IN THE
                                SUPREME COURT
                                            OF
                          THE STATE OF ILLINOIS




                                    (Docket No. 128004)

     LATRINA COTHRON, Appellee, v. WHITE CASTLE SYSTEM, INC., Appellant.


                              Opinion filed February 17, 2023.



        JUSTICE ROCHFORD delivered the judgment of the court, with opinion.

        Justices Neville, Cunningham, and O’Brien concurred in the judgment and
     opinion.

         Justice Overstreet dissented, with opinion, joined by Chief Justice Theis and
     Justice Holder White.

OPINION

¶1       This case requires us to construe section 15(b) and 15(d) of the Biometric
     Information Privacy Act (Act) (740 ILCS 14/15(b), (d) (West 2018)) in an action
     alleging that an employer violated the Act when it repeatedly collected fingerprints
     from an employee and disclosed that biometric information to a third party without
     consent. Specifically, the United States Court of Appeals for the Seventh Circuit
     certified the following question of law to this court: “Do section 15(b) and 15(d)
     claims accrue each time a private entity scans a person’s biometric identifier and
     each time a private entity transmits such a scan to a third party, respectively, or only
     upon the first scan and first transmission?” Cothron v. White Castle System, Inc.,
     

 (7th Cir. 2021). We hold that a separate claim accrues under
     the Act each time a private entity scans or transmits an individual’s biometric
     identifier or information in violation of section 15(b) or 15(d).


¶2                                    I. BACKGROUND

¶3       We recite the facts as provided by the Seventh Circuit in its certification ruling.
     See, e.g., In re Hernandez, 

. The controversy arises from a
     proposed class action filed by plaintiff, Latrina Cothron, on behalf of all Illinois
     employees of defendant, White Castle System, Inc. (White Castle). Plaintiff
     originally filed her action in the circuit court of Cook County against White Castle
     and its third-party vendor, Cross Match Technologies. Cross Match Technologies
     removed the case to federal court under the Class Action Fairness Act of 2005 (

(d), 1453 (2018)). Plaintiff later voluntarily dismissed Cross Match
     Technologies from her action and proceeded solely against White Castle in the
     United States District Court for the Northern District of Illinois.

¶4        According to her complaint, plaintiff is a manager of a White Castle restaurant
     in Illinois, where she has been employed since 2004. Shortly after her employment
     began, White Castle introduced a system that required its employees to scan their
     fingerprints to access their pay stubs and computers. A third-party vendor then
     verified each scan and authorized the employee’s access.

¶5       Generally, plaintiff’s complaint alleged that White Castle implemented this
     biometric-collection system without obtaining her consent in violation of the Act
     (740 ILCS 14/1 et seq. (West 2018)), which became effective in 2008 (see Pub. Act
     95-994, § 1 (eff. Oct. 3, 2008)). Section 15(b) of the Act provides that a private
     entity may not “collect, capture, purchase, receive through trade, or otherwise
     obtain” a person’s biometric data without first providing notice to and receiving
     consent from the person. 740 ILCS 14/15(b) (West 2018). Section 15(d) provides




                                              -2-
     that a private entity may not “disclose, redisclose, or otherwise disseminate”
     biometric data without consent. Id. § 15(d).

¶6       Plaintiff asserted that White Castle did not seek her consent to acquire her
     fingerprint biometric data until 2018, more than a decade after the Act took effect.
     Accordingly, plaintiff claimed that White Castle unlawfully collected her biometric
     data and unlawfully disclosed her data to its third-party vendor in violation of
     section 15(b) and 15(d), respectively, for several years.

¶7       In relevant part, White Castle moved for judgment on the pleadings, arguing
     that plaintiff’s action was untimely because her claim accrued in 2008, when White
     Castle first obtained her biometric data after the Act’s effective date. Plaintiff
     responded that a new claim accrued each time she scanned her fingerprints and
     White Castle sent her biometric data to its third-party authenticator, rendering her
     action timely with respect to the unlawful scans and transmissions that occurred
     within the applicable limitations period.

¶8       The district court agreed with plaintiff and denied White Castle’s motion.
     Cothron v. White Castle System, Inc., 

, 734 (N.D. Ill. 2020).
     The court later certified its order for immediate interlocutory appeal, finding that
     its decision involved a controlling question of law on which there is substantial
     ground for disagreement.

¶9        The United States Court of Appeals for the Seventh Circuit accepted the
     certification. After determining that plaintiff had standing to bring her action in
     federal court under article III of the United States Constitution (U.S. Const., art.
     III), the Seventh Circuit addressed the parties’ respective arguments on the accrual
     of a claim under the Act. Cothron, 

. Ultimately, the Seventh
     Circuit found the parties’ competing interpretations of claim accrual reasonable
     under Illinois law, and it agreed with plaintiff that “the novelty and uncertainty of
     the claim-accrual question” warranted certification of the question to this court. 

. The Seventh Circuit observed that the answer to the claim-accrual
     question would determine the outcome of the parties’ dispute, this court could
     potentially side with either party on the question, the question was likely to recur,
     and it involved a unique Illinois statute regularly applied by federal courts. 

 at




                                             -3-
       1166. Thus, finding the relevant criteria favored certification of the question, the
       Seventh Circuit certified the question to this court. 1 

.

¶ 10        We chose to answer that question. See Ill. S. Ct. R. 20(a) (eff. Aug. 1, 1992).
       The Illinois Chamber of Commerce, Chamber of Commerce of the United States,
       Retail Litigation Center, Inc., Restaurant Law Center, National Retail Federation,
       Illinois Manufacturers’ Association, National Association of Manufacturers,
       Illinois Health and Hospital Association, Illinois Retail Merchants Association,
       Chemical Industry Council of Illinois, Illinois Trucking Association, Mid-West
       Truckers Association, and Chicagoland Chamber of Commerce were granted leave
       to file amicus curiae briefs in support of White Castle’s position. Ill. S. Ct. R. 345
       (eff. Sept. 20, 2010). The American Association for Justice, Employment Law
       Clinic of the University of Chicago Law School’s Edwin F. Mandell Legal Aid
       Clinic, NELA/Illinois National Employment Law Project, Raise the Floor Alliance,
       and Electronic Privacy Information Center (EPIC) were granted leave to file
       amicus curiae briefs in support of plaintiff’s position. 

