The Illinois appellate court finally issued its long-awaited ruling in Tims v. Black Horse Carriers [1] regarding the applicable statute of limitations for claims under Illinois' Biometric Information Privacy Act (BIPA). [2] The question before the court concerned which limitations period should apply to BIPA claims: Illinois' "catch-all," five-year limitations period set forth in 735 ILCS 5/13-205 (Section 205) or the one-year limitations period utilized in actions involving a publication "violating the right to privacy" under 735 ILCS 5/13-201 (Section 201). The court ultimately split the baby, concluding that claims under BIPA Sections 15(c) and (d) are subject to the one-year limitations period, while claims under BIPA Sections 15(a), (b), and (e) enjoy the longer five-year limitations period.
Illinois Statutes of Limitation: Section 205 vs. Section 201
BIPA, itself, does not specify a limitations period. Under Illinois law, if a statutory civil cause of action does not specify a limitations period, it will typically assume a "catch all" five-year limitations period under Section 205. However, if another statute of limitations is "specifically applicable," Illinois courts will apply that statute's limitations period. [3] Thus, the Tims court had to determine whether a statute of limitations "specifically applicable" to BIPA claims already existed or whether the default period should apply.
Black Horse Carriers, Inc. (and other defendants litigating this issue) argued that Section 201, which expressly applies to "[a]ctions in slander, libel or publication of matter violating the right of privacy" and provides for a one-year limitations period, "specifically applied" to BIPA claims because (1) BIPA is, first and foremost, a privacy statute, and (2) BIPA prohibits the publication of biometric information to third parties.
The Tims Court Applies Both Limitations Periods
1. BIPA claims receiving the Section 205 statute of limitation period
In its analysis, the Tims court placed great weight on the term "publication" in Section 201, finding that it "does not encompass all privacy actions but only those where publication is an element or inherent part of the action." [4] Applying this to BIPA, the court explained that the law imposes a number of duties, at least three of which do not involve publication or dissemination of protected information. In particular, the court ruled that there is no publication element involved in the requirements of Section 15(a), Section 15(b), or Section 15(c) to BIPA.
Section 15(a) requires entities collecting biometric information to develop and comply with a written policy, retention schedule, and destruction guidelines. Section 15(b) requires notices informing the owner of the biometric information of the purpose and length of time the information will be stored. Section 15(e) requires entities collecting biometric information to adequately store, transmit, and protect that information. Because these obligations do not involve publishing or disseminating information, Section 201 is inapplicable to claims alleging violations of these duties, and the catch-all, five-year limitations period under Section 205 applies.
2. BIPA claims receiving the Section 201 statute of limitation period
On the other hand, where BIPA has clear publication elements, the one-year limitations period for claims involving the "publication of matter violating the right of privacy" applies under Section 201. The Tims court concluded that Section 15(c) and Section 15(d) of BIPA involve such publication. Section 15(c) prohibits the sale lease, trade, or profit from biometric data, and Section 15(d) places a prohibition on disclosing or otherwise disseminating biometric data absent required consent or a court order. Accordingly, the one-year statute of limitation under Section 201 is applicable to allegations that these sections were violated.
Additional Considerations
BIPA has far reaching application given its broad definition of biometric information; the expanding collection of such information by organizations; and the act's private right of action, which has enabled the filing of hundreds of class actions in recent years. The bifurcated application of limitations periods further reinforces the importance of immediately addressing compliance practices, including auditing vendor and other third-party contracts where applicable.
Notably, the Tims court did not have occasion to consider when a claim under BIPA accrues. This issue is currently before the Seventh Circuit in Cothron v. White Castle. [5] The Seventh Circuit heard oral arguments in Cothron on September 14, which focused largely on whether the Seventh Circuit should decide the accrual issue or certify the question to the Supreme Court of Illinois. Troutman Pepper's Cybersecurity, Information Governance, and Privacy Practice Group will continue to monitor Cothron and other cases shaping the development of biometric legislation and litigation.
[1] Tims v. Black Horse Carriers, Inc., 2021 IL App (1st) 200563.
[2] 740 ILCS 14/1, et seq.
[3] Stauffer v. Innovative Heights Fairview Heights, LLC, No. 3:20-CV-00046-MAB, 2020 WL 4815960, at *11 (S.D. Ill. Aug. 19, 2020).
[4] 2021 IL App (1st) 200563, ¶ 29.
[5] No. 20-3202.
