The fix for ruinous fingerprint-scan damages reaches cases already on file

How the exposure got so large

The Illinois Biometric Information Privacy Act regulates how private businesses collect and handle fingerprints, hand geometry, and similar identifiers. For a great many Illinois employers, that means one thing in particular: the timeclock at the door.

In 2023 the Illinois Supreme Court decided Cothron v. White Castle System and held that a claim accrues with every scan. Not once when the employer first took the fingerprint, but every single time an employee clocked in. Paired with the statute's liquidated damages of $1,000 for a negligent violation and $5,000 for an intentional one, the arithmetic became difficult to look at. White Castle's own exposure in that case was put at more than $17 billion.

The court that created this outcome was uneasy about it. It described the possibility of "annihilative liability" and closed its opinion by inviting the legislature to say what it actually meant about damages.

The General Assembly accepted the invitation. In August 2024 it amended section 20 to provide that a business that collects the same identifier from the same person by the same method more than once has committed a single violation, for which that person is entitled to "at most, one recovery."

The question that was left open

The amendment said nothing about whether it reached cases already on file. Thousands were. District courts split, and three of them certified the question for immediate appeal.

The stakes are easier to grasp through the plaintiffs than through the doctrine. Reginald Clay, a commercial truck driver, alleges Union Pacific had him scan his fingerprints roughly 1,500 times entering and leaving facilities. If those were intentional violations, the old reading put his individual recovery at $7.5 million. Brandon Willis filed as a putative class action, which the court noted carried a risk of billions.

What the court held

The Seventh Circuit reversed all three district courts. Illinois asks a single question about retroactivity: is the change substantive or procedural? Substantive changes define rights and duties. Procedural ones govern how a right is enforced, and Illinois treats changes to remedies as procedural, which means they apply to pending cases.

Two features of the amendment made it remedial. The legislature put it in section 20, the damages provision, and left section 15, the provision setting out what a business must actually do, entirely untouched. And the language it chose speaks only about recovery, saying an aggrieved person is entitled to "at most, one recovery under this Section."

The plaintiffs argued that turning thousands of violations into one is a matter of substance, not procedure, and one district court had agreed in a much-quoted line. The Seventh Circuit answered that the word "violation" never appears in section 15 at all. It appears only in section 20. Cothron decided when claims accrue for limitations purposes under section 15, not what "violation" means for damages under section 20.

What this means for an Illinois business

If your company uses biometric timekeeping or access control and is defending one of these cases, the damages model your counsel built before April is very likely wrong, and wrong by a large multiple. A case that looked existential may now be an ordinary defense.

Two cautions belong with that. This decision changes what a plaintiff can recover. It does not change what the Act requires, and section 15's consent, notice, retention-policy, and disclosure obligations are exactly where they were. A business that never adopted a written retention policy or never obtained written releases is still in violation; the price of that violation is simply no longer measured per scan.

Second, this is a federal court predicting how the Illinois Supreme Court would rule. That prediction is well reasoned and binding on federal district courts in Illinois, but the Illinois Supreme Court has not itself decided the question, and a state court is not bound to agree.

Where the cases stand

All three were reversed and remanded. The court noted the district courts may need to revisit subject matter jurisdiction on remand, since a dramatically smaller amount in controversy can affect whether a federal court has a case at all.