¶ 11                                           II. ANALYSIS

¶ 12       The certified question asks: “Do section 15(b) and 15(d) claims accrue each
       time a private entity scans a person’s biometric identifier and each time a private
       entity transmits such a scan to a third party, respectively, or only upon the first scan
       and first transmission?” When answering this question, we assume, without
       deciding, that White Castle’s alleged collection of plaintiff’s fingerprints and
       transmission to a third party was done in violation of the Act.

¶ 13       Section 15(b) of the Act provides:



           1
             Several federal district courts have stayed proceedings pending a final decision from the
       Seventh Circuit in Cothron in connection with the accrual question. See, e.g., Callendar v. Quality
       Packaging Specialists International, Inc., No. 21-cv-505-SMY, 

 (S.D. Ill. Aug.
       27, 2021); Hall v. Meridian Senior Living, LLC, No. 21-cv-55-SMY, 

 (S.D. Ill.
       June 29, 2021); Roberson v. Maestro Consulting Services, LLC, No. 20-CV-00895-NJR, 

 (S.D. Ill, Mar. 17, 2021); Roberts v. Graphic Packaging International, LLC, No. 21-CV-
       750-DWD, 

 (S.D. Ill. Aug. 17, 2021); Starts v. Little Caesar Enterprises, Inc.,
       No. 19-cv-1575, 

 (N.D. Ill. Oct. 19, 2021); Treadwell v. Power Solutions
       International, Inc., No. 18-cv-8212, 

 (N.D. Ill. Dec. 2, 2021).




                                                     -4-
              “No private entity may collect, capture, purchase, receive through trade, or
          otherwise obtain a person’s or a customer’s biometric identifier or biometric
          information, unless it first:

                  (1) informs the subject or the subject’s legally authorized representative
              in writing that a biometric identifier or biometric information is being
              collected or stored;

                  (2) informs the subject or the subject’s legally authorized representative
              in writing of the specific purpose and length of term for which a biometric
              identifier or biometric information is being collected, stored, and used; and

                  (3) receives a written release executed by the subject of the biometric
              identifier or biometric information or the subject’s legally authorized
              representative.” 740 ILCS 14/15(b) (West 2018).

¶ 14      Section 15(d) of the Act provides, in relevant part, that

          “[n]o private entity in possession of a biometric identifier or biometric
          information may disclose, redisclose, or otherwise disseminate a person’s or a
          customer’s biometric identifier or biometric information unless:

                  *** the subject of the biometric identifier or biometric information or
              the subject’s legally authorized representative consents to the disclosure or
              redisclosure[.]” 

 § 15(d)(1).

¶ 15       Relevant to this case, the Act further defines the term “biometric identifier” to
       include a fingerprint and the term “biometric information” to include any
       information based on an individual’s biometric identifier used to identify that
       person. Id. § 10. The Act provides a private right of action for any person aggrieved
       by a violation of the Act. Id. § 20.

¶ 16       White Castle argues that section 15(b) and 15(d) claims can accrue only once—
       when the biometric data is initially collected or disclosed. Section 15(b) provides
       that no private entity “may collect, capture, purchase, receive through trade, or
       otherwise obtain a person’s or a customer’s biometric identifier or biometric
       information, unless it first” provides notice and receives consent as outlined in the
       rest of section 15(b). (Emphasis added.) Id. § 15(b). According to White Castle, the




                                               -5-
       “unless it first” phrase refers to a singular point in time; notice and consent must
       precede, or occur before, collection. The active verbs used in section 15(b)—
       collect, capture, purchase, receive, and obtain—all mean to gain control, an action
       that White Castle argues can only happen once under the plain meaning of those
       terms.

¶ 17       White Castle advances a similar argument for section 15(d), noting that it
       provides that no private entity “in possession of a biometric identifier or biometric
       information may disclose, redisclose, or otherwise disseminate a person’s or a
       customer’s biometric identifier or biometric information unless” the private entity
       has obtained consent or certain exceptions apply. Id. § 15(d). Thus, section 15(d)
       requires consent in order for a private entity to “disclose, redisclose, or otherwise
       disseminate” an individual’s biometrics. According to White Castle, the plain
       meaning of each verb used in section 15(d) “implicates the disclosure of biometrics
       by one party to a new, third party—said differently, a party that has not previously
       possessed the relevant biometric identifier or biometric information.” As it argues
       for section 15(b) claims, White Castle contends that occurs only on the first instance
       of disclosure or dissemination.

¶ 18       Plaintiff responds that the plain meaning of the statutory language demonstrates
       that claims under section 15(b) and 15(d) accrue every time a private entity collects
       or disseminates biometrics without prior informed consent. According to plaintiff,
       this construction is consistent with the plain meaning of the statutory language,
       gives effect to every word in the provision, and directly reflects legislative intent to
       provide an individual with a meaningful and informed opportunity to decline the
       collection or dissemination of their biometrics. It also provides an incentive for
       private entities that collect biometric information to take action to mitigate their
       conduct if they neglected to comply at first.

¶ 19       Plaintiff maintains that section 15(b) applies to every instance when a private
       entity collects biometric information without prior consent. According to plaintiff,
       the word “first” in section 15(b) modifies the words “informs” and “receives.”
       Thus, according to plaintiff, an entity violates section 15(b) when it collects,
       captures, or otherwise obtains a person’s biometrics without prior informed
       consent. Plaintiff observes that our appellate court reached the same conclusion in
       Watson v. Legacy Healthcare Financial Services, LLC, 

,




                                                -6-
       ¶ 53. Similarly, section 15(d) prohibits the disclosure, redisclosure, or
       dissemination of biometrics by a private entity “unless” that entity receives prior
       consent. Thus plaintiff argues that, under the plain language of both section 15(b)
       and 15(d), a claim accrues each time that biometric identifiers or information are
       collected or disseminated by a private entity without prior informed consent.

¶ 20       To resolve the parties’ dispute and answer the certified question, we focus on
       the language of the Act itself. The cardinal principle and primary objective in
       construing a statute is to ascertain and give effect to the intention of the legislature.
       Roberts v. Alexandria Transportation, Inc., 

. The best
       indicator of legislative intent is the statutory language itself, given its plain and
       ordinary meaning. In re Hernandez, 

. Where the language is
       clear and unambiguous, we must apply the statute without resort to further aids of
       statutory construction. Krohe v. City of Bloomington, 

 (2003).
       Only if the statutory language is ambiguous may we look to other sources to
       ascertain the legislature’s intent. 

