In a ruling that is unlikely to significantly alter the landscape of litigation under the Illinois Biometric Information Privacy Act (“BIPA” or the “Act”) (740 ILCS 14/1 et seq.), the Illinois Supreme Court recently clarified that a five-year statute of limitations is applicable to all claims under the Act.  The Supreme Court’s holding in Tims, et al. v. Black Horse Carriers, Inc. clarifies the applicable statute of limitations period for BIPA claims, but does not address the critical question of when claims accrue under the Act.

The Tims, et al. v. Black Horse Carriers, Inc. Decision  

In the Tims case, Plaintiff Jorome Tims sued Black Horse Carriers, Inc. (“Black Horse”) in March 2019, alleging that Black Horse violated BIPA when it scanned the fingers of its employees, including plaintiff, for timekeeping purposes.^[1] Specifically, the Plaintiffs alleged that Black Horse violated Sections 15(a), (b), and (d) of the Act.  Those sections of the Act place both restrictions and affirmative obligations on private entities related to biometric identifiers (such as fingerprints, voiceprints, retinal scans and facial geometry) and biometric information (e.g., information based on biometric identifiers to the extent used to identify an individual), including the following:

• Private entities in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for destroying the information.  740 ILCS 14/15(a).

• Private entities which collect, capture, purchase, receive or otherwise obtain biometric identifiers or biometric information must first inform the subject of that fact in writing, as well as the specific purpose and length of time for which the information will be retained, and must obtain a written release executed by the subject.  740 ILCS 14/15(b).   

• Private entities are prohibited from selling or disclosing biometric identifiers or biometric information, subject to certain exceptions.  740 ILCS 14/15(d).

Notably, the Act contains no provision as to the applicable statute of limitations.  Therefore, Black Horse moved to dismiss the complaint, arguing that the one-year limitations period applied for privacy actions under Section 13-201 of the Illinois Code of Civil Procedure (the “Code”).  The one-year limitations period established by Section 13-201 applies to “actions for slander, libel or for publication of matter violating the right of privacy.”  735 ILCS 5/13-201.  Plaintiffs argued that the five-year limitations period should apply to the Act, for all civil actions where no statute of limitations is otherwise provided, as stated under Section 13-205 of the Code.  See 735 ILCS 13/201 and 13/205.  The trial court denied Black Horse’s motion to dismiss and found that a five-year limitations period applied to claims under the Act.

On appeal, the Illinois Appellate Court found that different statutes of limitations applied to different sections of the Act.  Specifically, the Appellate Court found that a one-year statute of limitations applied to Plaintiffs’ claim under Section 15(d) and that a five-year statute of limitations applied to Plaintiffs’ claims under Sections 15(a) and (b).   

The Illinois Supreme Court affirmed in part and reversed in part the Appellate Court’s decision.  As an initial matter, the Supreme Court took issue with the application of two distinct limitation periods and held that “applying two different limitations periods or timebar standards to different subsections of section 15 of the Act would create an unclear, inconvenient, inconsistent, and potentially unworkable regime as it pertains to the administration of justice for claims under the Act.”  Tims, 2023 IL 127801, at ¶ 21.  Having determined that a single uniform limitations period should apply, the Court engaged in a two-step analysis.

First, the Supreme Court analyzed the plain language of the Act and found that all five subsections of Section 15 prescribe rules to regulate the collection, retention, disclosure, and destruction of biometric identifiers and biometric information.  Id. at ¶ 29.  The Supreme Court then briefly analyzed the Appellate Court’s application of a five-year limitations period with respect to Sections 15(a), (b), and (e).^[2]  The Supreme Court affirmed the Appellate Court’s holding, finding that no language in those subsections involved “publication” which would have implicated the shorter one-year limitation period provided in Section 13-201 of the Code.  Turning to claims under Sections 15(c)^[3] and (d), the Illinois Supreme Court analyzed the plain language and found that a one-year statute of limitations “could” by applied to those subsections.   

Second, the Supreme Court turned away from a plain language analysis of the Act and held that “when we consider not just the plain language of section 15 but also the intent of the legislature, the purposes to be achieved by the statute, and the fact that there is no limitations period in the Act, we find that it would be best to apply the five-year catchall limitations period codified in section 13-205 of the Code.”  Id. at ¶ 32.  The Court stated that this outcome would further its goal of ensuring certainty and predictability in the administration of limitations periods that apply to causes of actions under the Act.  Id.  Additionally, the Court examined the Illinois General Assembly’s goals in enacting BIPA and found that applying a shorter limitations period would “thwart legislative intent.”  Id. at ¶ 39.   

The Tims Ruling’s Impact on Your Business

The Tims decision appears unlikely to have a significant impact on BIPA cases.  While the ruling definitively states that a five-year limitations period is applicable to claims under the Act, the practical realities of the ruling are limited.  Prior to the ruling in Tims, nearly all trial-level courts to consider the issue applied a five-year limitations period to claims under the Act.  Moreover, almost all class-wide settlements of BIPA claims have consistently applied a five-year limitations period.  As a result, the Tims ruling is unlikely to significantly impact the litigation and settlement negotiations of BIPA claims.

Notably, Tims did not completely resolve the BIPA statute of limitations issue.  Specifically, Tims did not address when a BIPA claim accrues for purposes of applying the limitations period.  The accrual issue is currently pending before the Illinois Supreme Court in Cothron v. White Castle, which the Court is expected to decide later this year.  Given BIPA’s provisions allowing awards of liquidated damages of up to $5,000 for each violation of the Act, a finding of multiple violations per day for each class member would prove catastrophic for Illinois defendants.       

Ultimately, every business should perform a critical analysis as to any business practice that potentially concerns biometrics—including employee timekeeping, identification procedures or security protocols.  The failure to fully comply with BIPA, even when such a failure results in no actual injury to an individual, may lead to significant liability.  Vedder Price attorneys are at the forefront in defending BIPA claims and counseling clients on BIPA-related policy and disclosure language.  Please contact members of our BIPA defense team or your Vedder Price attorney with any questions you may have or assistance you may need. 

FOOTNOTES

^[1] Tims subsequently amended his complaint to name Isaac Watson as an additional plaintiff and class representative. 

^[2] Section 15(e) of the Act requires a private entity in possession of biometric data to “store, transmit, and protect from disclosure all” biometric data using a reasonable standard of care.  740 ILCS 14/15(e).

^[3] Section 15(c) of the Act prohibits a private entity in possession of biometric data from selling, leasing, trading, or otherwise profiting from biometric data.  740 ILCS 14/15(c).