Today, the Illinois Supreme Court issued a long-awaited and highly-anticipated decision in Tims v. Black Horse Carriers, Inc., which is sure to have a long-term ripple effect on litigation under the Illinois Biometric Information Privacy Act (“BIPA”) going forward. With no dissenting opinion, the Supreme Court reversed the Illinois First District Appellate Court’s decision applying two separate statutes of limitation depending on the section under which a plaintiff’s BIPA claim is brought. The Supreme Court held instead that the five-year catchall statute of limitations period contained in the Illinois Code of Civil Procedure applies to all BIPA claims. Specifically, the Supreme Court held that two separate statutes of limitation go against Illinois public policy and could cause an “unclear, inconvenient, inconsistent, and potentially unworkable regime” for BIPA litigation.

BIPA itself does not contain a statute of limitations. As a result, parties have often disputed which Illinois limitations period properly applies. In Tims, the plaintiff allegedly worked for Defendant Black Horse Carriers, Inc. from June 2017 to January 2018 and filed an amended complaint in March 2019 on behalf of himself and a putative class of similarly situated individuals. Plaintiff alleged that, by scanning employee fingerprints, Black Horse violated three sections of BIPA: Section 15(a), by failing to institute and maintain a retention schedule for biometric data; Section 15(b), by failing to obtain written consent prior to obtaining biometric data; and Section 15(d), for disclosing or disseminating biometric data without first obtaining consent.

Black Horse filed a motion to dismiss the plaintiff’s amended complaint, arguing that plaintiff’s claim was time-barred as it was filed outside the one-year statute of limitations for “privacy actions” contained in 735 ILCS 5/13-201. Plaintiff countered that the five-year catchall limitation period in 735 ILCS 5/13-205 applied and that his claims were timely.

The First District analyzed the particular language of the Illinois Code of Civil Procedure and held that the one-year limitations period contained in Section 13-201 applied only where “publication” was a necessary element of the claim. In particular, the First District noted that Section 13-201 sets a one-year limitations period for “[a]ctions for slander, libel or for publication of matter violating the right of privacy.” Conversely, where publication is not a necessary element of the BIPA claim, the First District held that the catchall five-year limitations period for “all civil actions not otherwise provided for” in Section 13-205 applied.

Based on this reasoning, the First District held that BIPA violations alleged under Sections 15(c) and 15(d), for which publication or disclosure of biometric data is a necessary element of the claim, have a one-year statute of limitations. Since actions alleging violations of Sections 15(a), (b), and (e) do not require proof of publishing or disclosure, the First District reasoned that the five-year limitations period properly applied.

Although the Supreme Court acknowledged that claims under Sections 15(c) and (d) of BIPA involve publication and the one-year statute of limitations under Section 13-201 could plausibly apply, the Court nevertheless held that the intent of the legislature matters. Because BIPA itself does not contain its own statute of limitations, the Supreme Court determined that the legislature intended for the five-year catchall limitations period to apply because it was “not otherwise provided for.” Further, the Court noted that the legislature’s concerns in protecting biometric information were better accomplished through application of the five-year statute.

Notably, the Supreme Court did not opine on the issue of when exactly a plaintiff’s claim accrues under BIPA. The First District noted that the Tims plaintiff argued that the BIPA violation was ongoing due to continuous scans of his fingerprint, but the issue was left alone in both the First District’s and Supreme Court’s decisions. The issue of claim accrual under BIPA is set to be decided in another case pending before the Supreme Court, Cothron v. White Castle, which was argued in May 2022. In other words, Cothron will determine whether damages are available for each individual BIPA violation (for example, scans of an employee’s fingerprint to clock in and out of work every day), which could lead to astronomical damages.

Key Takeaways:

  • The Tims decision provides putative plaintiffs up to five years to file a claim under any section of BIPA.
  • Tims provides precedent for courts to apply the five-year limitations period to any statute not containing its own limitations period.
  • The issue of when BIPA claims accrue is still open and pending decision in Cothron v. White Castle.
  • Until a decision in Cothron v. White Castle, the starting and ending point of calculating the statute of limitations is still very much up in the air.

Dykema’s team is experienced in handling BIPA-related counseling and litigation. For more information, please contact Melanie Chico or Abad Lopez.

For information regarding Dykema’s Privacy and Data Security Team, please contact Cindy Motley.

To sign up for Dykema’s The Firewall Blog e-mail updates, please click here. For information regarding our Blog, please contact our Blog editors: Dante Stella and Jennifer Torrez.