¶ 21                                        Section 15(b)

¶ 22       Section 15(b) mandates informed consent from an individual before a private
       entity collects biometric identifiers or information. Specifically, section 15(b)
       provides that “[n]o private entity may collect, capture, purchase, receive through
       trade, or otherwise obtain a person’s or a customer’s biometric identifier or
       biometric information unless it first” obtains informed consent from the individual
       or the individual’s legally authorized representative. 740 ILCS 14/15(b) (West
       2018).

¶ 23       We agree with plaintiff that the plain language of the statute supports her
       interpretation. “Collect” means to “to receive, gather, or exact from a number of
       persons or other sources.” Webster’s Third New International Dictionary 444
       (1993). “Capture” means “to take, seize, or catch.” Id. at 334. We disagree with
       defendant that these are things that can happen only once. As plaintiff explains in
       her complaint, White Castle obtains an employee’s fingerprint and stores it in its
       database. The employee must then use his or her fingerprint to access paystubs or
       White Castle computers. With the subsequent scans, the fingerprint is compared to
       the stored copy of the fingerprint. Defendant fails to explain how such a system



                                                 -7-
       could work without collecting or capturing the fingerprint every time the employee
       needs to access his or her computer or pay stub. As the district court explained,
       “[e]ach time an employee scans her fingerprint to access the system, the system
       must capture her biometric information and compare that newly captured
       information to the original scan (stored in an off-site database by one of the third-
       parties with which White Castle contracted).” Cothron, 477 F. Supp. 3d at 732. To
       the extent White Castle is suggesting that “collection” or “capture” occurs only
       when an entity first obtains a print to store in its database—and subsequent
       authentication scans therefore cannot be collections or captures—this argument is
       belied by the position White Castle took below. White Castle acknowledges that it
       argued in its motion for judgment on the pleadings that plaintiff’s claim accrued, if
       ever, in 2008 with her first scan after the Act’s enactment. And White Castle argues
       in its brief that “there was no ‘loss of control’ under [the Act] until 2008, the first
       time she used the finger-scan technology in 2008 following [the Act’s] effective
       date.” Because White Castle first obtained a copy of plaintiff’s fingerprint years
       before this, the first scan after the Act went into effect would have been a routine
       authentication scan. A claim could have accrued upon the taking of this
       authentication scan only if it were a collection or a capture under section 15(b).
       Moreover, section 15(b)(2) of the Act distinguishes between collection and storage.
       This section provides that the private entity must notify the subject of the “length
       of term for which a biometric identifier or biometric information is being collected,
       stored, and used.” 740 ILCS 14/15(b)(2) (West 2008). That the subject must be
       notified how long his or her biometric data will be collected shows that the
       legislature contemplated collection as being something that would happen more
       than once.

¶ 24       We agree with the federal district court that “[a] party violates Section 15(b)
       when it collects, captures, or otherwise obtains a person’s biometric information
       without prior informed consent. This is true the first time an entity scans a
       fingerprint or otherwise collects biometric information, but it is no less true with
       each subsequent scan or collection.” Cothron, 477 F. Supp. 3d at 732. Our appellate
       court has reached the same conclusion, determining that “the plain language of
       [section 15(b)] establishes that it applies to each and every capture and use of
       plaintiff’s fingerprint or hand scan. Almost every substantive section of the Act
       supports this finding.” Watson, 

.




                                                -8-
¶ 25       White Castle’s suggestion that the “unless it first” phrase in section 15(b) refers
       only to the first collection of biometric information is inaccurate. Contrary to White
       Castle’s position, the “unless it first” phrase refers to the private entity’s statutory
       obligation to obtain consent or a release. See 740 ILCS 14/15(b) (West 2018)
       (prohibiting a private entity from collecting, capturing, purchasing, receiving, or
       otherwise obtaining biometric information “unless it first” obtains consent or a
       release as described by the statute). As our appellate court correctly determined, the
       “unless it first” phrase “modifies the entity’s obligations, not the triggering
       actions.” Watson, 

.


¶ 26                                       Section 15(d)

¶ 27       Similar to section 15(b), section 15(d) mandates consent or legal authorization
       before a specific action is taken. It provides that “[n]o private entity in possession
       of a biometric identifier or biometric information may disclose, redisclose, or
       otherwise disseminate a person’s or a customer’s biometric identifier or biometric
       information unless” it obtains informed consent from the individual or their legal
       representative or has other legal authorization to disclose that information. 740
       ILCS 14/15(d) (West 2018).

¶ 28        As with section 15(b), we conclude that the plain language of section 15(d)
       applies to every transmission to a third party. White Castle argues that a disclosure
       is something that can happen only once. The Seventh Circuit asserted that the plain
       meaning of “disclose” connotes a new revelation. See Cothron, 

;
       see also Webster’s Third New International Dictionary 645 (1993) (defining
       “disclose” as “to make known” or “to reveal *** something that is secret or not
       generally known”). In determining that an entity violates section 15(d) every time
       it discloses or otherwise disseminates biometric data, the district court focused on
       this section’s use of the term “redisclose.” Cothron, 477 F. Supp. 3d at 733. The
       district court agreed with plaintiff that repeated transmissions to the same third
       party are “redisclosures.” Id. As the Seventh Circuit court pointed out, however,
       the issue is not quite so simple:

          “[Cothron] reads the term ‘redisclose’ as used in section 15(d) to include
          repeated disclosures of the same biometric data to the same third party. For its
          part, White Castle offers a different interpretation of the term: a downstream



                                                -9-
           disclosure carried out by a third party to whom information was originally
           disclosed. That reading is consistent with the term ‘redisclose’ as used in other
           Illinois statutes.[2] Countering again, Cothron argues that this usage would make
           ‘redisclose’ meaningless surplusage. Section 15(d) applies to any ‘private entity
           in possession of a biometric identifier or biometric information.’ As such, a
           violation by a down-stream entity can just be called a ‘disclosure,’ making
           ‘redisclose’ redundant under White Castle’s reading. Maybe so; or maybe
           ‘redisclose’ serves to make certain that down-stream entities are subject to
           section 15(d). See Reid Hosp. & Health Care Servs., Inc. v. Conifer Revenue
           Cycle Sols., LLC, 

 (7th Cir. 2021) (noting the tension between
           the anti-surplusage canon and the belt-and-suspenders drafting approach).”
           Cothron, 

.

