Continuing the trend of recognizing Illinois’ Biometric Information Privacy Act (“BIPA”) as a muscular privacy-protective statute, the Illinois Appellate Court for the First District has ruled that the most common statutory violations of BIPA are subject to a five-year statute of limitations. BIPA imposes several duties on companies that collect, store or use biometric data—e.g., fingerprints, facial geometry scans—from Illinois residents. Prevailing plaintiffs may recover liquidated damages ranging from $1,000 to $5,000 for each BIPA violation (plus attorneys’ fees), and these provisions incentivize plaintiffs’ lawyers to bring BIPA claims as class actions.

The First District’s long-awaited opinion in Tims v. Black Horse Carriers, Inc., 2021 IL App (1st) 200563 (1st Dist. Sept. 17, 2021) clarified that claims brought under section 15(b) of BIPA—which prohibits the collection or storage of biometric data without the subject’s written consent—may be brought within five years of the alleged violation. Applying a five-year statute of limitations to section 15(b)—BIPA’s most frequently litigated provision—will likely continue the avalanche of BIPA lawsuits alleging the unconsented collection of individuals’ biometric data.

Additionally, Tims ruled that Illinois five-year “catchall” statute of limitations (735 ILCS 5/13-205) also governs claims under sections 15(a) (requiring private entities to develop a publicly available BIPA policy and to establish retention and destruction protocols) and 15(e) (requiring companies to store biometric data according to a reasonable standard of care). Plaintiffs often allege section 15(a) and 15(b) claims in tandem, and thus the uniform application of a five-year limitations period to both types of claims will further encourage that popular litigation strategy.

Not all BIPA claims are subject to a five-year limitations period under Tims. Instead, two provisions—sections 15(c) and (d)—are subject to a one-year limitations period. Section 15(c) forbids companies from profiting from an individual’s biometric data, and section 15(d) prohibits the unauthorized disclosure of biometric data without the subject’s consent. The Tims court found that “publication or disclosure of biometric data is clearly an element of an action” under these two provisions. Because actions for publication of matter violating a right of privacy are governed by a one-year statute of limitations (735 ILCS 5/13-201), Tims held that claims alleging violations of section 15(c) or 15(d) must be brought within one year.

PUTTING INTO PRACTICE: In the last year, dozens of cases had been stayed pending the outcome of Tims. In the immediate term, it is likely that many courts will lift those stays and restart long-dormant BIPA cases. In opposing the lifting of such stays, defendants could argue that the courts should wait to determine whether the Illinois Supreme Court decides to take up the statute-of-limitations matter and have the final word.

In the longer term, Tims must be viewed as a victory for BIPA plaintiffs and their attorneys. Section 15(b) is the linchpin of the BIPA class action cottage industry. By making section 15(b) claims subject to a longer limitations period (five years vs. one year), Tims ensures that Illinois courts will continue to be inundated with BIPA lawsuits for the foreseeable future.

Tims may also reinitiate momentum in the Illinois General Assembly for amending the statute and inserting a one-year statute of limitations period. Earlier this year, the Illinois House proposed a bill (H.B. 559) that would have prescribed a one-year statute of limitations for all BIPA claims, but the proposed measure did not pass.