KD Alert: Cook County Circuit Court Decides that a Five Year Statute of Limitations Applies to BIPA Cases

By Stefan R. Dandelles, co-managing partner of the KD Chicago office, and Jean Y. Liu, attorney located in KD Chicago 

The much litigated Illinois Biometric Information Privacy Act (“BIPA”) does not contain an express statute of limitations. BIPA imposes requirements on companies that collect “biometric information” such as fingerprints and confers a private right of action by natural persons who are “aggrieved by violation of [BIPA]” against a private entity that negligently, intentionally, or recklessly violates BIPA’s provisions. In light of there being no express statute of limitations, the plaintiff’s bar has argued that a five year statute of limitations under 735 ILCS 5/13-205 applies, while the defense bar has argued that either a one year statute of limitations under 735 ILCS 5/13-201 or alternatively, a two year statute of limitations under 735 ILCS 5/13-202 applies.

On July 31, 2019, a Cook County Circuit Court judge ruled in Robertson v. Hostmark Hospitality Group, 2019 Ill. Cir. LEXIS 119, that a five year statute of limitations applies to claims brought under BIPA. In Robertson, the plaintiff filed a putative class action, arguing that beginning in 2010, as a condition of his employment, he was required to scan his fingerprint for timekeeping purposes, and that by requiring him to provide his fingerprint, the defendants violated BIPA’s informed consent and disclosure provisions. The Robertson defendants filed a motion to dismiss arguing in part that the plaintiff’s claims were barred by one of three statutes of limitations.

The court first examined the defendants’ argument that a one year statute of limitations applies under 735 ILCS 5/13-201 (providing that “[a]ctions for slander, libel or publication of matter violating the right of privacy, shall be commenced within one year next after the cause of action accrued”). Rejecting application of Section 13-201, the court noted that this section applies only to privacy claims involving a publication element, and “[n]othing in the plain and unambiguous language of [BIPA] indicates that publication is a necessary element for a person to be aggrieved by a violation of [BIPA].”

The court next examined the defendants’ argument that a two year statute of limitations applies under 735 ILCS 5/13-202 (providing that “[a]ctions for . . . a statutory penalty . . . shall be commenced within 2 years next after the cause of action accrued …”). The court rejected this contention and noted instead that BIPA does not impose damages without regard to the actual damages suffered by a plaintiff. Under BIPA, a plaintiff is able to recover the greater of either actual damages or the applicable liquidated damages amount, and thus, BIPA is remedial (as opposed to penal) in nature, as it is “clearly ‘within the class of remedial statutes which are designed to grant remedies for the protection of rights, introduce regulation conducive to the public good or cure public evils.’” (internal citation omitted).

Finally, the court examined 735 ILCS 5/13-205, which provides “ . . . all civil actions not otherwise provided for, shall be commenced within 5 years next after the cause of action accrued.” The court reasoned that since neither Section 13-201 nor Section 13-202 applies, the catch-all 5 year statute of limitations must apply to BIPA.

The Robertson decision, subject of course to any possible appellate review, casts a wide net for potential BIPA liability, not long after the litigation floodgates burst open after the Illinois Supreme Court rendered its opinion in Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, finding that a technical violation of BIPA can give rise to a private right of action under same.

The attorneys in KD’s Chicago office are prepared to assist with your BIPA compliance or defense litigation needs.