¶ 29       We note that, even in the dictionary relied upon by White Castle, the principal
       meaning of “redisclose” is “[t]o disclose again.” See WordSense Dictionary,
       https://www.wordsense.eu/redisclose/ (last visited Jan. 7, 2023) [https://perma.cc/
       63VU-RRTK]. Nevertheless, we do not believe that we have to specifically
       determine the meaning of “redisclose” in section 15(d) because the other terms in
       that section are broad enough to include repeated transmissions to the same party.
       “Disclose” also means to “expose to view” (Webster’s Third New International
       Dictionary 645 (1993)), and Webster’s gives as an example something happening
       more than once: “the curtain rises to [disclose] once again the lobby” (emphasis
       added) (id.). A fingerprint scan system requires a person to expose his or her
       fingerprint to the system so that the print may be compared with the stored copy,
       and this happens each time a person uses the system. Moreover, section 15(d) has
       a catchall provision that broadly applies to any way that an entity may “otherwise
       disseminate” a person’s biometric data. “Disseminate” means “to spread or send
       out freely or widely.” Id. at 656. White Castle asserts that this is something that can
       happen only once but provides no definitional support for that assertion. Thus, we

           2
            See, e.g., section 35.3(b) of the Children and Family Services Act (20 ILCS 505/35.3(b) (West
       2020) (“[a] person to whom disclosure of a foster parent’s name, address, or telephone number is
       made under this Section shall not redisclose that information except as provided in this Act or the
       Juvenile Court Act of 1987”)) and section 5 of the Mental Health and Developmental Disabilities
       Confidentiality Act (740 ILCS 110/5(d) (West 2020) (“[n]o person or agency to whom any
       information is disclosed under this Section may redisclose such information unless the person who
       consented to the disclosure specifically consents to such redisclosure”)). In its reply brief, White
       Castle lists several other Illinois statutes that use the term “redisclose” in the same manner.




                                                     - 10 -
       find that the plain language of section 15(d) supports the conclusion that a claim
       accrues upon each transmission of a person’s biometric identifier or information
       without prior informed consent.

¶ 30       We agree with the district court’s explanation of how sections 15(b) and (d) are
       violated:

          “Section 15(b) provides that no private entity ‘may collect, capture, purchase,
          receive through trade, or otherwise obtain’ a person’s biometric information
          unless it first receives that person’s informed consent. 740 ILCS 14/15(b). This
          requirement is violated—fully and immediately—when a party collects
          biometric information without the necessary disclosure and consent. Similarly,
          Section 15(d) states that entities in possession of biometric data may only
          disclose or ‘otherwise disseminate’ a person’s data upon obtaining the person’s
          consent or in limited other circumstances inapplicable here. 740 ILCS 14/15(d).
          Like Section 15(b), an entity violates this obligation the moment that, absent
          consent, it discloses or otherwise disseminates a person’s biometric information
          to a third party.” Cothron, 477 F. Supp. 3d at 730-31.

       We believe that the plain language of section 15(b) and 15(d) demonstrates that
       such violations occur with every scan or transmission.


¶ 31                             White Castle’s Other Arguments

¶ 32       We are not persuaded by White Castle’s nontextual arguments in support of its
       single-accrual interpretation. Citing Feltmeier v. Feltmeier, 

 (2003),
       White Castle maintains that under Illinois law a claim accrues when a legal right is
       invaded and an injury inflicted. White Castle maintains that this court’s decisions
       interpreting the Act define a right to secrecy in and control over biometric data and
       define the “injury” as loss of control or secrecy.

¶ 33       Citing Rosenbach v. Six Flags Entertainment Corp., 

,
       White Castle contends that the Act allows a claim for an individual’s loss of the
       “right to control” biometric information and that, once an individual loses control
       over the secrecy in his or her biometric information, it cannot be recreated, resulting
       in the loss of any confidentiality. See also West Bend Mutual Insurance Co. v.




                                               - 11 -
       Krishna Schaumburg Tan, Inc., 

 (explaining that the Act
       protects a “secrecy interest”); McDonald v. Symphony Bronzeville Park, LLC, 

 (reiterating that the Act protect an individual’s “ ‘right to privacy
       in and control over their biometric identifiers and biometric information’ ” (quoting
       Rosenbach, 

)).

¶ 34       Relying on this precedent, White Castle contends that, when a party collects or
       discloses biometric information without complying with the Act’s notice and
       consent requirements, an individual’s rights have been invaded, an injury has
       occurred, and the plaintiff may immediately sue. In other words, “the invasion and
       injury are one and the same and occurred upon [p]laintiff’s initial loss of control of
       her biometrics.” For purposes of claim accrual under sections 15(b) and 15(d),
       White Castle argues that the claim accrues only on the initial scan or transmission
       of biometric information. Because a person cannot keep information secret from
       another entity that already has it, White Castle contends that the loss of an
       individual’s right to control his or her biometrics is a “single overt act” that
       encompasses both the invasion of the interest and the infliction of the injury. See
       Feltmeier, 

. Thus, a claim under section 15(b) or 15(d) can accrue
       only the first time the information is collected or disclosed. We disagree.

¶ 35       White Castle misreads our decisions in Rosenbach, West Bend Mutual
       Insurance Co., and McDonald. As a preliminary observation, we note that none of
       those decisions involved, let alone analyzed, the question of claim accrual under
       the Act.

¶ 36       In fact, we find that Rosenbach supports our construction of sections 15(b) and
       15(d). This court recognized in Rosenbach that the Act operates to codify an
       individual’s right to privacy in and control over his or her biometric identifiers and
       information. Rosenbach, 

. Importantly, we determined in
       Rosenbach that a person is “aggrieved” or injured under the Act “when a private
       entity fails to comply with one of section 15’s requirements.” 

¶ 37       Focusing on the section 15 violation in Rosenbach, the same provision at issue
       in this case, we determined that, “[w]hen a private entity fails to comply with one
       of section 15’s requirements, that violation constitutes an invasion, impairment, or
       denial of the statutory rights of any person or customer whose biometric identifier
       or biometric information is subject to the breach.” 

 Critically, Rosenbach



                                               - 12 -
       explains that an individual raising a section 15 claim is not required to plead or
       prove actual damages because the statutory violation, “in itself, is sufficient to
       support the individual’s or customer’s statutory cause of action.” 

