Illinois Supreme Court Rules Five-Year Statute of Limitations Applies to All BIPA Claims

Chicago, Ill. (February 2, 2023) –  On February 2, 2023, the Illinois Supreme Court issued its long awaited opinion in Tims v. Black Horse Carriers, ruling that the five-year, catchall statute of limitations period applies uniformly to claims brought under all provisions of the Illinois Biometric Information Privacy Act (BIPA). The pivotal decision finally brings clarity to a hotly contested issue affecting hundreds of BIPA class actions that have been stayed by federal and state courts in Illinois while the high court reviewed the issue. Many of those stays are set to be lifted imminently by the trial courts, with the Tims decision ensuring the expansion of the size of putative classes and potential liabilities for Illinois businesses facing BIPA suits.

Prior to the Illinois Supreme Court’s ruling, the First District Appellate Court had determined that the five-year limitations period applied to claims brought under §§15(a), 15(b), and 15(e) of BIPA. Those provisions regulate the collection, possession, and storage of biometrics and require private entities to obtain informed consent before collecting biometrics and make publicly available a retention schedule governing the storage and deletion policies for biometric data. But the First District had held that Illinois’ one-year limitations period for traditional privacy claims applied to §§15(c) and 15(d) of BIPA, which prohibit entities from disclosing or profiting from the sale of biometrics. The First District had based its reasoning on the Illinois Supreme Court’s holding in Sekura v. West Bend Mutual Insurance Co. that “publication” includes dissemination of information to a single entity as well as the public at large. The First District thus found that claims under §§15(c) and 15(d) paired with the one-year limitations period for privacy claims because these sections of BIPA dealt with disclosure or sale to third parties.

In its Tims decision, the Illinois Supreme Court “acknowledge[d] that the one-year statute of limitations period could be applied to subsections (c) and (d),” but instead found that “it would be best to apply the five-year catchall limitations period codified in section 13-205 of the Code.” This interpretation comports with the legislative purpose of BIPA, namely “securing the public welfare, security, and safety of the public” by regulating biometrics. Furthermore, applying the five-year catchall period will “ensure certainty, predictability, and uniformity as to when the limitations period expires” in each of the five subsections of BIPA.

With the Tims ruling now on the books, BIPA watchers look next to the Illinois Supreme Court’s anticipated decision in Cothron v. White Castle, Inc., the case that will decide when BIPA claims accrue for purposes of starting the five-year time clock in which plaintiffs may sue under the statute. BIPA defendants have argued for years that a “violation” of the statute occurs the first time an individual’s data is collected – and only once – and so the five-year limitations window starts from the first time a company obtains or possesses a biometric identifier or information. Plaintiffs have asked the Illinois Supreme Court to find that a violation occurs “each time” biometrics are obtained; for example, each time an employee clocks in/out from working using a so-called “biometric” timeclock. Some plaintiffs’ lawyers have argued that this interpretation permits an award of statutory damages each time an employee uses a clock. After the decision in Tims, the court’s imminent ruling in Cothron is sure to have far-reaching implications on the potential exposures to businesses facing BIPA class actions. Stayed tuned for further updates.

Lewis Brisbois has been on the cutting edge of BIPA litigation defense and compliance services, establishing the country’s first dedicated BIPA practice, chaired by Chicago Partners Mary Smigielski and Josh Kantrow. Our BIPA team stands ready to defend businesses facing BIPA claims and assist with BIPA compliance obligations. For more information on this decision, contact the author or editors of this alert. Visit our Illinois BIPA Practice page to learn more about Lewis Brisbois’ capabilities in this area.

Author:

Michael J. Roman, Partner

Editors:

Mary A. Smigielski, Partner

Josh M. Kantrow, Partner