Employers will now have to contend with a five-year statute of limitations for all employee claims under the Illinois Biometric Information Privacy Act (BIPA). On February 2, 2023, in Tims v. Black Horse Carriers, the Illinois Supreme Court held that a five-year statute of limitations applies to all BIPA claims—even those that are tied to the publication of an individual’s data and could presumably be subject to a one-year limitations period “for publication of matter violating the right of privacy.” The Court held that the legislative intent and purpose of BIPA, and the fact that BIPA does not have its own statute of limitations, favor all BIPA claims being subject to the state’s “catchall” five-year limitations period.
What happened
Plaintiff Tims filed a class-action complaint against his former employer, Black Horse, alleging that Black Horse violated section 15(a) of BIPA (providing for the retention and deletion of biometric information), and sections 15(b) and 15(d) of BIPA (providing for the consensual collection and disclosure of biometric identifiers and biometric information). Specifically, Tims alleged that Black Horse required its employees to use a fingerprint authentication time clock, and that Black Horse violated BIPA because it (1) failed to institute, maintain, and adhere to a publicly available biometric information retention and destruction policy required under section 15(a); (2) failed to provide notice and to obtain employees’ consent when collecting their biometrics, in violation of section 15(b); and (3) disclosed or otherwise disseminated employees’ biometric information to third parties without consent in violation of section 15(d).
Black Horse moved to dismiss the complaint as untimely, arguing that it was barred by the one-year statute of limitations in section 13-201 of the Illinois Code of Civil Procedure (Code). Black Horse argued that claims brought under BIPA concern violations of privacy, therefore the one-year limitations period in section 13-201 governing actions for the “publication of matter violating the right of privacy” should apply to such BIPA claims.
The circuit court rejected Black Horse’s argument, and denied the motion to dismiss. In doing so, the court held that violations of all three sections of BIPA were subject to Illinois’ “catchall” five-year limitations period in section 13-205 of the Code.
The appellate court, however, distinguished the applicable statute of limitations under BIPA based on the type of violation alleged. It held that violations of section 15(c) (prohibiting the sale, lease, trade or other profit from biometric information) and 15(d) (prohibiting the disclosure, redisclosure or dissemination of biometric information) were subject to the one-year limitations period in section 13-201 of the Code, while violations of section 15(a) (requiring a written policy with a retention schedule and guidelines for destroying biometric information), 15(b) (requiring notice and the specific purpose and length of collection of biometric information prior to collection), and 15(e) (requiring confidentiality and protective measures in the storage and transmission of biometric information) were subject to the five-year “catchall” limitations period in section 13-205.
What the Illinois Supreme Court said
One limitations period for all
The Illinois Supreme Court held that the five-year limitations period contained in section 13-205 of the Code governs all claims under BIPA. First, the Court said that one limitations period should govern all of BIPA, noting that two limitations periods could confuse future litigants about when claims are time-barred, particularly when the same facts support causes of action under more than one subsection of BIPA.
Sections 15(c) and 15(d) could be governed by the privacy statute of limitations
The Court then analyzed the plain language of BIPA in order to determine which limitations period should apply to each of BIPA’s subsections. The Court first addressed BIPA sections 15(a), 15(b) and 15(e), agreeing with the appellate court’s assessment that these sections contain no words that could be defined or inferred as involving publication and did not come within the purview of section 13-201’s one-year limitations period as “publication of matter” violating a privacy right. The Court found these subsections subject to the five-year “catchall” limitations period in section 13-205.
The Court then turned to sections 15(c) and 15(d) of BIPA, which contain the words “sell,” “lease,” “trade,” “disclose,” redisclose,” and “disseminate,” and acknowledged that an argument could be made that these words could be defined as involving publication, and could fall within the purview of section 13-201’s one-year limitation period as “publication of matter” violating a privacy right.
No limitations period? Illinois “catchall” applies
The Court found that because the Act does not have its own limitations period–and because certainty, predictability, and uniformity must be ensured as to when the limitations period expires in each subsection–the Act is subject to the default five-year limitations period found in section 13-205 of the Code.
The legislative intent and purposes of BIPA means a five-year limitations period
The Court then looked to the legislative intent and purposes of BIPA. The Court found that given the extensive consideration the General Assembly gave to the fears of, and risks to, the public surrounding the disclosure of sensitive biometric information, it would “thwart” the legislature’s intent to shorten the amount of time a party could seek redress for BIPA violations. The Court contrasted BIPA actions with defamation actions, noting that in cases of libel and slander, individuals are expected to quickly become aware of the injury and act when their reputation is publicly compromised, lending themselves to a one-year statute of limitations. On the other hand, it is unclear with BIPA claims when or if an individual would discover evidence of the disclosure of biometric information, short of BIPA’s protections.
Where should employers go from here?
Employers should continue to be diligent in meeting BIPA’s requirements. Though statute of limitations defenses can still be part of the defense arsenal, a five-year statute of limitations for all BIPA claims increases the risk that employees’ claims will be timely filed.
In addition, employers should watch for these other important decisions from the Illinois Supreme Court regarding BIPA.
Cothron v. White Castle System, Inc.: Whether BIPA claims accrue each time a person’s biometric information is scanned or transmitted without informed consent–or just the first time
In Cothron v. White Castle System, Inc., the Illinois Supreme Court will determine the issue of whether claims asserted under sections 15(b) (collection of biometric data) and 15(d) (disclosure of biometric data) of BIPA accrue only once–when biometric data is initially collected or disclosed–or each time biometric data is collected or disclosed. The Illinois Supreme Court held oral argument on the case on May 17, 2022, and a decision is pending. For more on this case, see our prior blog here.
Walton v. Roosevelt University: Whether the Labor Management Relations Act (LMRA) preempts union-represented workers from pursuing BIPA claims
In Walton v. Roosevelt University, the Illinois Supreme Court will decide whether claims brought under BIPA by union-represented employees are preempted under federal labor law. In 2021, the Seventh Circuit ruled such claims were preempted under the LMRA because they would require courts to take the improper step of interpreting union workers’ collective bargaining agreements (CBA). Prior to the appeal in Walton, the Appellate Court of Illinois found the CBA at issue contained a broad management rights clause making the union the sole and exclusive bargaining agent for its members, and concluded that the timekeeping procedures–which were at issue in this case–were clearly covered by the agreement and would improperly require interpretation by the court to resolve the matter. The Illinois Supreme Court heard oral argument in this case on January 18, 2023.
Regardless of the way they turn, these cases will significantly impact the BIPA landscape and BIPA litigation for employers going forward, including defenses based on preemption, and damages calculations. For help with BIPA issues and all of your employment needs, contact your Baker McKenzie employment attorney.