't. But this court routinely requires... It sounds like it might be an appropriate occasion for certification, which the plaintiff has requested. What worries me in a case like this is that this case was filed in state court but removed, and it looks very much from the docket of this court like almost all cases under the act are being removed under the Class Action Fairness Act, which makes it very hard for the state to interpret its own statute. That's why I wonder why we shouldn't be thinking about certification. I would answer that in two parts. First, as this court has noted in State Farm v. Payne, the decision to certify should be approached with caution, given the burdens on the state bench, colleagues, and concern for the litigants before this court. As a result, certification is only appropriate when the court is genuinely uncertain about a question of state law that is vital to the case. No genuine uncertainty exists here. This court sitting in diversity regularly applies state law accrual principles and has construed and cited the Illinois Supreme Court's Feltmire decision... Counsel, I wish you'd address the source of my concern. We address state law questions all the time when we're confident that the state, in due course, will be able to resolve the issue. But it looks to me like a very substantial fraction of these cases is being removed under the Class Action Fairness Act, which is going to prevent the state court from addressing the issue of state law. That's what worries me. If you have some response to that concern, I'd appreciate it. Sure. There are two appeals pending on the issue of the statute of limitations, and one involves accrual in the Illinois appellate courts, but they're in their infancy. And this court has not previously held that pending appellate court proceedings create genuine uncertainty sufficient to warrant certification. It's only when state court appellate opinions conflict that certification is appropriate. There are, in fact, Your Honor, hundreds of BIPA cases pending in Illinois state courts. I currently represent over 130 BIPA defendants, and at least half of those cases... 130 what defendants? I'm sorry. Defendants who have been sued... Once you start using these initialisms, it's hard to stop. But it really is a good idea to stop. Understood. Understood. In State Farm v. Pay, this court declined to certify a question because of exactly what you note. The issue is likely to recur frequently in state courts, which will give the Illinois Supreme Court ample opportunity to revisit the subject if it chooses to do so. But there have not been decisions, and decisions are not yet close in Watson v. Guinness. And there is no genuine uncertainty, from White Castle's perspective, on the law regarding accrual. And the Supreme Court has twice issued decisions about when an injury occurs under the Act and what that injury is in Rosenbach and Westbeth. Ms. Siebert, on this issue of genuine uncertainty, what is White Castle's best textualist argument as to why its accrual position prevails? Argument from the text of the statute. Sure. BIPA Section... Sorry. The Act, Section 15b, does not permit White Castle to collect data unless it first follows the consent regime. The language of BIPA does not state that the consent regime must be followed each time biometric data is allegedly collected by the same entity, White Castle, from the same individual. That's what the lower court found. And in doing so, it impermissibly read a phrase into Section 15b each time that does not exist, something that Rosenbach has cautioned against. Bryant actually supports White Castle's reading of the statute. It notes that the, quote, text of the statute demonstrates that its purpose is to ensure that consumers understand before providing their biometric data how that data will be used. This is a point in time before the data is ever provided, not each subsequent point in time. Bryant further notes that when an entity fails to follow the consent regime, BIPA plaintiffs do not know that there is a choice to be made. Again, this is a singular event, choosing whether or not to provide biometric data in the first place, and the Bryant decision was based on this court's textual reading of 15b. Similarly, Section 15d requires consent to disclose biometric information. Section 15d does not contain any requirement that consent be obtained repeatedly, and in Let me, counsel, let me go back to what Illinois has addressed. Has Illinois decided whether it will follow the general approach to accrual of claims articulated by the Supreme Court of the United States in Amtrak against Morgan? I don't know that, Your Honor. The case distinguishes between discrete wrongs and cumulative wrongs. You don't know whether Illinois has ever tackled that question. If this were a question of federal law, it seems to me that these would be classified as discrete wrongs under Morgan. But Illinois may want to do something completely differently. It's really hard for us to know. Well, we know what Illinois law is regarding discrete violations or continuing violations, and that's set forth in the Illinois Supreme Court's opinion in Feldmeier, which, again, this court has applied. White Castle's point is that both Rosenbach and West Bend define when the injury occurs and the claim occurs as that loss of control, as the loss of secrecy, as the loss of privacy in one's data. And that privacy right, once given up without informed consent, as Rosenbach says, vanishes forever. There is nothing in Rosenbach that would indicate that they Counsel, as I said, Rosenbach is not about the statute