In a highly anticipated decision, the Illinois Appellate Court finally clarified the correct application of the statute of limitations under the state’s Biometric Information Privacy Act (BIPA). In Tims v. Black Horse Carriers Inc., Ill. App. Ct., 1st Dist., No. 1-20-563 (9/17/21), the court ruled that a five-year limitations period applies to some claims, and a one-year deadline applies to other claims.

Specifically, the five-year period applies to all BIPA claims that assert (1) unlawful collection of biometric data without written notice, or (2) issues relating to storing or transmitting it, or (3) claims involving the company's failure to develop a publicly available retention and destruction schedule. Meanwhile, the one-year statute of limitations period applies to BIPA claims that allege (1) improper disclosure or (2) improper sale, lease, trade, or profit from biometric data. 

This long-awaited decision provides much-needed clarity for businesses and entities involved in the collection or processing of biometric data that impacts Illinois residents. This clarification by the Illinois Appellate Court  provides more certainty with respect to when potential claims can be deemed untimely.

The Illinois Appellate Court in its opinion wrote that Section 13-201 doesn’t encompass all privacy actions, but “only those where publication is an element or inherent part of the action.” Improper disclosure and improper sale of biometrics involve an element of publication, the court wrote, meaning the one-year statute of limitations period applies under Section 13-201.