Following the Illinois’ Supreme Court’s decision in Cothron v. White Castle System, Inc., the Illinois legislature amended the Biometric Information Privacy Act (BIPA), which the governor signed into law as Public Act 103-0769 on August 2, 2024. Public Act 103-0769 clarified that multiple BIPA violations against the same person using the same method, constitute
Illinois Employers: Got a Broad Management Rights Clause in Your CBA? BIPA Claims by Union Employees Preempted
The Illinois Supreme Court just handed union employers with broad management rights clauses in their collective bargaining agreements (CBA) a win. On March 23, 2023 the Illinois Supreme Court affirmatively answered a certified question (Does Section 301 of the Labor Management Relations Act preempt BIPA claims asserted by bargaining unit employees covered by a collective
One Limitations Period for All: Illinois Supreme Court Holds All Claims Under BIPA Have a Five-Year Statute of Limitations
Employers will now have to contend with a five-year statute of limitations for all employee claims under the Illinois Biometric Information Privacy Act (BIPA). On February 2, 2023, in Tims v. Black Horse Carriers, the Illinois Supreme Court held that a five-year statute of limitations applies to all BIPA claims—even those that are tied to the publication of an individual’s data and could presumably be subject to a one-year limitations period “for publication of matter violating the right of privacy.” The Court held that the legislative intent and purpose of BIPA, and the fact that BIPA does not have its own statute of limitations, favor all BIPA claims being subject to the state’s “catchall” five-year limitations period.
What happened
Plaintiff Tims filed a class-action complaint against his former employer, Black Horse, alleging that Black Horse violated section 15(a) of BIPA (providing for the retention and deletion of biometric information), and sections 15(b) and 15(d) of BIPA (providing for the consensual collection and disclosure of biometric identifiers and biometric information). Specifically, Tims alleged that Black Horse required its employees to use a fingerprint authentication time clock, and that Black Horse violated BIPA because it (1) failed to institute, maintain, and adhere to a publicly available biometric information retention and destruction policy required under section 15(a); (2) failed to provide notice and to obtain employees’ consent when collecting their biometrics, in violation of section 15(b); and (3) disclosed or otherwise disseminated employees’ biometric information to third parties without consent in violation of section 15(d).
Black Horse moved to dismiss the complaint as untimely, arguing that it was barred by the one-year statute of limitations in section 13-201 of the Illinois Code of Civil Procedure (Code). Black Horse argued that claims brought under BIPA concern violations of privacy, therefore the one-year limitations period in section 13-201 governing actions for the “publication of matter violating the right of privacy” should apply to such BIPA claims.
The circuit court rejected Black Horse’s argument, and denied the motion to dismiss. In doing so, the court held that violations of all three sections of BIPA were subject to Illinois’ “catchall” five-year limitations period in section 13-205 of the Code.
The appellate court, however, distinguished the applicable statute of limitations under BIPA based on the type of violation alleged. It held that violations of section 15(c) (prohibiting the sale, lease, trade or other profit from biometric information) and 15(d) (prohibiting the disclosure, redisclosure or dissemination of biometric information) were subject to the one-year limitations period in section 13-201 of the Code, while violations of section 15(a) (requiring a written policy with a retention schedule and guidelines for destroying biometric information), 15(b) (requiring notice and the specific purpose and length of collection of biometric information prior to collection), and 15(e) (requiring confidentiality and protective measures in the storage and transmission of biometric information) were subject to the five-year “catchall” limitations period in section 13-205.Continue Reading One Limitations Period for All: Illinois Supreme Court Holds All Claims Under BIPA Have a Five-Year Statute of Limitations
The Ninth Circuit Clears The Way For BIPA Class Actions
As detailed in prior posts, in January, the Illinois Supreme Court held that a plaintiff need not plead an actual injury beyond a per se statutory violation to state a claim for statutory liquidated damages or injunctive relief under the Illinois Biometric Information Privacy Act (BIPA). While recent decisions applying BIPA have been largely Illinois-based, the Ninth Circuit recently applied BIPA in Patel v. Facebook to affirm a lower court’s ruling that plaintiffs in the ongoing Facebook BIPA class action alleged a concrete injury-in-fact to confer Article III standing and that the class was properly certified.
The Ninth Circuit is the first federal circuit court to conclude that a plaintiff alleging a BIPA violation has standing for purposes of Article III of the US Constitution. The ruling makes it easier for plaintiffs to certify BIPA class actions, within and outside of Illinois.
Continue Reading The Ninth Circuit Clears The Way For BIPA Class Actions