The Illinois Supreme Court just handed union employers with broad management rights clauses in their collective bargaining agreements (CBA) a win. On March 23, 2023 the Illinois Supreme Court affirmatively answered a certified question (Does Section 301 of the Labor Management Relations Act preempt BIPA claims asserted by bargaining unit employees covered by a collective
Illinois employers, do you utilize any workforce monitoring or security measures, such as time clocks, that involve individuals’:
If so, read ahead because the Illinois Supreme Court just decided that doing so, without strict compliance with the Illinois Biometric Information Privacy Act (BIPA), could be a multi-billion dollar mistake.
In Cothron v. White Castle System, Inc. (issued February 17, 2023), the Court held that a separate BIPA claim accrues each time a private entity scans or transmits an individual’s biometric identifier or information in violation of section 15(b) or 15(d) of BIPA–not just the first time. Employers subject to BIPA now have no margin of error, because noncompliance with sections 15(b) or 15(d) of BIPA could mean cost-prohibitive–even ruinous–damages for the company.
Employers will now have to contend with a five-year statute of limitations for all employee claims under the Illinois Biometric Information Privacy Act (BIPA). On February 2, 2023, in Tims v. Black Horse Carriers, the Illinois Supreme Court held that a five-year statute of limitations applies to all BIPA claims—even those that are tied to the publication of an individual’s data and could presumably be subject to a one-year limitations period “for publication of matter violating the right of privacy.” The Court held that the legislative intent and purpose of BIPA, and the fact that BIPA does not have its own statute of limitations, favor all BIPA claims being subject to the state’s “catchall” five-year limitations period.
Plaintiff Tims filed a class-action complaint against his former employer, Black Horse, alleging that Black Horse violated section 15(a) of BIPA (providing for the retention and deletion of biometric information), and sections 15(b) and 15(d) of BIPA (providing for the consensual collection and disclosure of biometric identifiers and biometric information). Specifically, Tims alleged that Black Horse required its employees to use a fingerprint authentication time clock, and that Black Horse violated BIPA because it (1) failed to institute, maintain, and adhere to a publicly available biometric information retention and destruction policy required under section 15(a); (2) failed to provide notice and to obtain employees’ consent when collecting their biometrics, in violation of section 15(b); and (3) disclosed or otherwise disseminated employees’ biometric information to third parties without consent in violation of section 15(d).
Black Horse moved to dismiss the complaint as untimely, arguing that it was barred by the one-year statute of limitations in section 13-201 of the Illinois Code of Civil Procedure (Code). Black Horse argued that claims brought under BIPA concern violations of privacy, therefore the one-year limitations period in section 13-201 governing actions for the “publication of matter violating the right of privacy” should apply to such BIPA claims.
The circuit court rejected Black Horse’s argument, and denied the motion to dismiss. In doing so, the court held that violations of all three sections of BIPA were subject to Illinois’ “catchall” five-year limitations period in section 13-205 of the Code.
The appellate court, however, distinguished the applicable statute of limitations under BIPA based on the type of violation alleged. It held that violations of section 15(c) (prohibiting the sale, lease, trade or other profit from biometric information) and 15(d) (prohibiting the disclosure, redisclosure or dissemination of biometric information) were subject to the one-year limitations period in section 13-201 of the Code, while violations of section 15(a) (requiring a written policy with a retention schedule and guidelines for destroying biometric information), 15(b) (requiring notice and the specific purpose and length of collection of biometric information prior to collection), and 15(e) (requiring confidentiality and protective measures in the storage and transmission of biometric information) were subject to the five-year “catchall” limitations period in section 13-205.
