On September 17, 2021, the Illinois Appellate Court held that a one-year statute of limitations applies to causes of action alleging violations under sections 15 (c) and (d) of the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (BIPA), while a five-year limitations period applies to those alleging violations of sections 15 (a), (b), and (e). 

BIPA, Generally

In 2008, Illinois enacted BIPA to regulate the collection, use and storage of biometric data. In short, BIPA requires private entities to (1) obtain informed, written consent from individuals prior to collecting their biometric information and (2) develop a written, publicly available policy on retention and destruction of such information (collectively, sections 15(a), (b), and (e)). BIPA also prohibits entities from profiting from the biometric data and permits only a limited right to disclosure of the information (collectively, sections 15(c) and (d)). 

BIPA creates a private right of action for individuals “aggrieved” by a violation of the statute. After roughly seven years of inactivity, BIPA-related litigation has grown exponentially since 2015. While the statute provides guidelines for companies collecting biometric data, its practical application in the court system has been much less clear. Recently, one of the most significant questions was addressed by the First District: What is the statute of limitations for BIPA claims? 

The Ruling

In Tims v. Black Horse Carriers, Inc., the First District considered whether the limitations period in 735 ILCS 5/13-201 (governing privacy claims) or the limitations period in 735 ILCS 5/13-205 (default, catch-all provision) applies. Section 13-201 establishes a one-year limitation period for “[actions] for slander, libel or for publication of matter violating the right of privacy.” By contrast, section 13-205 provides a five-year limitations period for, in relevant part, “all civil actions not otherwise provided for” by statute. 

The Tims court held that the one-year limitations period applies to actions brought pursuant to sections 15(c) and (d) of BIPA, while the five-year limitations period applies to those brought under sections 15(a), (b), and (e). 

The court reasoned that BIPA imposes various duties on private entities and, though all relate to protecting biometric data, each duty is separate and distinct. Section 13-201 does not encompass all privacy actions, but only those where publication is an element or an inherent part of the action. Under BIPA, the only two sections that concern publication are 15(c) and 15(d). 

Implications

Interestingly, this decision comes on the heels of a recent decision by the Illinois Supreme Court that also discussed privacy violations in connection with BIPA, albeit in the context of an insurance coverage dispute. In West Bend Mutual Ins. Co. v. Krishna Schaumburg Tan Inc., the Illinois Supreme Court ruled that an insurer must defend a tanning salon against a customer’s BIPA proposed class action, because in alleging oral or written publication of a person’s biometric data, it alleged a privacy violation that was potentially covered under the salon’s general liability policy. 

These two cases provide clarity as to the interplay between BIPA and existing privacy statutes. This clarity is particularly relevant, as most BIPA lawsuits allege a panoply of violations under section 15. However, we may expect more targeted and exacting complaints by plaintiffs – particularly related to whether (and when) there was a “publication” of an individual’s biometric information. In light of Tims and Krishna, these “publication” allegations will not only have an impact on potential insurance coverage under commercial general liability policies but also be subject to the shortened, one-year statute of limitations. 

The “Each Violation” Unanswered Question

Finally, the First District’s ruling touched on another significant question plaguing BIPA litigation – whether a BIPA “violation” occurs each time a person’s biometric information is collected, or only the first time. This question has very real implications for the scope of potential damages in BIPA claims. 

As this question was not certified before the Tims court, it was not addressed directly; however, the court’s Opinion does provide some insight. The court interpreted section 15 of BIPA as creating five separate duties under sections 15(a)-(e), respectively. While section 20 allows a prevailing party to recover for “each violation,” the court suggested that this refers to each violation of a duty – which potentially could cap the number of violations. However, again, this issue and its application in the class action context will require additional clarity from the courts before it is certain. 

Notably, the issue remains an open question, currently on appeal to the U.S. Circuit Court of Appeals for the Seventh Circuit (Latrina Cothron v. White Castle System Inc.).