of limitations. I'm looking for state cases that are about the statute of limitations. I assume Illinois has a statute banning harassing telephone calls. Does it view the claim as arising on the first such call or with each such call? I'm not familiar with that statute, Your Honor. What I do know is that the Feldmeier... Look, think about federal law. There is a federal law saying you can't send somebody a fax without consent. But if there's no consent, it's established federal law that each fax is a separate wrong. And all you need is one fax within the period of limitations. We don't ask when the first fax without consent was sent. Now, Illinois might take that approach, and in that event, each thumbprint without consent is covered. But maybe Illinois would take the approach of the single publication doctrine in the law of defamation and look only to the first wrong. I'm just trying to find genuine state cases that would tell us where it comes down on that kind of choice. Well, Your Honor, two things. I think you can find that in Feldmeier. Feldmeier also says that Illinois law on accrual is when there is a single overt act that the claim accrues and the limitations period begins to run on the date the defendant invaded the plaintiff's interest and inflicted injury. Here, West Bend provides the exact analysis that Your Honor just referenced. West Bend equated the disclosure of the same biometric data to the same third-party technology provider, those are the same allegations that are present here, to a publication of privacy, of private information. Under BIPA, the West Bend court deemed that an invasion of privacy. That's the single publication rule that's set forth in cases such as Troia and Cialino applies. All plaintiff has alleged here is that White Castle systematically and automatically disclosed her data to the same two parties. The same data, the same publication under Illinois law does not create a new injury each time the data is published to the same audience. That argument, counsel, that argument works well or potentially works well for a subsection D violation of the act, the anti-disclosure rule based on the meaning of what it is to disclose something. But I'm not sure it works for a subsection B violation, which is, you know, the anti-collection norm in the act that prohibits collection without prior informed consent. Right. As I noted, Your Honor, the act itself, section 15B, does not say each time. And what this court and Bryant and what the court of Rosenbach said is that the injury is the loss of control over or privacy in one's biometric data without informed consent. But once that privacy right is invaded, as Rosenbach says, the privacy right vanishes into thin air. And the very injury that was designed to prevent is realized here that when something vanishes into thin air, it can't it can no longer be secret. And again, we have collection by the same party of the same information for years with two consents. It bears noting that Ms. Cothron has consented not once but twice to the collection of her biometric data. First in 2004. And again in 2018. I was trying to reserve some argument time, but I believe I've exceeded my time. In sum, the nature of a BIPPA injury and accrual are well settled in Illinois. Plaintiff's claims accrued, if at all, in 2008 when she first used White Castle's finger scan technology after BIPPA's enactment. That is the moment she lost control of her purported biometric data. And that is the only moment that matters for this appeal. She her her privacy rights vanished. Her secrecy is gone. White Castle thus asked the court to deny plaintiff's certification motion, reverse the district court order, and remand with instructions to grant White Castle's motion for judgment. Thank you, Mr. Suris. May it please the court. My name is Jim Suris and I represent the plaintiff, Appleby Latrina Cothron. The plain text of the statute dictates the result. It contains a clear directive. There is to be no collection or dissemination of biometric data without informed consent. So a collector may not collect or disseminate unless it first informs the person of all the required information and gets their consent to do so. Here, the allegations are that White Castle did collect Latrina Cothron's data without disclosing the required information or getting consent. The allegations are that White Castle did disseminate her data without disclosing the required information or getting her informed consent, and that it did so repeatedly over the course of 10 years. The idea that White Castle injured Latrina Cothron, Pauline, once works only if she lost all of her rights under the act after the very first— Counsel, I brought up the single publication rule earlier, and I'd appreciate it if you would address it. And Illinois is among the states that follow the single publication rule, even though successive publications of defamatory information can cause new harm. But the claim accrues just once on first publication. Why shouldn't we predict that Illinois would take the same approach to biometric information? The main reason is that there's no authority by which to believe the Illinois Supreme Court would equate publication in the context of defamatory material, an injury that violated some false light rights, some other torts, and it would somehow equate it to the informed consent regime under BIPA—under the act, sorry. Under what? Under the statute, under the statute, under the act, sorry. It's just very hard for people who get into their little corner of the law to remember that we are generalists. We don't talk like that. I