BIPA Amendment Precluding Per-Scan Recovery Held Retroactive
In Clay v. Union Pacific Railroad Co., the U.S. Court of Appeals for the Seventh Circuit predicted that the Illinois Supreme Court would hold that the legislature’s amendment to the Illinois Biometric Information Privacy Act’s (BIPA) damages provision applies retroactively. Clay is a positive development for BIPA defendants because the court’s holding takes significant wind out of plaintiffs’ sails in pending individual cases and putative class actions where plaintiffs seek or threaten per-scan damages.
As our team previously discussed, the Illinois legislature amended BIPA in 2024 to restrict an individual’s damages to one recovery for repeated collections or disseminations of identical biometric data. Prior to the amendment, the threat was that of “per-scan” damages, meaning statutory damages awarded to the plaintiff for every interaction between plaintiff and biometric technology without consent.
The threat of per-scan damages was real. As the Illinois Supreme Court noted in Cothron v. White Castle, a per-scan damages theory could lead to “annihilative liability” for entities regulated by BIPA. 216 N.E.3d 918, 928 (Ill. 2023). Despite acknowledging this threat, in Cothron the Supreme Court held that the statute must be applied as written. The amendment was in direct response to the per-scan damages theory, which had real-world consequences: numerous BIPA suits were filed after Cothron expressly pursuing the per-scan damages theory, both as single-plaintiff cases and putative class actions.
No one seriously disputes that the amendment eliminated the per-scan theory of damages. Following BIPA’s amendment, if an individual used a biometric device without adequately receiving notice and giving consent, they could only potentially recover for one collection or dissemination of that data—not each time they scanned in and out of work. The open question, however, was whether the amendment eliminating the possibility of per-scan damages applied retroactively, or only to cases filed after the amendment took effect. For one of the plaintiffs at issue in Clay, the difference was between one scan or 1,500; if the latter applied, Clay alone could seek up to $7.5M in damages.
Under Illinois law, remedial changes—meaning, those dealing with remedies rather than substantive rights—apply retroactively. At least three different district courts, and several state courts, held that the amendment was not retroactive because it was a substantive change to the law, not a remedial one. Consolidating three interlocutory appeals on this common question of law, the Seventh Circuit disagreed with the district courts. The court concluded that the amendment was a remedial measure because it addresses what plaintiffs can recover, not when they can.
Moreover, and importantly, the court also emphasized the Illinois Supreme Court’s indication that damages under BIPA are themselves discretionary—the statute’s references to $1,000 for negligent violations or $5,000 for reckless violations serve as the ceiling for any statutory damages award, not the floor. It explained: BIPA “states plaintiffs are entitled to, at most, one recovery. . . . By including the qualifier ‘at most,’ the amendment indicates that plaintiffs alleging thousands of violations might not even be entitled to the full award of liquidated damages permitted.”
This part of the opinion provides helpful support for defendants in settlement negotiations and at trial. Since Cothron, BIPA plaintiffs’ counsel frequently have used the specter of “annihilative damages” to inflate their settlement demands, especially when cases approach class certification rulings and trial. Clay should help cabin what are often outrageous settlement demands by plaintiffs in BIPA class actions.
Concluding that the Illinois Supreme Court would likely find the change remedial, the Seventh Circuit held that “courts should apply the amendment to cases pending at the time the statute was enacted.” The Clay ruling applies to both individual (i.e., single plaintiff) actions like Clay, as well as putative class actions. The Illinois Supreme Court could have the final say in a different case eventually, as the statute’s retroactivity is a question of state law. Still, the opinion serves as a significant arrow in BIPA defendants’ quiver going forward.
As our team previously discussed, the Illinois legislature amended BIPA in 2024 to restrict an individual’s damages to one recovery for repeated collections or disseminations of identical biometric data. Prior to the amendment, the threat was that of “per-scan” damages, meaning statutory damages awarded to the plaintiff for every interaction between plaintiff and biometric technology without consent.
The threat of per-scan damages was real. As the Illinois Supreme Court noted in Cothron v. White Castle, a per-scan damages theory could lead to “annihilative liability” for entities regulated by BIPA. 216 N.E.3d 918, 928 (Ill. 2023). Despite acknowledging this threat, in Cothron the Supreme Court held that the statute must be applied as written. The amendment was in direct response to the per-scan damages theory, which had real-world consequences: numerous BIPA suits were filed after Cothron expressly pursuing the per-scan damages theory, both as single-plaintiff cases and putative class actions.
No one seriously disputes that the amendment eliminated the per-scan theory of damages. Following BIPA’s amendment, if an individual used a biometric device without adequately receiving notice and giving consent, they could only potentially recover for one collection or dissemination of that data—not each time they scanned in and out of work. The open question, however, was whether the amendment eliminating the possibility of per-scan damages applied retroactively, or only to cases filed after the amendment took effect. For one of the plaintiffs at issue in Clay, the difference was between one scan or 1,500; if the latter applied, Clay alone could seek up to $7.5M in damages.
Under Illinois law, remedial changes—meaning, those dealing with remedies rather than substantive rights—apply retroactively. At least three different district courts, and several state courts, held that the amendment was not retroactive because it was a substantive change to the law, not a remedial one. Consolidating three interlocutory appeals on this common question of law, the Seventh Circuit disagreed with the district courts. The court concluded that the amendment was a remedial measure because it addresses what plaintiffs can recover, not when they can.
Moreover, and importantly, the court also emphasized the Illinois Supreme Court’s indication that damages under BIPA are themselves discretionary—the statute’s references to $1,000 for negligent violations or $5,000 for reckless violations serve as the ceiling for any statutory damages award, not the floor. It explained: BIPA “states plaintiffs are entitled to, at most, one recovery. . . . By including the qualifier ‘at most,’ the amendment indicates that plaintiffs alleging thousands of violations might not even be entitled to the full award of liquidated damages permitted.”
This part of the opinion provides helpful support for defendants in settlement negotiations and at trial. Since Cothron, BIPA plaintiffs’ counsel frequently have used the specter of “annihilative damages” to inflate their settlement demands, especially when cases approach class certification rulings and trial. Clay should help cabin what are often outrageous settlement demands by plaintiffs in BIPA class actions.
Concluding that the Illinois Supreme Court would likely find the change remedial, the Seventh Circuit held that “courts should apply the amendment to cases pending at the time the statute was enacted.” The Clay ruling applies to both individual (i.e., single plaintiff) actions like Clay, as well as putative class actions. The Illinois Supreme Court could have the final say in a different case eventually, as the statute’s retroactivity is a question of state law. Still, the opinion serves as a significant arrow in BIPA defendants’ quiver going forward.
Our team is thrilled to welcome Liz Hutchinson back to Shook as a partner in our privacy and cybersecurity litigation group. Liz is a data, privacy and cyber litigator, with significant experience defending BIPA putative class actions and mass arbitrations. Liz has represented organizations of all sizes—from the Fortune 50 to startups—in bet-the-company privacy litigation. She is based in Denver but is admitted in several states, including Illinois, and is involved in litigation from coast-to-coast. She also brings the perspective of an appellate clerk to her cases, having spent six years in appellate courts prior to entering private practice, including the U.S. Court of Appeals for the Tenth Circuit, the Colorado Supreme Court, and the Colorado Court of Appeals.
