Breaking News – Illinois Appellate Court Rules on BIPA Statute of Limitations: It’s Complicated

On September 17, 2021, the Illinois Appellate Court issued a much-anticipated decision directly addressing how long an individual has to sue under the Illinois Biometric Information Privacy Act (“BIPA”). BIPA, enacted in 2008, has brought a storm of litigation debating the intricacies of its harsh penalties for private entities that capture individual’s biometric information without strict adherence to its statutory guidelines. Notably, BIPA does not expressly contain a statute of limitations, causing confusion on how long an individual has to sue under same. In the September 17, 2021 ruling, Tims v. Black Horse Carriers (2021 IL App (1st) 200563), the First District Appellate Court held that claims brought against a private entity for failing to give notice, obtain consent, and provide a written retention policy to individuals prior to collecting their biometric information must be brought within five years. However, claims brought against a private entity for violating BIPA’s selling, disclosing, or disseminating information requirements must be brought within only one year.

BIPA regulates the capture, storage, and disclosure of individuals’ biometric identifiers (i.e., retina or iris scans, fingerprints, voiceprints, palm prints, or face geometry). In making this most recent ruling, the Court reasoned that 735 ILCS 5/13-201 provides a one-year statute of limitations only for privacy matters where publication is an element or inherent part of the action. BIPA is a privacy statute, but only two of its five requirements concern publication. Section 15(c) prohibits a private entity from selling an individual’s biometric information and Section 15(d) prohibits a private entity from disclosing or disseminating an individual’s biometric information without consent. Sections 15(c) and (d) govern the publication of an individual’s biometric information to third parties, bringing these sections squarely under the one-year statute of limitations prescribed by 735 ILCS 5/13-201.

On the other hand, the Court found that Sections 15(a), (b), and (e) of BIPA are subject to the five-year “catch-all” statute of limitations contained in 735 ILCS 5/13-205 because these sections are not rooted in publication and thus not subject to 735 ILCS 5/13-201. Section 15(a) governs establishing a written policy and adhering to a published retention schedule of collected biometric information. Section 15(b) governs the notice requirements of collecting biometric information. Finally, Section 15(e) governs storage of the biometric information collected. The Court found that a BIPA plaintiff can make allegations under Sections 15(a), (b), and (e) without making allegations rooted in publication. Accordingly, the Court found that 735 ILCS 5/13-205 (providing for the five-year statute of limitations) applies to these Sections.

Although judicial guidance surrounding BIPA’s statute of limitations is certainly welcomed, private entities need to be aware of the Court’s commentary that “a plaintiff who alleges and eventually proves violation of multiple duties [under BIPA] could collect multiple recoveries of liquidated damages.” Practically speaking, plaintiffs typically bring allegations that private entities have violated multiple sections of BIPA, such that even if part of a plaintiff’s BIPA claim were barred by 735 ILCS 5/13-201, another portion of the claim would fall within the five-year statute of limitations afforded by 735 ILCS 5/13-205. As the Tims Court has indicated that each requirement under BIPA is “separate and distinct,” it is of the upmost importance that private entities using biometric technology revisit their internal policies and procedures to confirm compliance with BIPA.

By Stefan Dandelles, Managing Partner of the KD Chicago office, Jean Liu, Attorney in KD’s Chicago office, and Sarah Suddarth, Law Clerk.