apologize, Judge. I understand. There's no reason to believe that the Illinois Supreme Court would equate those wrongs with the taking—with the failure to secure informed consent as required under the statute. Is there any reason to believe it wouldn't? What the parties are arguing in this case rests a lot on what the Seventh Circuit has said, rests a lot on what two decisions of the state Supreme Court have said in cases that don't involve a period of limitations. I'm just trying to get my hands on genuine Illinois limitations law. The answer, Your Honor, is that based on the vetting that I think the parties have done here, there isn't a lot of authority out there in the Illinois appellate court world or the Supreme Court world. The only decisions that even come close, I believe, have been brought to the court's attention, although our view is they really don't help us when it comes to interpreting this particular statute, which, again, it's unlike a case. It's unlike a claim for, let's say, a data breach, because recall, it isn't the collection or the dissemination in and of itself that gives rise to a claim. It is that conduct without getting informed consent. And under the plain text of the statute, that informed consent is required before any occasion of collection or dissemination. Now, as the district court pointed out, once an entity, a collector like White Castle, does get that informed consent, that informed consent is good for the future, provided nothing changes, which is similar to the facts cases that Your Honor pointed out. So White Castle is effectively asking the wrong question here. It is not correct to ask, did the collector take control of a person's biometrics? That doesn't make sense because a yes answer doesn't make the person agree, like perhaps it would in a claim involving a data breach. The purpose of the act is not to remedy any loss of control. It is to prevent a data breach from happening in the first place. So the breach is not what gives rise to the claim. So, in other words, Latrina Cattrone couldn't bring a statutory claim just by alleging that White Castle or a third party, another third party, took control of her data. The act does not prohibit a collector from taking control. It permits it after certain conditions are met, and that is the informed consent regime. So the correct question is, did the collector fail to educate the person and get the person's permission before engaging in any collection or dissemination of biometrics? A yes answer does make the person aggrieved. So that is the relevant analysis, and it holds true, it's the same at every instance of collection or dissemination. There's no basis to take another step and inquire, well, wait a minute, did the person lose control, or to what degree, or so forth. And again, if the practices remain the same from the collector's standpoint, they may continue to collect, store, disseminate into the indefinite future. Here, the allegations are that each time White Castle took and disseminated Latrina Cattrone's data, it repeatedly deprived her of the right to information. That each time White Castle took and disseminated her data, it repeatedly denied her the right to choose to say no. And of course, all these rights work in conjunction with the duties required under the statute, particularly the duty on the collector to safeguard the data. Here, White Castle's theory would not only take away rights from the person whose data is being collected, but it would relieve themselves of the duty to mitigate or to safeguard the data. So, under the trial court's ruling, the collector retains all the incentives to take action to comply with the statute if it didn't in the first instance, because it would stop the claim from accruing, and it also would serve the purpose of the statute. So, for example, if we went back in time to 2008, let's say White Castle realized it made a mistake after, let's say, one month of the first unlawful collection or dissemination that runs afoul of the statute, it could have then provided Latrina Cattrone with the proper disclosures and requested her consent, and at that time, she could have considered the information, she could have asked questions on how are they protecting the data now. If she's dissatisfied, she could have stopped any further collection in the future, she could have stopped any further dissemination in the future, and also she could have taken some perhaps corrective measures, asked White Castle to destroy the data before any breach as a prophylactic measure. Because after all, the Miller case correctly teaches us that the longer a third party has data, the more there's a risk, the greater the risk that there's some unknown possible future risk of harm like a data breach, like it being compromised. And of course, White Castle could have taken these measures in 2009, 2010, or at any time before it finally attempted to comply in 2018. But under White Castle's theory, after the first illegal collection or dissemination back in 2008, it had no restrictions on what it could do with the data in spite of the rapidly changing technology in this area, and never inform her of any facts on what it is doing with her data in terms of who it has decided to disseminate the data to, when, for how long, how frequently, how it's physically doing it, what safeguards are in place, and how is it physically storing that data, and what safeguards are in place. In other words, under that theory, there's no incentive to mitigate the conduct or a safeguard going forward. There's every incentive to do the opposite, to essentially keep the person in the