On February 2, the Illinois Supreme Court determined in Tims v. Blackhorse Carriers, Inc. that all claims under the Biometric Information Privacy Act (BIPA) have a five-year statute of limitations. This ruling clarified the longstanding question, asking when claims can be timely brought under BIPA's various subsections.

Background

BIPA is a privacy statute that prohibits, among other things, the collection and dissemination of biometric data without consent. BIPA, itself, is silent with respect to its applicable limitations period. Consequently, Illinois courts wrestled with the appropriate limitations period to apply to BIPA claims.

By ruling that a five-year statute of limitations period applies to all BIPA claims, the Illinois Supreme Court reversed the appellate court's decision that a one-year limitations period applies to claims brought under Section 15(c)'s profit restrictions and Section 15(d)'s dissemination prohibitions, while a five-year limitations period applies to Sections 15(a), 15(b), and 15(e). With this course correction, the Illinois Supreme Court provided litigants with a clear and consistent answer regarding BIPA's limitations period. As Justice Neville stated: "Two limitations periods could confuse future litigants about when claims are time-barred, particularly when the same facts could support causes of action under more than one subsection of Section 15."

The five-year limitations period aligns with Illinois' " catch-all" statute of limitations, whereas, the one-year period was borrowed from the state's statute of limitations for cases involving the publication of private data. In explaining its decision to apply the five-year period instead of the one-year period, the court reasoned that "it would thwart legislative intent to (1) shorten the amount of time an aggrieved party would have to seek redress for a private entity's noncompliance with the Act and (2) shorten the amount of time a private entity would be held liable for noncompliance with the Act."

Why This Matters

Everything comes at a cost. Although private entities can now feel more certain about the statute of limitations for BIPA claims, the degree of exposure they now face has vastly increased. The court's ruling substantially expands the timeframe within which litigants can assert BIPA claims, and in so doing, has increased the number of potential litigants, document retention costs, potential damages, and the scope of BIPA litigation generally. This increased exposure means that companies must become even more diligent in their BIPA compliance efforts.