Illinois Supreme Court: All BIPA Claims Subject to Five-Year Statute of Limitations

In Tims v. Black Horse Carriers Inc., 2023 IL 127801, the plaintiff alleged his employer, which required its employees to use a fingertip scan time clock, violated BIPA by failing to institute a publicly available retention and destruction policy, failing to provide notice and obtain consent before collecting fingertip scans, and disclosing biometric information to third parties without consent. At the trial court level, the employer argued the plaintiff’s claims were barred by the one-year statute of limitations for actions based on the “publication of matter violating the right of privacy.” The trial court disagreed, concluding that Illinois’s five-year catchall limitations period applies because BIPA itself does not contain a limitations period.

The intermediate appellate court held that BIPA is governed by two statutes of limitations (with different limitations periods) depending on the type of claim at issue. The court held that the one-year limitations period for claims based on the “publication of matter violating the right of privacy” applies to BIPA claims where publication or disclosure of biometric data is an element of the claim (BIPA Sections 15(c) and (d)). But the court determined the five-year catchall limitations period applies to BIPA claims under Sections 15(a), (b), and (e) because those sections contain no words that could be defined as involving “publication.”

The employer appealed to the Illinois Supreme Court, arguing that a one-year statute should apply to all BIPA claims. Both parties agreed that the appellate court erred in applying two different statutes of limitations and requested that the Illinois Supreme Court apply a single limitations period to all BIPA claims.

The Illinois Supreme Court reversed the appellate court’s ruling in part. The court first concluded that one statute of limitations should govern all BIPA claims to prevent the “unclear, inconvenient, inconsistent, and potentially unworkable regime” of two separate limitations periods for claims under the same statute. Next, the court agreed that the catchall five-year limitations period must apply to claims under Sections 15(a), (b), and (e) because they do not involve “publication” of biometric data. While the court acknowledged that Sections 15(c) and (d) could be read to involve publication such that the one-year statute should apply, the court concluded that a five-year statute is more consistent with the legislature’s goal of protecting the public against disclosure of highly sensitive biometric information while ensuring certainty and predictability in the administration of limitations periods.

This decision resolves a seminal open question with respect to BIPA claims, but leaves open the question of when a BIPA cause of action accrues for limitations purposes. That question is at issue in another pending appeal, Cothron v. White Castle Systems. As we have previously written, in Cothron, the Illinois Supreme Court will determine whether certain BIPA claims accrue only once upon the initial collection or disclosure of biometric information, or each time a company collects or discloses biometric information. Until that issue is resolved, defendants will continue to face uncertainty regarding their potential exposure under BIPA. Businesses that collect biometric data should seek counsel to ensure they do so in compliance with BIPA and other biometric privacy regulations and to develop legal strategies for successfully resolving BIPA claims.