On February 2, 2023, the Illinois Supreme Court ruled in the widely watched Tims v. Black Horse Carriers, Inc. case and unanimously held a five-year statute of limitations applies to all causes of action alleging violations under all sections of the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (BIPA). The decision partially overruled the Illinois Appellate Court for the First District, which held a one-year statute of limitations applied to causes of action under sections 15(c) and (d) of BIPA, while a five-year statute of limitations applied to causes of action under sections 15(a), (b) and (e). Many companies and insurers were hoping the Illinois Supreme Court would find the one-year statute of limitations applied to all BIPA claims, thereby helping to curtail the explosion of BIPA class action lawsuits and limit the skyrocketing damages.

Background

In 2008, Illinois enacted BIPA to regulate the collection, use and storage of biometric information, defined as a biological measurement or physical characteristic that can be used to identify individuals, such as fingerprint mapping, facial recognition and retina scans. BIPA creates a private right of action for individuals “aggrieved” by a violation of the statute.

• Section 15(a) of BIPA requires private entities to develop written, publicly available policies that establish procedural safeguards for the retention and destruction of individuals’ biometric data.

• Section 15(b) prohibits the collection of biometric data without the individual’s informed, written consent.

• Section 15(c) regulates and prohibits entities from profiting from collected biometric data.

• Section 15(d) permits the disclosure or dissemination of biometric data under a limited right that requires an individual’s consent.

• Section 15(e) regulates the storage of biometric data and requires entities to enact stringent protections for collected biometric data.

The Ruling

In Tims, the Illinois Supreme Court held the five-year limitations period applies to all causes of action under BIPA, rejecting the First District’s bifurcated approach, which applied a one-year limitations period to sections (c) and (d) and a five-year limitations period to sections (a), (b) and (e).

In its opinion, the Illinois Supreme Court considered whether to apply the one-year limitations period governing privacy claims (735 ILCS 5/13-1301), or the five-year limitations period commonly referred to as a “catch-all” provision (735 ILCS 5/13-205). The court’s analysis primarily focused on policy considerations and legislative intent. The court reasoned that because BIPA’s text does not provide for its own limitations period, applying two different limitations periods could confuse litigants about when claims are time-barred, such as when a plaintiff has two or more causes of action arising out of the same set of facts. Accordingly, the court presumed that legislative intent is to avoid “absurd, inconvenient, or unjust consequences,” and applied the five-year limitations period found in section 13-205’s catch-all provision.

The Tims decision also rejected the First District’s conclusion that because the disclosure of biometric data is akin to the “publication” element under defamation claims, the one-year statute of limitations should apply to causes of action under sections 15(c) and (d). The First District found sections 15(c) and (d), which contain the words “sell,” “lease,” “trade,” “disclose” and “disseminate,” involved publication, which is a critical element in defamation torts – such as libel and slander, which are subject to the one-year limitation found in 735 ILCS 5/13-201.

The Illinois Supreme Court acknowledged that publication could be an inherent part of causes of action under sections 15(c) and (d), but ultimately held that considerations of public policy, legislative intent and the absence of clarity within the statute weighed in favor of applying section 13-205’s five-year default limitations period. According to the court, the Illinois Legislature concluded that the public at large is hesitant to provide biometric information when it relates to finances and other personal information. Also, aggrieved individuals are less likely to discover evidence of BIPA violations compared with defamation torts because individuals may or may not discover they have been aggrieved under BIPA. Accordingly, the five-year limitation period allows aggrieved parties sufficient time to discover BIPA violations.

Further Considerations

Under the legal standard for analyzing the applicability of limitation periods, the Supreme Court must focus on “the nature of the liability.” (Armstrong v. Guigler, 174 Ill. 2d 281, 291 (1996)) In Tims, the court’s opinion takes care to differentiate BIPA from defamation torts, holding that, unlike claims for defamation, a one-year limit on BIPA claims is insufficient for aggrieved individuals. The result of this holding is a significant increase in the potential number of plaintiffs seeking remedies under BIPA than if it had affirmed the First District’s opinion.

In another issue presented by BIPA in Cothron v. Whitecastle – which underwent oral argument before the Illinois Supreme Court on May 17, 2022, and is currently under advisement – the court was asked to consider whether a BIPA “violation” occurs each time a person’s biometric data is collected, or only the first time. Once it is published, the Cothron opinion will indicate the extent of liability private entities are likely to face in the aftermath of the Tims ruling.