¶ 38       Thus, contrary to White Castle’s position, Rosenbach does not stand for the
       proposition that the “injury” for a section 15 claim is predicated on, or otherwise
       limited to, an initial loss of control or privacy. Instead, Rosenbach clearly
       recognizes the statutory violation itself is the “injury” for purposes of a claim under
       the Act, which is entirely consistent with our decision here. Our subsequent
       decisions in West Bend Mutual Insurance Co. and McDonald adhered to
       Rosenbach’s construction of the Act and similarly recognized that a claim under
       the Act is a private cause of action based exclusively on a statutory violation. West
       Bend Mutual Insurance Co., 

 (citing Rosenbach); McDonald,
       

 (citing Rosenbach).

¶ 39       Put simply, our caselaw holds that, for purposes of an injury under section 15
       of the Act, the court must determine whether a statutory provision was violated.
       Consequently, we reject White Castle’s argument that we should limit a claim under
       section 15 to the first time that a private entity scans or transmits a party’s biometric
       identifier or biometric information. No such limitation appears in the statute. We
       cannot rewrite a statute to create new elements or limitations not included by the
       legislature. Zahn v. North American Power & Gas, LLC, 

.

¶ 40       White Castle and amici supporting White Castle’s position caution this court
       against construing section 15(b) and section 15(d) to mean that a claim accrues for
       each scan or transmission of biometric information made in violation of those
       provisions. They assert that, because section 20 of the Act sets forth liquidated
       damages that a party may recover for “each violation,” allowing multiple or
       repeated accruals of claims by one individual could potentially result in punitive
       and “astronomical” damage awards that would constitute “annihilative liability”
       not contemplated by the legislature and possibly be unconstitutional. For example,
       White Castle estimates that if plaintiff is successful and allowed to bring her claims
       on behalf of as many as 9500 current and former White Castle employees, class-
       wide damages in her action may exceed $17 billion. We have found, however, that
       the statutory language clearly supports plaintiff’s position. As the district court
       observed, this court has repeatedly held that, where statutory language is clear, it




                                                - 13 -
       must be given effect, “ ‘even though the consequences may be harsh, unjust, absurd
       or unwise.’ ” (Emphasis omitted.) Cothron, 477 F. Supp. 3d at 734 (quoting
       Peterson v. Wallach, 

 (2002)).

¶ 41       This court has repeatedly recognized the potential for significant damages
       awards under the Act. Rosenbach, 

; McDonald, 

. This court explained that the legislature intended to subject private
       entities who fail to follow the statute’s requirements to substantial potential
       liability. Rosenbach, 

. The purpose in doing so was to give
       private entities “the strongest possible incentive to conform to the law and prevent
       problems before they occur.” Id. ¶ 37. As the Seventh Circuit noted, private entities
       would have “little incentive to course correct and comply if subsequent violations
       carry no legal consequences.” Cothron, 

.

¶ 42       All of that said, we generally agree with our appellate court’s recognition that
       “[a] trial court presiding over a class action—a creature of equity—would certainly
       possess the discretion to fashion a damage award that (1) fairly compensated
       claiming class members and (2) included an amount designed to deter future
       violations, without destroying defendant’s business.” Century Mutual Insurance
       Co. v. Tracy’s Treasures, Inc., 

, ¶ 72. It also appears that
       the General Assembly chose to make damages discretionary rather than mandatory
       under the Act. See 740 ILCS 14/20 (West 2018) (detailing the amounts and types
       of damages that a “prevailing party may recover” (emphasis added)); see also
       Watson, 

, ¶ 66 n.4 (concluding that damages under the
       Act are discretionary rather than mandatory). While we explained in Rosenbach
       that “subjecting private entities who fail to follow the statute’s requirements to
       substantial potential liability, including liquidated damages, injunctions, attorney
       fees, and litigation expenses ‘for each violation’ of the law” is one of the principal
       means that the Illinois legislature adopted to achieve the Act’s objectives of
       protecting biometric information (Rosenbach, 

, ¶ 36 (quoting 740
       ILCS 14/20 (West 2016))), there is no language in the Act suggesting legislative
       intent to authorize a damages award that would result in the financial destruction
       of a business.

¶ 43       Ultimately, however, we continue to believe that policy-based concerns about
       potentially excessive damage awards under the Act are best addressed by the




                                               - 14 -
       legislature. See McDonald, 

 (observing that violations of
       the Act have the potential for “substantial consequences” and large damage awards
       but concluding that “whether a different balance should be struck *** is a question
       more appropriately addressed to the legislature”). We respectfully suggest that the
       legislature review these policy concerns and make clear its intent regarding the
       assessment of damages under the Act.


¶ 44                                    III. CONCLUSION

¶ 45       In sum, we conclude that the plain language of section 15(b) and 15(d) shows
       that a claim accrues under the Act with every scan or transmission of biometric
       identifiers or biometric information without prior informed consent.


¶ 46      Certified question answered.


¶ 47      JUSTICE OVERSTREET, dissenting:

¶ 48       I respectfully disagree with my colleagues’ answer to the certified question. The
       majority’s interpretation cannot be reconciled with the plain language of the statute,
       the purposes behind the Biometric Information Privacy Act (Act) (740 ILCS 14/1
       et seq. (West 2018)), or this court’s case law, and it will lead to consequences that
       the legislature could not have intended. Moreover, the majority’s interpretation
       renders compliance with the Act especially burdensome for employers. This court
       should answer the certified question by saying that a claim accrues under section
       15(b) or 15(d) of the Act (id. § 15(b), (d)) only upon the first scan or transmission.

¶ 49        The principles guiding our analysis are set forth in Feltmeier v. Feltmeier, 

 (2003). This court held that, generally, “a limitations period
       begins to run when facts exist that authorize one party to maintain an action against
       another.” 

. Moreover, “where there is a single overt act from which
       subsequent damages may flow, the statute begins to run on the date the defendant
       invaded the plaintiff’s interest and inflicted injury.” 

. Thus, to resolve the
       question of when claims accrue under section 15(b) and (d), we must consider




                                                - 15 -
       whether plaintiff has alleged a single overt act from which subsequent damages
       may flow.

