The Illinois Supreme Court ruled Friday in a divided opinion that employers violated the Illinois Biometric Information Privacy Act each time they collected fingerprints from an employee and disclosed that biometric information without consent.

An employer attorney said the ruling could have a devastating impact on businesses unless the state legislature takes some action in response.

The state high court’s 4-3 ruling in Latrina Cothron v. White Castle System Inc. follows its unanimous Feb. 2 decision in Tims vs. Black Horse Carriers. Inc., in which it ruled that claims under BIPA are governed by a five-year, rather than a one-year, statute of limitations.

BIPA, which has led to thousands of court cases filed against employers, primarily in Illinois but elsewhere as well, requires businesses that store biometric information to inform the subject in writing that the data is being collected or stored and the purpose and duration for which it is being collected. It also requires that businesses receive the subject’s written consent.

Illinois remains the only state that permits a private right of action in biometric cases. The 2008 law enables plaintiffs to be awarded $1,000 for each negligent violation, or $5,000 for each intentional or reckless violation.

Ms. Cothron is a manager of a White Castle restaurant in Illinois, where she has been employed since 2004, according to the ruling.

Her complaint states that shortly after her employment began, White Castle introduced a system that required its employees to scan their fingerprints to access their pay stubs and computers. A third-party vendor then verified each scan and authorized the employees’ access, the ruling said.

Ms. Cothron said the company did not seek her consent until more than a decade after the act took effect.

Her complaint argued that a new claim accrued each time she scanned her fingerprints and White Castle sent her biometric data to a third party. 

White Castle argued that claims accrue only once, when the biometric data is initially collected or disclosed.

The district court ruled in Ms. Cothron’s favor. On appeal, the 7th U.S. Circuit Court of Appeals in Chicago asked the Illinois Supreme Court to consider the case.

The majority opinion said White Castle estimates that if the plaintiff is successful and allowed to file her claims on behalf of as many as 9,500 current and former White Castle employees, class-wide damages could total more than $17 billion.

It added, however, that “this court has repeatedly held that, where statutory language is clear, it must be given effect.”

The minority opinion stated the ruling “will lead to consequences that the legislature could not have intended” and the majority’s interpretation “renders compliance with the Act especially burdensome for employers.”

Plaintiff attorney Stephan Zouras, of Stephan Zouras LLP in Chicago, said in a statement, the opinion is “well-reasoned.”

“We are extremely gratified that after three years of litigating this important issue, Ms. Cothron and the class she presents will now have an opportunity to proceed with her case and prove to a jury that White Castle disregarded their biometric privacy rights under BIPA for more than a decade.”

Defense attorneys did not respond to a request for comment.

Employer attorney Daniel S. Marvin, a partner with Kennedys Law LLP in New York, who is not involved in the case, said the majority “pretty much acknowledges that this decision could lead to absurd results.”

Mr. Marvin added that such a ruling “could effectively destroy a company.”

Daniel A. Cotter, an attorney with Howard & Howard Attorneys PLLC in Chicago who is not involved in the case, said, “My recommendation to anybody using biometric information would be to stop immediately.” He said he expects insurers to add endorsements to their policies to make it “very clear” that BIPA claims are excluded.