dark, make decisions on their behalf, and not safeguard, which goes contrary to the purposes of the Act, which is designed to encourage transparency, honesty, instill confidence, and perhaps most of all, ensure safeguards are in place. A plain reading of the text fulfills those goals as the legislature intended. We firmly believe the trial court got it right, but as Your Honor has mentioned, the court could decide this is more appropriately resolved by the Illinois Supreme Court, given the lack of, I would say, concrete guidance in this particular area. We believe the requirements of Rule 52 certification are present. Counsel is correct. There are two appeals right now dealing with this same issue that are pending before two districts of the Illinois Appellate Court, and there's also a case that is fully briefed on a somewhat related statute of limitations question. It's actually been fully briefed for, I believe, 10 months now. White Castle, we have to note in its petition to appeal, indicated that the question here is uncertain at the Illinois appellate level. The trial court indicated its belief that the question will likely ultimately be decided by the Illinois Supreme Court. I think that fairly reflects what other trial courts are thinking. Your Honor is correct. Many cases have been removed to federal court under the COPA jurisdiction. Even in the Illinois system, there's only been a handful of trial court cases to address the issue. The parties dispute the accrual question. Obviously, that's why we're here, but there's no dispute. This involves a statute. An Illinois statute is governed entirely by the text of that statute. The procedural law of Illinois, it's probably outcome determinative here. It certainly is with many, many other cases. No precedent directly on point. Very limited precedent even on related topics. It is important. Counsel acknowledges that. So do I. It's important not just because of the cases, but more broadly to the citizens of Illinois and to its policymakers and, frankly, to biometric collectors on how they're going to address this concern in the future. It also bears noting the Illinois Supreme Court is taking a fairly active role when it comes to this statute. They appear to be granting appeals, even though in the broader sense, they only grant review in I think it's one or two percent of the cases. It seems to be virtually, if not all cases, they're asked to decide under this particular statute. A certification of the question would ensure consistency, would ensure finality. It would ensure that there's no conflicts, not only in the results, but the reasoning, how we get to the results between the state system and the federal system. So we would respectfully ask the court to affirm or because the elements we believe are present for Rule 52 certification, we would ask that the court certify the question to the Illinois Supreme Court in its sound discretion. Mr. Zuros, before you wrap up, if I could ask you the same question that I asked your opponent, and that is, do you see any distinction under Illinois accrual law between a subsection B violation and the accrual rule that applies to an unlawful collection of biometric data without consent and the subsection D violation and unlawful disclosure, whether based on the single publication rule or some other feature of Illinois accrual law? I believe under the text both require informed consent at the time of the events, and you look to the informed consent regime in conjunction with the act, the conduct, in either taking the data or disseminating it. No, I understand that the informed consent requirement applies in both subsections of the statute, but the question is whether the substance of the claim in a subsection D violation, which is the unlawful disclosure or redisclosure section as compared to subsection B, which is the unlawful collection, whether the one-and-done argument that White Castle is advancing here applies with greater force for a subsection D violation, whether by virtue of the single publication rule or otherwise? We believe that the one-and-done proposed rule applies with the same effect for both, and that is not at all. So we do not see that distinction, Your Honor. And that would be because? It is because the same principles apply to collection without informed consent that apply to any dissemination without informed consent. We don't see the distinction between the two concepts. All right, thank you. Ms. Siebert, your time had expired. I'll give you one minute if you have any brief thoughts in rebuttal. We can't hear you. Apologies. I got it. I'm sorry about that. This court can decide this question based on Rosenbach and Westbend. All of those choices occur once. This court can interpret BIPA based on that case law. It does not need to certify a question. There is no appellate court conflicting authority, and the fact that there are pending appeals, as in State Farm v. Pate, should indicate to the court that that will give the Illinois Supreme Court ample opportunity to revisit that subject if it chooses to do so. At some level, as Pate notes, there's always going to be uncertainty about how a state Supreme Court might decide a case, but that uncertainty is not enough to warrant certification. BIPA should not be read to impose catastrophic damages and to bankrupt Illinois employers, and that's what a per-use, per-disclosure interpretation of BIPA will do. All right. Thank you very much. Our thanks to both counsel. The case is taken under advisement. --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/argument%3A77586. Public record. Not legal advice.