Per-Violation Damages (BIPA)
Definition
BIPA's statutory damages structure: USD 1,000 per negligent violation or USD 5,000 per intentional/reckless violation; confirmed by Cothron v. White Castle (2023) to accrue on each scan or transmission, not per person per engagement.
- Statute
- Illinois Biometric Information Privacy Act
- Negligent violation
- USD 1,000 statutory damages
- Intentional or reckless violation
- USD 5,000 statutory damages
- Confirming case
- Cothron v. White Castle, 2023
- Accrual unit
- Per scan or transmission, not per person
Common questions
Why does per-scan accrual matter so much for defendants?+
A single employee scanning a fingerprint clock daily over several years can generate thousands of separate violations under this reading, multiplying potential liability far beyond a one-time per-person penalty.
What did Cothron v. White Castle actually decide?+
The Illinois Supreme Court held that a BIPA claim accrues with each unlawful scan or transmission of biometric data, on each scan rather than just the first violation against a given individual, rejecting the argument that damages should be capped per person.
Does a plaintiff automatically receive the maximum per-violation amount?+
No. Courts and juries retain discretion in awarding statutory damages within the negligent or intentional/reckless bands, and the same ruling noted trial courts can account for due-process concerns in large aggregate awards.
Related terms
- Aadhaar Exclusion (DPDP Act S.17(2))
- Provision that exempts processing covered by the Aadhaar Act 2016 from the general DPDP Act regime, meaning UIDAI biometric data is governed...
- Adequate Country (GDPR Ch. V)
- A country that the European Commission has determined provides a level of data protection essentially equivalent to the EU's. As of mid-2026,...
- Biometric Identifier (BIPA)
- Under Illinois BIPA: a retina or iris scan, fingerprint, voiceprint, or scan of a person's hand or face geometry; distinct from 'biometric...
- Data Fiduciary (DPDP Act)
- Any person who alone or in conjunction with others determines the purpose and means of processing personal data; the DPDP Act equivalent...
- Data Protection Impact Assessment (DPIA)
- A structured risk assessment required under Article 35 before any processing that is likely to result in high risk to individuals' rights...
- Explicit Consent (GDPR)
- A higher consent standard required for special-category data processing under Article 9(2)(a): must be freely given, specific, informed, and involve an explicit...
- Real-Time Remote Biometric Identification (RTBI)
- As defined in the EU AI Act: automated identification of natural persons at a distance by comparing their biometric data to those...
- Special-Category Data (GDPR)
- Personal data revealing racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic data, biometric data for unique identification, health data,...
- Standard Contractual Clauses (SCCs)
- Pre-approved contract terms issued by the European Commission that create GDPR-compliant safeguards for cross-border data transfers to countries without an adequacy decision....