On September 17, 2021, in Tims v. Black Horse Carriers, Inc., the Illinois Appellate Court decided which of the state’s statutes of limitations applies to claims brought under the Illinois Biometric Privacy Act (“BIPA”). The court found that actions based on two of the law’s provisions are governed by a one-year statute of limitations, while actions based on BIPA’s three other provisions are governed by a five-year statute of limitations.

• Tims is a putative class action brought by plaintiffs Jorome Tims and Isaac Watson against their former employer, Black Horse Carriers, Inc., related to the company’s practice of scanning the fingerprints of all its employees for timekeeping and other purposes. Plaintiffs alleged that Black Horse’s conduct violated three provisions of BIPA: section 15(a), which requires entities that collect biometric data to have a written retention schedule for that data; section 15(b), which requires entities to obtain consent before collecting biometric data and to disclose certain information about their use and collection of such data; and section 15(d), which prohibits the disclosure of biometric data without the consent of the subject of the data.
  • Plaintiffs did not bring claims based on BIPA’s two other provisions—section 15(c), which prohibits leasing, selling, or otherwise profiting off of biometric data, and section 15(e), which requires entities to use reasonable care in storing and protecting biometric data—though these provisions were ultimately discussed in the case on appeal.
• Black Horse moved to dismiss plaintiffs’ action, arguing that Illinois’s one-year statute of limitations for “actions for slander, libel or for publication of matter violating the right of privacy” applied to plaintiffs’ claims. Because neither Tims nor Watson had worked for Black Horse in the year before they filed their suit, the company contended that their claims were time-barred. By contrast, plaintiffs argued that because the text of BIPA does not set out a limitations period for BIPA claims, Illinois’s catch-all five-year statute of limitations for “all civil actions not otherwise provided for” applied to their claims and that those claims were therefore timely. The trial court agreed with plaintiffs and denied Black Horse’s motion to dismiss. Black Horse moved for reconsideration. The trial court denied that motion but certified to the Illinois Appellate Court the question of which statute of limitations applies to BIPA claims.
• The appellate court began its analysis by explaining that its goal in analyzing a statute of limitations is to determine the intent of the legislature. That intent is best divined, the court said, by looking to “the plain and ordinary meaning of the statutory language.”
• The court then turned to the one-year statute Black Horse argued applied. Pointing to the one-year statute of limitations’ use of the words “for publication of matter violating the right of privacy,” the court found a one-year limitations period applies only to those claims for which “publication is an element” or otherwise an “inherent part of the action.”
• Applying this reasoning to BIPA, the court noted that while all of BIPA’s five provisions “relate to protecting biometric data,” the “duty” created by each provision is separate and distinct.” Since “disclosing or otherwise disseminating” data is only a necessary part of violating two of BIPA’s provisions—section 15(c) and 15(d)—the court held that only actions based on those two provisions are governed by a one-year limitations period. Because BIPA’s three remaining provisions—sections 15(a), 15(b), and 15(e)—can be violated without disclosure or dissemination of protected data on the defendant’s part, the court held actions based on those sections were governed by Illinois’s catch-all five-year limitations period.
• Tims is notable because it clarifies what statute of limitations applies to frequently litigated BIPA claims. Moreover, the narrower one-year statute of limitations will help BIPA defendants defend against disclosure-related BIPA claims. But Tims is also notable in that its reasoning underscores the separate nature of each of the five requirements BIPA imposes on entities that collect biometric data and clarifies that non-disclosure-related BIPA claims are subject to a more generous five-year limitations period.
• Read the Illinois Appellate Court’s full decision in Tims here.