Illinois Appellate Court Clarifies BIPA Statutes of Limitations

On September 17, 2021, the First District of the Illinois Appellate Court — which covers appeals from Cook County, Illinois — addressed a hotly contested issue under the Illinois Biometric Information Privacy Act (BIPA): which statutes of limitations apply to BIPA claims? In Tims v. Black Horse Carriers, Inc. (2021 IL App (1st) 200563), the court concluded that a five-year limitations applies to some BIPA claims and a one-year limitations period applies to others.

There is no statute of limitations in BIPA which has led to litigation over which limitations period under Illinois law should apply to BIPA claims. In Tims, the plaintiff, a former employee of defendant, filed a class action complaint alleging that defendant did not comply with certain BIPA provisions in connection with its so-called biometric time clocks. The defendant moved to dismiss, arguing these claims were untimely under Illinois’ one-year limitation period for “slander, libel or for publication of matter violating the right of privacy” under 735 ILCS 5/13-201. The trial court denied the motion, concluding instead that the Illinois “catch-all,” five-year limitation period under 735 ILCS 5/13-205 for “all civil actions not otherwise provided for” applied to the plaintiff’s BIPA claims.

On interlocutory appeal, the Illinois appellate court held that both periods — one-year and five-years — apply, depending on the specific alleged BIPA violation.

In particular, the Court held that the five-year statute of limitations applies to BIPA claims alleging failure to develop a publicly available retention and destruction schedule (Section 15(a)); collecting biometrics without written notice and release (Section 15(b)); and failing to take reasonable care in storing, transmitting, and protecting biometric data (Section 15(e)).

By contrast, claims for improper disclosure (Section 15(d)) and improperly selling, leasing, trading or otherwise profiting from biometrics (Section 15(e)) are subject to a one-year statute of limitations because such claims, according to Tims, involve “publication” of biometrics that implicate Illinois’ one-year statute of limitations.

The Tims decision thereby endorses two potential sets of limitations periods, even within the same complaint. Certain of the most common BIPA claims — failure to maintain and comply with a publicly available retention policy under Section 15(a), and failure to provide written notice and receive written consent under Section 15(b) — are afforded a lengthier limitations period of five years, whereas improper disclosure claims under Section 15(d) must be brought within one-year. Further, Tims suggests that “multiple recoveries of liquidated damages” could be recovered for each BIPA subsection violated (2021 IL App (1st) 200563, ¶ 30.)

The Tims appellate court decision is not the last word on this statute of limitations issue. The defendant, which was supported on appeal by the Illinois Chamber of Commerce, could seek a discretionary appeal to the Illinois Supreme Court. Additionally, this same issue is now before the Illinois Appellate Court’s Third District in Marion v. Ring Container Technologies, LLC (though Marion is stayed pending the Illinois Supreme Court’s decision in McDonald v. Symphony Bronzeville Park LLC regarding the applicability of the Illinois Workers’ Compensation Act to certain BIPA claims). The Tims court also did not address when BIPA claims accrue (regardless of the limitations period), an issue pending before the federal Seventh Circuit Court of Appeals in Cothron v. White Castle System, Inc. This accrual issue, too, may be headed to the Illinois Supreme Court as a certified question.

Meanwhile, companies doing business in Illinois that use biometric devices should continue to consider potential BIPA obligations. Virtually all trial courts to have addressed the issue applied the five-year statute of limitations to all BIPA subsections. Thus, a silver lining in an otherwise pro-plaintiff decision is the ruling that a one-year statute of limitations applies at least to some BIPA claims. However, because under Tims, that one-year limitation does not apply to BIPA’s most frequently litigated provisions (Sections 15(a) and 15(b)), the tide of BIPA class action lawsuits should continue to flood Illinois state and federal court dockets.