​On February 2, 2023, the Illinois Supreme Court weighed in and answered a question that had previously remained uncertain and hotly contested in recent years: how long is the statute of limitations for claims under the Illinois Biometric Information Privacy Act (“BIPA”)? According to the Supreme Court, the statute of limitations is five years. In doing so, the Supreme Court reversed the decision from the Illinois Appellate Court for the First District, which applied a one-year statute of limitations for violation of the BIPA prohibitions on profiting from or disseminating an individual’s biometric information, and a five-year statute of limitations for violation of the BIPA disclosure, retention, and storage provisions. The case, captioned Tims v. Black Horse Carriers, Inc., provides needed clarity on a novel cause of action that has been vigorously litigated in recent years, both in Illinois and jurisdictions across the county.

What You Need to Know

• The scope and applicability of the Illinois Biometric Information Privacy Act (“BIPA”) have been hotly contested in state and federal courts across the country, particularly since the Illinois Supreme Court’s 2019 decision in Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, where the Court held that a BIPA plaintiff need not show any actual injury suffered in order to bring a BIPA claim against a company that improperly collects or uses biometric information from its customers or employees.
• Illinois courts have differed in their interpretations of the appropriate statute of limitations for claims under the Illinois Biometric Information Privacy Act (“BIPA”), the Illinois statute governing the collection, storage, retention, use, and destruction of biometric identifiers.
• BIPA plaintiffs have generally advocated that BIPA has a five-year statute of limitations, while defendants have argued that a one-year statute of limitations applies.

Section 15 of BIPA provides a comprehensive statutory framework governing the collection, retention, storage, and destruction of biometric identifiers and biometric information. Specifically, section 15(a) regulates the establishment, maintenance, and adherence to a retention schedule and guidelines for destroying collected biometric information. Section 15(b) requires entities to provide notice and obtain written consent before collecting or storing biometric information, and provides regulations for the notice and consent forms. Section 15(c) prohibits profiting in any way from selling an individual’s biometric information. Section 15(d) regulates the disclosure or dissemination of biometric information without consent. Section 15(e) regulates storage and protection of collected biometric information. BIPA does not include a statute of limitations for bringing a cause of action for violation of these sections.

Without a specific statute of limitations to rely upon, Illinois courts have generally applied one of two statutes of limitations to the various section 15 BIPA claims. Specifically, some courts have applied the one-year statute of limitations codified at 735 ILCS 5/13-201, which provides that “[a]ctions for slander, libel or for publication of matter violating the right of privacy, shall be commenced within one year next after the cause of action accrued.” Courts applying this one-year limitations period have generally reasoned that BIPA’s regulation of the dissemination of an individual’s biometric identifiers corresponds with an action for publishing private information. On the other hand, other courts have applied the five-year “catch-all” statute of limitations codified at 735 ILCS 5/13-205, which provides that:

actions on unwritten contracts, expressed or implied, or on awards of arbitration, or to recover damages for an injury done to property, real or personal, or to recover the possession of personal property or damages for the detention or conversion thereof, and all civil actions not otherwise provided for, shall be commenced within five years next after the cause of action accrued.

Courts applying this five-year statute of limitations have reasoned that because BIPA does not include its own statute of limitations within its provisions, its statute of limitations is “not otherwise provided for” and therefore requires application of the five-year catch-all statute of limitations.

In its February 2, 2023 decision in Tims v. Black Horse Carriers, the Illinois Supreme court weighed in and addressed this issue. In Tims, plaintiffs brought a class action lawsuit against their former employer, Black Horse Carriers (“Black Horse”) for violating (1) section 15(a) of BIPA, providing for the retention and deletion of biometric information, and (2) sections 15(b) and 15(d) of BIPA, providing for the consensual collection and disclosure of biometric identifiers and biometric information, when it scanned the plaintiff's fingerprints. Black Horse moved to dismiss plaintiffs’ claim, arguing that it was time-barred by the one-year statute of limitations for privacy-related actions in 735 ILCS 5/13-201. The trial court disagreed, holding that the five-year limitations period in 735 ILCS 5/13-205 applied to plaintiffs’ BIPA claims.

