In an opinion issued yesterday in Tims et al. v. Black Horse Carriers, Inc.,^[1]the Illinois Supreme Court answered a long-unresolved question concerning the statute of limitations for claims under Illinois’s Biometric Information Privacy Act (“BIPA,” 740 ILCS 14), holding that such claims are governed by a five-year, rather than one-year, limitations period.

Background on BIPA and the Tims Litigation

The Illinois legislature enacted BIPA in 2008 to regulate the collection, retention, and use of biometric data. BIPA has proved to be very popular with plaintiffs’ class action lawyers, and BIPA claims have resulted in a number of high-value settlements and a recent $228 million jury verdict.

BIPA does not explicitly specify a statute of limitations, which produced uncertainty regarding which of three possible Illinois limitations periods applies: the one-year period applicable to “publication of matter violating the right of privacy,” 735 ILCS 5/13-201, the two-year period applicable to “an injury to the person,” 735 ILCS 5/13-202, or the “catchall” five-year period applicable to civil actions where another limitations period is not otherwise provided for, 735 ILCS 5/13-205.

In Tims, the plaintiff filed a class action complaint challenging his employer’s use of finger-scan technology for timekeeping purposes. The plaintiff alleged that the defendant violated BIPA both with respect to the requirement that private entities in possession of biometric data develop and comply with a publicly available data retention and destruction policy, and the requirement that entities provide written notice and obtain a written release before collecting biometric data.

The defendant moved to dismiss on statute of limitations grounds, arguing that the plaintiff was required to file within one year of his BIPA claim accruing because his claims related to “publication” of biometric data. The circuit court denied the motion, reasoning that because the plaintiff was alleging that the defendant had violated BIPA, rather than claiming a general invasion of his privacy or defamation, the one-year limitations period did not apply.

On interlocutory appeal, answering a certified question from the circuit court, the intermediate appellate court held that both the five-year and the one-year statute of limitations apply to BIPA, depending on the particular BIPA violation alleged. Specifically, taking an approach that both parties later agreed was incorrect, the First District Illinois Appellate Court found that the one-year limitations period applicable to publication of biometric data governs claims under section 15(c) and 15(d) of BIPA, while the five-year catchall applies to claims under sections 15(a), 15(b), and 15(e) because those claims do not require publication as an element.

The defendant appealed to the Illinois Supreme Court, and the high court accepted the appeal.

The Illinois Supreme Court’s Tims Opinion

In yesterday’s decision, the Illinois Supreme Court affirmed in part and reversed in part. It agreed with the parties that BIPA should have a uniform statute of limitations for all claims, rather than the “unclear, inconvenient, inconsistent, and potentially unworkable regime” created by deciding the limitations period on a subsection-by-subsection basis and clarified that the default five-year limitations period governs all BIPA claims.

The Tims court reached its conclusion after examining BIPA’s plain text, which it found creates liability even absent publication; considering the need for certainty and predictability; and reviewing the legislative history. With respect to the policy concerns that animated the Illinois General Assembly’s adoption of BIPA, the court cited the legislature’s “extensive consideration” of “the fears of and risks to the public surrounding the disclosure of highly sensitive biometric information.” It would thwart the General Assembly’s intent, the court reasoned, to shorten the amount of time an aggrieved party has in which to seek redress. The court also noted that while classic privacy torts, such as libel and slander, are usually discovered quickly, claims relating to biometric privacy can take a long time to discover and prosecute. In addition, the court stated, “the full ramifications of the harms associated with biometric technology is unknown.” These factors, according to the court, weighed in favor of a longer limitations period.

Takeaways

Tims is another in a line of Illinois Supreme Court decisions that have resolved heavily litigated disputes about the interpretation of the BIPA statute. It also represents yet another instance of the court declining defendants’ entreaties to construe BIPA in ways that would limit the negative impacts of BIPA litigation on businesses in Illinois and across the country.

Another, likely more significant Illinois Supreme Court opinion addressing BIPA is presumably coming soon. In Cothron v. White Castle System, Inc.,^[2]the Seventh Circuit certified the following question of state law for resolution by the Illinois Supreme Court: “Do section 15(b) and 15(d) claims accrue each time a private entity scans a person’s biometric identifier and each time a private entity transmits such a scan to a third-party, respectively, or only upon the first scan and first transmission?” The Illinois Supreme Court heard argument in May 2022, and its decision is forthcoming. In Cothron, in addition to answering the question certified by the Seventh Circuit, the Illinois Supreme Court may address (i) whether plaintiffs can recover statutory liquidated damages for each use of a biometric technology (which would increase potential exposures astronomically in some cases); and (ii) whether courts have discretion regarding whether to award statutory damages and how much to award in statutory damages.

Footnotes

[1] 2023 IL 127801 (Ill. 2023).
[2] 20 F.4th 1156 (7th Cir. 2021).