American burger-slinging giant White Castle is almost certainly regretting its decisions about employee monitoring after the Illinois Supreme Court Friday issued an opinion opening the fast "food" corp up to potentially billions in fines.

In what we imagine was a gut-wrenching decision for White Castle's legal team, the court ruled

[1]PDF

in a 4-3 decision that White Castle could be held accountable for every instance in which it scanned the fingerprints of its 9,500 employees without their consent.

Illinois has [2]required companies to obtain permission before collecting or transmitting an individual's biometric data since 2008. The fine for failing to do so was between $1,000 and $5,000 per infraction, depending on the circumstances.

[3]

The case, brought by an Illinois woman who began working at White Castle in 2004, involves the use of workers' fingerprints to access pay stubs and company computers, which she said were implemented shortly after she joined.

[4]

[5]

The possibly very expensive issue at the center of the case is whether private entities — in this case the burger-slinging chain — are liable every time they collected a person's biometric data without their consent. According to court documents, White Castle only obtained permission to use its employees' fingerprints in 2018, a decade after the bill was signed.

[6]EU lawmakers argue against signing US data pact

[7]The Pentagon is shockingly bad at managing its employee smartphones

[8]Man wrongly jailed by facial recognition, lawyer claims

[9]Amnesty International Canada claims attack by China-backed forces

In court, White Castle argued that it was only on the hook for the first instance in which it collected its workers' fingerprints, and not for every instance of an employee swiping their finger to sign in for work or access records.

However, the plaintiffs in the case had maintained that the company should be held accountable for every fingerprint it had collected in the 10 years it violated state law. That could leave a bad taste in the mouth.

Any hopes the court would let the issue slide were dashed after the justices found White Castle's interpretation of the law unappetizing. The company estimates it could pay as much as $17 billion — or by our estimate, 23 billion classic sliders — as a result of the decision.

[10]

However, there remains a chance White Castle will shake the worst of the fines. While the State Supreme Court has issued an opinion on the matter, the case isn't over. And as the justices noted in their analysis, the presiding judge would possess the authority to fashion a damage award that fairly compensated class members, while deterring future violations, without the threat of what White Castle's lawyers described as "annihilative liability."

The court also suggested that the state legislature should review the law to determine if changes should be made with regard to potentially excessive damage awards.

This isn't the first time that a company has violated the state's biometric privacy protections. In 2020, Facebook — since rebranded as Meta — [11]agreed to pay $650 million to settle a class-action lawsuit for applying facial recognition software on Illinois residents without their consent. ®

Get our [12]Tech Resources



[1] https://ilcourtsaudio.blob.core.windows.net/antilles-resources/resources/e304b011-82d9-4832-9cae-d8205749a2ec/Cothron%20v.%20White%20Castle%20System,%20Inc.,%202023%20IL%20128004.pdf

[2] https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y-EEMIU@3Rcez5vgkt0LSgAAAE4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y-EEMIU@3Rcez5vgkt0LSgAAAE4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y-EEMIU@3Rcez5vgkt0LSgAAAE4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[6] https://www.theregister.com/2023/02/17/adequacy_decision_us_data_transfer/

[7] https://www.theregister.com/2023/02/13/pentagon_mobile_security/

[8] https://www.theregister.com/2023/01/03/facial_recognition_jail/

[9] https://www.theregister.com/2022/12/07/china_believed_responsible_for_amnesty_attack/

[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y-EEMIU@3Rcez5vgkt0LSgAAAE4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[11] https://www.reuters.com/article/us-facebook-privacy-lawsuit/facebook-raises-settlement-to-650-million-in-facial-recognition-lawsuit-idUSKCN24W313

[12] https://whitepapers.theregister.com/