In a much-anticipated decision, the Illinois Appellate Court for the First District has ruled that two separate statutes of limitations apply to violations of the Illinois Biometric Information Privacy Act (“BIPA” or the “Act”). Specifically, the court in Tims v. Black Horse Carriers, Inc., 2021 IL App (1st) 200563 (Sept. 17, 2021), held that violations of Sections 15(c) and (d) of the Act must be brought within one year, while violations of Sections 15(a), (b) and (e) must be brought within five years.

The Circuit Court’s Decision

In March 2019, the Tims plaintiff filed a complaint under Section 15 of BIPA against the defendant-employer, with whom he had been employed from June 2017 to January 2018. The plaintiff alleged the defendant collected and disclosed his fingerprint data for timekeeping purposes without obtaining consent in violation of Section 15(b) of BIPA. The plaintiff further alleged that the defendant failed to have a retention and destruction policy in violation of Section 15(a) and disclosed his data in violation of Section 15(d).

In June 2019, the defendant moved to dismiss the complaint, arguing that the plaintiff’s claims were untimely. Although BIPA lacks an express statute of limitations provision, the defendant argued that the one-year limitations period of 735 ILCS 5/13-201 applied to the plaintiff’s claims. Section 13-201 provides that actions involving “publication of matter violating the right of privacy” must be brought within one year. According to the defendant, all claims brought under BIPA were grounded in protecting the right of privacy, and Section 13-201 therefore applied.

In response, the plaintiff asserted that because BIPA is devoid of a limitations provision, Illinois’ catch-all statute, 735 ILCS 5/13-205, applies. Section 13-205 imposes a five-year limitations period on “all civil actions not otherwise provided for” in the Illinois Rules of Civil Procedure. Moreover, the plaintiff argued that the defendant’s position was inapplicable because the one-year limitations period of Section 13-201 requires publication of private information, and publication is not an essential element for a BIPA violation. Neither party argued, as litigants in other BIPA cases have done, that the two-year statute of limitations under 735 ILCS 5/13-202, which applies to actions “for damages for an injury to the person . . . or for a statutory penalty,” applies to claims brought under BIPA.

The Circuit Court denied the defendant’s motion and applied the five-year limitations period to all of the plaintiff’s claims. According to the Circuit Court, because the plaintiff had brought claims under specific sections of the Act, rather than asserting a general invasion of privacy theory, Section 13-201 did not apply. The Circuit Court opted to certify the statute of limitations question, placing it before the Appellate Court.

The Illinois Appellate Court’s Decision

On Sept. 17, 2021, the Illinois Appellate Court answered the question by splitting the parties’ positions and assigning different limitations periods to different subsections of the Act. The Tims court began by assessing the plain language of Section 13-201. Noting that Section 13-201 did not apply to intrusion upon seclusion, a privacy-related tort where no private information has been communicated to any party, the court held that Section 13-201 did not “encompass all privacy actions.” Instead, the action must involve publication: “Logically, an action for something has that thing as a necessary part or element of the action.”

The court then turned to Section 15 of the Act to assess whether publication was, in fact, necessary for a plaintiff to bring a BIPA claim. The court found that it was—in part. Highlighting that each subsection of Section 15 is a “separate and distinct” duty, the court determined that Section 15 is subject to different limitations periods. Three of the five violations delineated in Section 15 “have absolutely no element of publication or dissemination.” Section 15(a) involves establishing a written retention schedule and destruction guidelines, which make no mention of publication or dissemination of biometric data. Section 15(b) involves only the collection of biometric data without written notice and release, again omitting any element of publication. And Section 15(e) pertains to taking reasonable care to store, transmit, and protect biometric data and does not implicate sharing that data with other parties. Consequently, according to the Tims court, Sections 15(a), (b), and (e) could not fall within the ambit of the one-year limitations period requiring publication, and the five-year limitations period of Section 13-205 applies.

However, the court determined that two duties identified in Section 15 did implicate publication, bringing them within the one-year limitations period. Section 15(c) prohibits a private party from selling, leasing, trading, or otherwise profiting from a person or customer’s biometric information, which according to the Tims court “entails a publication, conveyance, or dissemination of such data.” Section 15(d) prevents the disclosure and dissemination of biometric data under most circumstances and similarly implicates a “publication” of private information. As a result, the court determined that Section 13-201’s one-year limitations period applies to Sections 15(c) and (d).
 
A summary of the court’s ruling is as follows:
 

Because the plaintiff brought suit under Sections 15(a) and (b), which were held to a five-year limitations period—and Section 15(d), which was held to a one-year limitations period, the Tims court remanded the case back to the Circuit Court for further proceedings consistent with the opinion.

BIPA Litigation Post-Tims

This ruling is a victory for plaintiffs because, historically, cases generally have focused most heavily on violations of Sections 15(a) and (b), as they relate to failure to develop a written BIPA policy and failure to secure a release. Indeed, it is these two claims that can most easily be verified by an internet search, and/or by speaking with a potential plaintiff.       
        
After this ruling by the First District of the Illinois Appellate Court, eyes now turn to the Appellate Court’s Third District’s case of Marion v. Ring Container Techs., LLC, No. 3-20-0184. The Marion court is also weighing which statute of limitations period applies under BIPA. Ultimately, it is likely a matter of time before the Illinois Supreme Court addresses the question of which statute of limitations period, or periods, should apply to BIPA.