Currently pending before the Seventh Circuit Court of Appeals is the important question of when a claim under the Illinois Biometric Information Privacy Act (“BIPA”) accrues.  Cothron v. White Castle, No. 20-3202 (7th Cir.)  In another litigation CPW previously identified, a panel for the Illinois Court of Appeals recently addressed whether BIPA claims are potentially subject to a one-, two-, or five-year statute of limitations.  Tims v. Black Horse Carriers, Inc., 2021 IL App (1st) 200563 (Sep. 17, 2021).  The answer is apparently “it depends,” based on the particular claims a plaintiff asserts under the statute.

The underlying facts of the case, as with many BIPA litigations, arose in the employer-employee context.  Plaintiff filed a putative class action Complaint in March 2019.  Plaintiff alleged that he worked for Defendant from June 2017 until January 2018. Plaintiff alleged that Defendant “scanned and was still scanning the fingerprints of all employees, including Plaintiff, and was using and had used fingerprint scanning in its employee timekeeping,” in violation of BIPA.

Count I of the Complaint alleged that Defendant violated Section 15(a) of BIPA by failing to institute, maintain, and adhere to a retention schedule for biometric data.  Count II of the alleged that Defendant violated BIPA Section 15(b) by failing to obtain an informed written consent and release before obtaining biometric data. Finally, Count III of the Complaint alleged that Defendant violated BIPA Section 15(d) by disclosing or disseminating biometric data without first obtaining consent.

Defendant subsequently moved to dismiss the Complaint in its entirety, asserting that Plaintiff’s Complaint was filed outside BIPA’s limitation period.  The motion noted that BIPA itself has no limitation provision and argued that the one-year limitation period for privacy actions under Illinois Code Section 13-201 applies to causes of action under the BIPA.

Plaintiff opposed, arguing that: (1) BIPA’s purpose is (in part) to prevent or deter security breaches regarding biometric data and therefore (2) in the absence of a limitation period expressly contained in BIPA itself, the five-year period in Illinois Code Section 13-205 for all civil actions not otherwise provided for should apply.  Plaintiff also argued that the one-year limitations period applied to actions only involving publication of information—which was not implicated for all claims under BIPA

The statute of limitations issue was eventually certified to a panel of the Illinois Court of Appeals.  The Court noted at the onset that Section 15 of BIPA “imposes various duties upon which an aggrieved person may bring an action” and “[t]hough all relate to protecting biometric data, each duty is separate and distinct.”

The Court ultimately found the publication-based distinction raised in the parties’ briefing a useful construct for categorizing claims under BIPA: “[a] plaintiff could therefore bring an action under the Act alleging violations of section 15(a), (b), and/or (e) without having to allege or prove that the defendant private entity published or disclosed any biometric data to any person or entity beyond or outside itself.  Stated another way, an action under section 15(a), (b), or (e) of the Act is not an action ‘for publication of matter violating the right of privacy.’” (quotation omitted).

The end result reached was that the Court held Section 13-201 (the one-year limitations period) governs BIPA actions under Section 15(c) and (d) while Section 13-205 (the five-year limitations period) governs BIPA actions under Sections 15(a), (b), and (e).

Although the shorter limitations period adopted for BIPA claims under Section 15(c) and 15(d) is a welcome ruling for defendants named in BIPA class actions, this ruling will have a limited impact on pending and future-filed BIPA cases.  This is because with the statute’s generous liquidated damages, class actions (even if defined depending on the claim asserted to include only a 1-year period) will still potentially bring a significant payoff for determined class counsel.  The bigger question—pending before the Seventh Circuit—is when BIPA claims accrue in the first place.  For more on this, stay tuned.  CPW will be there to keep you in the loop.