The Illinois Supreme Court settled the statute of limitations question on the Illinois Biometric Information Privacy Act (BIPA) once and for all. In Tims v. Black Horse Carriers, Inc., Illinois’s highest court held on Feb. 2 that all violations of BIPA will receive a five-year statute of limitations resolving the dispute between the trial and appellate court. The court reversed an appellate court’s holding that found a one-year statute of limitation applicable for BIPA violations involving the dissemination of biometric information and profiting from such information, while other BIPA violations received a five-year statute of limitation. 

In Tims, the plaintiff claimed that the defendant, his former employer, violated BIPA in multiple ways by failing to develop and publish a written policy for retaining and destroying biometric data); failing to obtain informed consent for access and use of a customer’s biometric data; and failing to abide by disclosure and dissemination prohibitions. The defendant argued that the Illinois Compiled Statutes provide a one-year statute of limitations for violations related to publication, defamation, and privacy, like libel or slander, so that injured parties can be swiftly made whole. The trial court found that the violations of all three sections fell within the five-year limitation period. 

On appeal, however, the appellate court distinguished which BIPA sections should receive a one-year instead of a five-year statute of limitation. The appellate court made this distinction based on whether the applicable section of BIPA contained language related to or including “publication,” due to its application being limited to “publication” of private information. Upon review, the Illinois Supreme Court agreed with the circuit court’s decision. 

In its analysis, the Illinois Supreme Court determined through statutory construction that BIPA is intended to apply a five-year limitation to all violations of the act. Further, the high court reasoned that the appellate court’s decision would be too confusing for litigants to determine whether their BIPA claims are time-barred or not. 

Given the expansion of the look-back period to five year for all possible BIPA claims, this ruling will undoubtedly increase potential liability for businesses unaware of BIPA’s prescriptions. Moreover, this ruling once again highlights the precautionary measures employers should consider implementing to ensure compliance with BIPA. By taking the steps set out in the statute, businesses are able to better inoculate themselves against potentially significant liability.