¶ 50       Two considerations inform this inquiry: (1) what interests does the Act seek to
       protect and (2) what constitutes a violation of section 15(b) or (d) under the plain
       language of those provisions? This court has addressed the first question several
       times. In Rosenbach, this court explained that “[t]he Act vests in individuals and
       customers the right to control their biometric information by requiring notice before
       collection and giving them the power to say no by withholding consent.” Rosenbach
       v. Six Flags Entertainment Corp., 

. This court further
       explained that the “precise harm” the legislature sought to prevent was an
       individual’s loss of the right to maintain biometric privacy. 

 In West Bend Mutual
       Insurance Co. v. Krishna Schaumburg Tan, Inc., 

, this court
       stated that the Act “protects a secrecy interest,” such as an individual’s right to
       “keep his or her personal identifying information like fingerprints secret.” Finally,
       in McDonald v. Symphony Bronzeville Park, LLC, 

 (quoting
       Rosenbach, 

), this court reiterated that the Act protects an
       individual’s “ ‘right to privacy in and control over their biometric identifiers and
       biometric information.’ ”

¶ 51       Turning to the language of the statute, section 15(b) requires certain disclosures
       to be made, and a written release obtained, before that entity may “collect, capture,
       purchase, receive through trade, or otherwise obtain a person’s or a customer’s
       biometric identifier or biometric information.” 740 ILCS 14/15(b) (West 2018).
       The statute thus broadly applies to any way that a private entity obtains a person’s
       or customer’s biometric information without consent. It is axiomatic, however, that
       a private entity may obtain any one type of a person’s biometric information only
       once, at least until that biometric identifier or information is destroyed. With
       subsequent authentication scans, the private entity is not obtaining anything it does
       not already have. The majority commits the same analytical error as the appellate
       court in Watson v. Legacy Healthcare Financial Services, LLC, 

.

¶ 52      The Watson court held that section 15(b) means that “an entity must inform a
       subject and receive a release ‘before’ it collects or captures. *** [T]here is no
       temporal limitation on ‘collects’ or ‘captures,’ thereby applying to the first, as well




                                               - 16 -
       as the last, collection or capture.” Id. ¶ 57. Watson’s error is in assuming that the
       private entity is collecting or capturing a person’s biometric information with every
       scan. The majority makes the same error, equating every scan with a “collection.”
       Supra ¶ 24. But this is not correct. Again, section 15(b) broadly applies to any way
       that a private entity obtains a person’s biometric identifier or information. But this
       can happen only once. Here, White Castle obtains an employee’s biometric
       identifier the first time that a fingerprint is scanned. White Castle is obviously not
       obtaining it with subsequent scans—White Castle already has it. As plaintiff
       acknowledges in her complaint, White Castle obtains an employee’s fingerprint and
       stores it in its database. The employee is then required to use his or her fingerprint
       to access paystubs or White Castle computers. With the subsequent scans, the
       fingerprint is not being obtained, it is being compared to the fingerprint that White
       Castle already has. This fact is made plain in plaintiff’s complaint. Plaintiff states,
       “Plaintiff was required to scan and register her fingerprint(s) so White Castle could
       use them as an authentication method for Plaintiff to access the computer as a
       manager and to access her paystubs as an hourly employee as a condition of her
       employment with White Castle.” (Emphasis added.) The subsequent scans did not
       collect any new information from plaintiff, and she suffered no additional loss of
       control over her biometric information.

¶ 53       The above reading of the statute is the only one consistent with the purposes of
       the Act. As this court explained in Rosenbach, the “precise harm” the legislature
       was addressing was an individual’s loss of the right to maintain biometric privacy.
       Rosenbach, 

; McDonald, 

, ¶ 24. And in
       Krishna, 

, this court stated that the Act “protects a secrecy
       interest,” such as an individual’s right to “keep his or her personal identifying
       information like fingerprints secret.” 3 An individual loses his or her privacy in and


              3
                  The majority denies that our prior cases support White Castle’s argument. The majority states
       that
            “Rosenbach does not stand for the proposition that the ‘injury’ for a section 15 claim is
            predicated on, or otherwise limited to, an initial loss of control or privacy. Instead, Rosenbach
            clearly recognizes the statutory violation itself is the ‘injury’ for purposes of a claim under the
            Act, which is entirely consistent with our decision here.” Supra ¶ 38.
       The majority assumes what it seeks to prove. The majority never explains how there is more than
       one loss of control or privacy with subsequent scans or how subsequent scans are a “statutory
       violation.”




                                                          - 17 -
       control over biometric information upon the first scan. At this point his or her
       secrecy interest is lost—he or she may no longer keep his or her personally
       identifying information a secret from the private entity. Once that entity has the
       fingerprint, there is no additional loss of control, loss of privacy, or loss of secrecy
       from subsequent scans of the same finger. This is true whether the same finger is
       scanned a few times or one million times. The individual loses control over it only
       once. Accordingly, under Feltmeier, a section 15(b) claim accrues the first time a
       scan is taken without the required disclosures and consent. There was a single overt
       act from which damages flow, because the employer did not obtain anything with
       subsequent scans that it did not already have, and the employee did not lose control
       over and privacy in her biometric information with subsequent scans.

¶ 54       Thus, I agree with White Castle’s argument on appeal: “Plaintiff’s injury under
       [section] 15(b) occurred, if at all, the first time that her biometrics were collected
       by White Castle without her consent, not each subsequent time that her finger was
       rescanned.” There is only one loss of control or privacy, and this happens when the
       information is first obtained. Indeed, the legislative findings in the Act confirm this.
       See 740 ILCS 14/5(c) (West 2018) (“[S]ocial security numbers, when
       compromised, can be changed. Biometrics, however, are biologically unique to the
       individual; therefore, once compromised, the individual has no recourse ***.”
       (Emphasis added.)). The majority tellingly never explains how there is any
       additional loss of control or privacy with subsequent scans that are used to compare
       the employee’s fingerprint with the fingerprint that White Castle already possesses.
       The majority simply asserts that every scan is a collection and therefore a violation
       of the Act. Supra ¶ 24. And this is the key flaw in the majority’s analysis: it begs—
       rather than answers—the most important question before the court.

¶ 55       The analysis is the same for section 15(d) claims. Under section 15(d), a private
       entity in possession of a person’s biometric identifier or information must obtain
       that person’s consent before it may “disclose, redisclose, or otherwise disseminate
       a person’s or a customer’s biometric identifier or biometric information.” 740 ILCS
       14/15(d) (West 2018). With respect to any one party to whom the biometric
       information is disclosed, the person loses control of her biometric identifier or
       information only once. There is no further loss of control, privacy, or secrecy with
       subsequent provision of the identical biometric information to the same party.




