In a victory for the plaintiffs’ bar, the Illinois Supreme Court has ruled that all claims under Illinois’s Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1, et seq., are subject to a five-year statute of limitations. For years, litigants and courts have grappled with whether BIPA claims must be brought within one, two, or five years of an alleged BIPA violation. The Court’s long-awaited decision in Tims v. Black Horse Carriers, Inc., 2023 IL 127801 (Ill. Feb. 2, 2023), puts an end to that pervasive uncertainty.

BIPA imposes several duties on companies that collect, store, or use biometric data—e.g., fingerprints, facial geometry scans—from Illinois residents. Specifically, private entities in possession of biometric data must (1) develop a publicly available written policy that includes retention and destruction protocols for such data (§ 15(a)); (2) obtain individuals’ written consent prior to collecting biometric data (§ 15(b)); (3) refrain from profiting off an individual’s biometric data (§ 15(c)); (4) refrain from disclosing biometric data without the subject’s consent (§ 15(d)); and (5) store biometric data according to a reasonable standard of care (§ 15(e)). Prevailing BIPA plaintiffs may recover liquidated damages ranging from $1,000 to $5,000 for each violation (plus attorneys’ fees), and these provisions have incentivized plaintiffs’ lawyers to file thousands of BIPA lawsuits as class actions in state and federal courts.

The Illinois Supreme Court affirmed in part and reversed in part a 2021 decision from the Illinois Appellate Court for the First District, which had held that a one-year statute of limitations period applied to violations of sections 15(c) and 15(d) of BIPA because “publication or disclosure of biometric data is clearly an element” of those claims. 2021 IL App (1st) 200563, ¶ 32. The Illinois Appellate Court in Tims also found that a five-year statute of limitations period applies to sections 15(a), 15(b) and 15(e) because “no element of publication or dissemination” exists in those claims. Id. ¶ 31. Illinois maintains a one-year statute of limitations period for acts which relate to “publication of matter” that violates a privacy right. 735 ILCS 5/13-201. And for statutes that do not contain a statute of limitations, there is a “catchall” limitations period of five-years. 735 ILCS 5/13-205.

Notably, both parties agreed that the appellate court erred in applying two different limitations periods to BIPA and asked the Illinois Supreme Court to apply either the one-year or the five-year period to the entire statute.

The Illinois Supreme Court agreed with the appellate court that sections 15(c) and 15(d) plausibly involve publication, and could fall within the one-year limitations period. But, when considered in conjunction with the intent of the legislature, and the fact that BIPA does not contain any limitations period language, the Court opted for the five-year period for all sections of BIPA. The Illinois Supreme Court concluded that a longer limitations period would further the General Assembly’s policy concerns professed in BIPA’s 2008 legislative findings. These concerns include protecting the safety of the larger public, particularly in light of the fact that the general public is weary of the use of biometrics. But the Illinois Supreme Court said nothing about the flood of BIPA litigation in recent years, or how the longer limitations period would impact the trajectory of BIPA litigation going forward.

Trial courts have stayed numerous BIPA actions pending Tims. The immediate effect of Tims on those stays may hinge on another Illinois Supreme Court BIPA case that remains pending: Cothron v. White Castle System, Inc. The Cothron case presents the related question of when a BIPA violation “accrues” for statute of limitations purposes. Tims could result in plaintiffs asking courts to lift the stays, but many cases have been stayed pending the resolution of Tims and Cothron. At the very least, Tims’ plaintiff-friendly resolution likely ensures that BIPA class actions will continue to be filed in state and federal courts—targeting employers of every size and in every industry.