On February 2, 2023, the Illinois Supreme Court filed an opinion in Jorome Tims v. Black Horse Carriers, Inc., holding that Illinois’ Biometric Information Privacy Act (BIPA) is subject to a single, five-year statute of limitations period.

The text of BIPA does not contain a statute of limitations. The question before the Illinois Supreme Court in Tims was whether BIPA is governed by the one-year statute of limitations for actions including those “for publication of matter violating the right of privacy” or the five-year “catch-all” statute of limitations period. Previously, the Appellate Court in Tims took a bifurcated approach. It held that the one-year privacy statute of limitations applies to subsections 15(c) and 15(d) of BIPA, which prohibit the sale or disclosure of biometric information. On the other hand, it held that the five-year catch-all limitations period applies to the remaining subsections 15(a), 15(b), and 15(e), which require development and compliance with a retention policy and informed consent prior to collecting biometric information.

The Supreme Court partially reversed the Appellate Court and found that the five-year catch-all applies to all subsections. Even though the Supreme Court acknowledged that subsections 15(c) and 15(d) involve “publication,” such that the one-year statute of limitations could be applied, it refused to do so in favor of a unified approach. The Supreme Court reasoned that two limitations periods could create confusion about which BIPA claims would be time-barred while others remain viable. It also relied on Illinois caselaw applying the five-year catch-all statute of limitations where the statute giving rise to a claim did not contain a limitations period. Finally, the Supreme Court found that a longer limitations period would support the Illinois’ legislature’s goal of “regulating the collection, use, safeguarding, handling, storage, retention, and destruction” of biometric information. Since the Supreme Court’s 2019 decision in Rosenbach v. Six Flags Ent. Corp., holding that “actual injury” is not required to pursue BIPA claims, the trend of BIPA class actions has remained consistent. The Tims decision will do nothing to slow down these actions and the attendant risk of liability. Accordingly, employers should ensure that they are in strict compliance with BIPA by working with counsel to audit their current compliance practices and address any potential gaps to reduce liability exposure.