                                                - 18 -
¶ 56       The majority reaches the conclusion that section 15(d) includes repeated
       transmission to the same party (supra ¶ 28) only when willing to ignore (1) the
       plain meaning of the word “disclose” and (2) the way in which the Illinois
       legislature consistently uses the word “redisclose.” The word “disclose” means “to
       make known” or “to reveal *** something that is secret or not generally known”
       (Webster’s Third New International Dictionary 645 (1993)) or “[t]o make
       (something) known or public,” “to reveal” (Black’s Law Dictionary 583 (11th ed.
       2019)); see also Cothron v. White Castle System, Inc., 

 (7th Cir.
       2021) (explaining that “the ordinary meaning of ‘disclose’ connotes a new
       revelation” (citing Black’s Law Dictionary (11th ed. 2019))). With respect to a
       disclosure to any one party, this is obviously something that can happen only once.
       You can tell someone your middle name an unlimited number of times, but you can
       disclose it to them only once. Therefore, when something is “redisclosed” or
       “disclosed again,” it must be to a different party. As the Seventh Circuit explained,
       “[r]epeated transmissions of the same biometric identifier to the same third party
       are not new revelations.” Cothron, 

.

¶ 57       Although the majority holds that it need not determine the meaning of
       “redisclose” in section 15(d) (supra ¶ 28), the definition of “redisclose” found in
       the WordSense Dictionary, https://www.wordsense.eu/redisclose/ (last visited Jan.
       7, 2023) [https://perma.cc/63VU-RRTK] (“[t]o disclose again; to disclose what has
       been disclosed to the discloser” (emphasis added)) is consistent with how the term
       is used by the Illinois legislature. See Cothron, 

. As noted by the
       majority, the Seventh Circuit gave two examples: section 35.3(b) of the Children
       and Family Services Act (20 ILCS 505/35.3(b) (West 2020) (“[a] person to whom
       disclosure of a foster parent’s name, address, or telephone number is made under
       this Section shall not redisclose that information except as provided in this Act or
       the Juvenile Court Act of 1987”)) and section 5 of the Mental Health and
       Developmental Disabilities Confidentiality Act (740 ILCS 110/5(d) (West 2020)
       (“[n]o person or agency to whom any information is disclosed under this Section
       may redisclose such information unless the person who consented to the disclosure
       specifically consents to such redisclosure”)). Supra ¶ 28 n.2; Cothron, 

. In its reply brief, defendant lists several other Illinois statutes that use the
       term “redisclose” in the same manner.




                                               - 19 -
¶ 58       Thus, if we consider the plain meaning of the word “disclose” and the manner
       in which the legislature consistently uses the term “redisclose,” it is clear that
       section 15(d)’s use of the word “redisclose” does not mean repeated disclosures to
       the same party (a logical impossibility) but rather refers to downstream disclosures
       to third parties. In other words, if the party in possession of biometric information
       discloses it to a third party, consent is required before that third party rediscloses
       the information to anyone else. Plaintiff’s only response to this argument is to claim
       that this interpretation renders the word “redisclose” in section 15(d) superfluous
       or redundant, as any disclosure to a new party would be covered by the word
       “disclose.” But all that plaintiff can demonstrate with this argument is that the word
       “redisclose” is probably unnecessary in the English language (perhaps why
       Webster’s does not define it). In the other statutes quoted above, the legislature
       could have used “disclose” instead of “redisclose,” and the meaning of the
       provisions would not change. But the reality that plaintiff cannot avoid is that
       (1) the legislature consistently uses the term “redisclose” to mean “to disclose what
       has been disclosed to the discloser” and (2) a “redisclosure” to the same party is a
       logical impossibility.

¶ 59      The majority acknowledges that, in construing the Act as it has, the
       consequences may be harsh, unjust, absurd, or otherwise unwise. Supra ¶ 40. In
       doing so, the majority ignores that the construction of a statute that leads to an
       absurd result must be avoided. Mulligan v. Joliet Regional Port District, 

 (1988). Instead, a court construing the language of a statute should

          “ ‘assume that the legislature did not intend to produce an      absurd or unjust
          result’ (State Farm Fire & Casualty Co. v. Yapejian, 

          (1992)), and [should] avoid a construction leading to an         absurd result, if
          possible (City of East St. Louis v. Union Electric Co., 

          (1967)).” Hubble v. Bi-State Development Agency of the           Illinois-Missouri
          Metropolitan District, 

 (2010).

¶ 60       In considering the consequences of construing the Act one way or another and
       giving each word of the statute a reasonable meaning (Haage v. Zavala, 

), two significant consequences militate against the majority’s
       construction. First, under the majority’s rule, plaintiffs would be incentivized to
       delay bringing their claims as long as possible. If every scan is a separate,




                                               - 20 -
       actionable violation, qualifying for an award of liquidated damages, then it is in a
       plaintiff’s interest to delay bringing suit as long as possible to keep racking up
       damages. Because there is no additional loss of privacy, secrecy, or control once a
       private entity has obtained a person’s biometric information, the plaintiff loses
       nothing by waiting to bring suit until as many scans as possible are accumulated.
       This point, all by itself, should convince the majority that its interpretation is wrong.
       If, indeed, a party was losing control over his or her biometric information with
       every scan, this incentive would simply not exist.

¶ 61       Next, the majority’s construction of the Act could easily lead to annihilative
       liability for businesses. As the Seventh Circuit explained:

           “White Castle reminds us that the Act provides for statutory damages of $1,000
           or $5,000 for ‘each violation’ of the statute. § 14/20. Because White Castle’s
           employees scan their fingerprints frequently, perhaps even multiple times per
           shift, Cothron’s interpretation could yield staggering damages awards in this
           case and others like it. If a new claim accrues with each scan, as Cothron argues,
           violators face potentially crippling financial liability.” Cothron, 

.

       The majority acknowledges White Castle’s estimate that, if plaintiff is successful
       in her claims on behalf of as many as 9500 current and former White Castle
       employees, damages in this action may exceed $17 billion. Supra ¶ 40.
       Nevertheless, the majority brushes this concern aside by stating that “policy-based
       concerns about potentially excessive damage awards under the Act are best
       addressed by the legislature.” Supra ¶ 43.