Upon Black Horse’s interlocutory appeal, the appellate court held that plaintiffs’ claims were subject to both the one-year and five-year statutes of limitations. Specifically, the appellate court applied the one-year period to plaintiffs’ section 15(c) and 15(d) claims, reasoning that those claims deal with the publication of private information and therefore invoke the language of 735 ILCS 5/13-201. On the other hand, the appellate court held that plaintiffs’ BIPA section 15(a) claim did not fit within the purview of 735 ILCS 5/13-201, and therefore invoked the five-year catch-all limitations period codified at 735 ILCS 5/13-205. The Illinois Supreme Court subsequently accepted Black Horse’s petition for leave to appeal in order to resolve the issue.

The Supreme Court concluded that all BIPA section 15 claims are subject to the five-year catch-all statute of limitations. In doing so, the Supreme Court declared that section 15 should be governed by one statute of limitations. According to the Court:

Two limitations periods could confuse future litigants about when claims are time-barred, particularly when the same facts could support causes of action under more than one subsection of section 15. For example, a plaintiff could have a cause of action under section 15(a) (failing to publicize a written policy regarding its collection of biometric information), which would have a five-year limitations period under the appellate court's analysis, and subsection (c) (prohibiting an entity's ability to sell or profit from a person's biometrics), which would have a one-year limitations period under the appellate court's analysis.

Consistent with Illinois principles of statutory interpretation requiring that courts interpret statutes so as to provide clarity and avoid unjust or untenable results, the court therefore reversed the appellate court’s decision to apply two separate statutes of limitations to section 15 BIPA claims.

Turning to the issue of which of the two limitations periods to apply, the Court looked to the stated purpose of BIPA, which is to regulate “the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” 740 ILCS 14/5(g). Further, and while the Court noted that sections 15(c) and (d) could be construed as regulating “publication” of information within the purview of the one-year statute of limitations of 735 ILCS 5/13-201, the application of a one-year limitations would conflict with the purpose of BIPA and preclude aggrieved parties from obtaining the remedies BIPA was enacted to provide. Citing the comments from the Illinois legislature in enacting BIPA, the Court noted that “[a]n overwhelming majority of members of the public are weary of the use of biometrics when such information is tied to finances and other personal information.” Further, “[t]he full ramifications of biometric technology are not fully known” and “[b]iometrics are unlike other unique identifiers that are used to access finances or other sensitive information.” Given the legislature’s intent to protect the public from harm through the transmission of biometric identifiers, the Court held that a one-year statute of limitations was not appropriate and that the longer, five-year catch-all limitations period would better serve the legislature’s intentions.

While clarifying an important issue concerning BIPA, the Supreme Court’s decision in Tims may pose problems for businesses that have failed to comply with BIPA’s requirements, in that a longer statute of limitations may create larger class sizes and higher statutory damages figures for BIPA litigation. Further, the Tims decision represents another windfall to the plaintiff’s bar in this area. Indeed, over the past four years, Illinois state and federal courts have held that (1) a plaintiff need not show actual damages in order to sustain a BIPA claim (Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186), (2) the Illinois Workers’ Compensation Act does not preempt a BIPA claim when related to employment (McDonald v. Symphony Bronzeville Park LLC, 2020 IL App (1st) 192398), and (3) that the Federal Railway Safety Act, the Interstate Commerce Commission Termination Act, and the Federal Aviation Administration Authorization Act do not preempt a BIPA claim (Rogers v. BNSF Railway Company, No. 19-C-3083, 2022 WL 787955 (N.D. Ill. Mar. 15, 2022) (slip copy)). Together with Tims, these cases create substantial obstacles for defendants facing BIPA litigation not only in Illinois, but across the county as well.

The next major BIPA issue to be decided may be whether each time an individual scans their biometric identifier creates a separate, distinct BIPA violation for damages and statute of limitations purposes. Indeed, that is the issue expected to be decided in Cothron v. White Castle, which was fully briefed and argued to the Illinois Supreme Court in the spring of 2022. If the Court holds that each time an individual submits a biometric identifier creates a stand-alone cause of action, this will further tip the scales in favor of BIPA plaintiffs and create another hurdle for BIPA defendants.

The Cybersecurity and Privacy group at Saul Ewing LLP will continue to monitor these and other relevant decisions affecting BIPA.