¶ 62       However, we are not being asked to render a decision on the damages in this
       case or to make a policy-based decision about excessive damages. Rather, we are
       being asked to determine legislative intent by considering the consequences of
       construing the statute one way or another. Surely the potential imposition of
       crippling liability on businesses is a proper consequence to consider. When the
       plaintiff argued in the Seventh Circuit that the calculation of damages is separate
       from claim accrual, that court pointed out that plaintiff “does not explain how
       alternative theories of calculating damages might be reconciled with the text of
       section 20.” Cothron, 

. Given that plaintiff argues that every scan
       is a violation and the statute sets forth what an aggrieved person may recover for



                                                - 21 -
       “every violation,” it is certainly proper to consider the consequences of plaintiff’s
       interpretation of the statute.

¶ 63       Imposing punitive, crippling liability on businesses could not have been a goal
       of the Act, nor did the legislature intend to impose damages wildly exceeding any
       remotely reasonable estimate of harm. Rather, the legislature recognizes that the
       use of biometrics is an emerging area whose ramifications are not completely
       known and that it is in the public interest to regulate the “collection, use,
       safeguarding, handling, storage, retention, and destruction of biometric identifiers
       and information.” 740 ILCS 14/5 (West 2018). Indeed, the statute’s provision of
       liquidated damages of between $1000 and $5000 is itself evidence that the
       legislature did not intend to impose ruinous liability on businesses. Moreover, the
       majority’s interpretation would lead to the absurd result that an entity that commits
       what most people would probably consider the worst type of violation of the Act—
       intentionally selling their biometric information to a third party with no knowledge
       of what the third party intended to do with it—would be subject to liquidated
       damages of $5000, while an employer with no ill intent that used that same person’s
       fingerprint as an authentication method to allow access to his or her computer could
       be subject to damages hundreds or thousands of times that amount. This could not
       have been the legislature’s intent.

¶ 64       The majority fails to set forth any similar dire consequences with White Castle’s
       interpretation. With respect to control, the individual does not lose all control over
       his or her biometric data. Consent is still required before the private entity may
       disclose it to anyone else (id. § 15(d)), and that is the real concern once an
       individual has consented to a private entity collecting a biometric identifier or
       information. With respect to postcollection, White Castle correctly explains:

          “[T]he Privacy Act itself contains numerous provisions that serve its
          prophylactic goals even after the first collection or disclosure. Specifically,
          White Castle has a duty to safeguard information it has collected. 740 ILCS
          14/15(a), (e). White Castle has an ongoing duty to destroy any biometric data
          that current employees have already scanned, once the data’s purpose is
          fulfilled. Id. at 15(a). Section 15(c) prohibits the sale of biometrics, so any sale
          of biometrics would give rise to a new claim. Id. at 15(c). Section 15(d)
          prohibits the disclosure of biometrics to a third party without consent. Id. at




                                               - 22 -
          15(d). So disclosure of biometrics to a new third party would give rise to a new
          claim—a straightforward reading of the statute that has always been White
          Castle’s position ***.” (Emphases in original.)

       Thus, the Act very tightly regulates what private entities may do with the biometric
       information they collect, and individuals maintain a measure of control over their
       biometric data.

¶ 65        While discussing the strengths and weaknesses of each side’s argument, the
       Seventh Circuit suggested two potential problems with a single accrual rule. First,
       that court speculated that the premise that “two violations aren’t worse than one”
       may “simply be wrong.” Cothron, 

. The court speculated that
       “[r]epeated collections or disclosures of biometric data, even if by or to the same
       entity, might increase the risk of misuse or mishandling of biometric data.” 

 This
       assumes, however, that repeated scans of the same biometric identifier by the same
       entity are repeated “collections” or “disclosures,” which is a dubious proposition.
       Indeed, the Seventh Circuit itself had earlier explained that a disclosure is a “new
       revelation” and that “[r]epeated transmissions of the same biometric identifier to
       the same third party are not new revelations.” 

. Moreover, there is no
       reason to believe that subsequent scans of the same biometric identifier used for
       authentication purposes against a stored copy would increase the risk of misuse or
       mishandling of biometric data. Second, the Seventh Circuit speculated that, under
       a single accrual rule, “[o]nce a private entity has violated the Act, it would have
       little incentive to course correct and comply if subsequent violations carry no legal
       consequences.” 

. The Act, however, provides for injunctive relief. See
       740 ILCS 14/20(4) (West 2018); see also McDonald, 

       (“McDonald and the putative class sought (1) injunctive and equitable relief to
       protect their interests by requiring Bronzeville to comply with the Privacy Act’s
       requirements.”). Moreover, there is no reason to believe that an employer would
       rather be on the hook for liquidated damages to every new employee it hires rather
       than simply providing the notice and obtaining the consent that the Act requires.
       Finally, as White Castle points out:

          “Plaintiff purports to allege two violations of the Act, for up to 9,500 current
          and former White Castle employees. Even under a single accrual method,
          damages could equate to between $19 million and $95 million if Plaintiff’s




                                              - 23 -
          claims had been timely made, assuming that Plaintiff could recover separately
          under Section 15(b) and 15(d). Even under a ‘one violation per employee’
          calculation of $1,000 per employee, damages could equal $9.5 million. These
          numbers, in and of themselves, are sufficient to incentivize [Act] compliance.”

       The consequences of construing the statute to provide multiple accruals are severe,
       and neither plaintiff nor the majority has identified similar severe consequences to
       White Castle’s interpretation.

¶ 66       In sum, the Act’s legislative findings and intent show that the legislature
       recognized the utility of biometric technology and wanted to facilitate its safe use
       by private entities by regulating how it is used. See 740 ILCS 14/5(a) (West 2018)
       (“The use of biometrics is growing in the business and security screening sectors
       and appears to promise streamlined financial transactions and security
       screenings.”). The Act thus requires notice and consent before biometric
       information is collected or disclosed. To encourage compliance and to prevent and
       deter violations, the Act provides for injunctive relief and liquidated damages. I see
       nothing in the Act indicating that the legislature intended to impose cumbersome
       requirements or punitive, crippling liability on corporations for multiple
       authentication scans of the same biometric identifier. The legislature’s intent was
       to ensure the safe use of biometric information, not to discourage its use altogether.


¶ 67      CHIEF JUSTICE THEIS and JUSTICE HOLDER WHITE join in this dissent.




                                               - 24 -