Earlier today (September 17, 2021), the Illinois First District Appellate Court issued its long awaited opinion in the interlocutory appeal of Tims v. Black Horse Carriers (2021 IL App (1^st) 200563), clarifying Illinois law on the issue of the applicable statute of limitations for claims brought under the Illinois Biometric Information Privacy Act (“BIPA” or the “Act”). The court ruled that individuals that have had their biometrics collected in Illinois have five years to sue a private entity for failure to follow the Act’s retention schedule requirements, the Act’s informed written consent and release requirements and the Act’s confidentiality requirements.  Individuals have just one year to sue for a private entities failure to follow the Act’s requirement of consent before disclosure or dissemination of biometric data or information and the Act’s prohibition to sell, lease or trade the information without consent.

Today’s decision is of critical interest and importance to Illinois businesses and employers facing claims under the Act. In sum, the First District Appellate Court held that the five-year “catch-all” statute of limitations contained in section 13-205 of the Illinois Code of Civil Procedure applies to claims brought under most, but not all, of the subsections of the BIPA. Under the appellate court’s ruling, BIPA claims that are subject to the five-year statute of limitations of section 13-205 of the Code include claims brought under Section 15(a) (requiring a private entity to institute, maintain and/or adhere to a retention schedule for biometric data), 15(b) (requiring a private entity to obtain informed written consent and release before obtaining biometric data), and 15(e) (requiring a private entity in possession of a biometric identifier or biometric information to store, transmit, and protect from disclosure all biometric identifiers and biometric information using the reasonable standard of care applicable in the entity’s industry, and in a manner that is the same or more protective that then manner in which the entity stores, transmits and protects other confidential information). However, under today’s ruling, claims brought under the other two subsections of the Act – Section 15(c) (prohibiting a private entity from selling, leasing, trading or otherwise profiting from a person’s or a customer’s biometric information) and Section 15(d) (proscribing a private entity from disclosing or disseminating biometric data without first obtaining consent) are only subject to a one year statute of limitations.

Under today’s ruling by the First District appellate court, pending eventual review by the Illinois Supreme Court (which is likely), most BIPA claims will be subject to a five-year statute of limitations, as Sections 15(a) and (b) of the BIPA statute are the most common bases for lawsuits filed under the BIPA.  However, the limitation of 15(c) and 15(d) claims to a one-year statute does change the calculus for the BIPA plaintiffs’ bar, which had assumed that the appellate court would find that a five-year statute of limitations is applicable to the entire BIPA. Given today’s guidance from the First District Appellate Court on this critical issue of Illinois law, employers facing BIPA claims should immediately review the specific bases of the BIPA claims alleged against them and move to dismiss or for summary judgment on Section 15(c) and 15(d) claims where appropriate.

In Tims, defendant Black Horse Carriers, an Illinois trucking company, allegedly required its employees to use a biometric time-keeping device to track employee’s hours of work. In March 2019, plaintiff and former Black Horse Carriers employee Jorome Tims brought a putative class action complaint against Black Horse Carriers alleging that the defendant had violated several sections of the BIPA, including Sections 15(a), 15(b), and 15(d). Critically for the purposes of the issue presented in this interlocutory appeal, Tims alleged that he worked for defendant from June 2017 until January 2018 – thus, his employment ended more than one year prior to the commencement of his BIPA lawsuit. In response to the complaint, Black Horse Carriers brought a 2-619 motion to dismiss on the basis of the statute of limitations, arguing that the one-year limitation period for privacy actions under 13-201 applies to claims arising under the BIPA because the purpose of the Act is privacy protection. Plaintiff, of course, contended that the five-year period in section 13-205 for all civil actions not otherwise provided for should apply to his BIPA claims. The trial court ruled in favor of plaintiff and denied a motion for reconsideration, but permitted a motion for interlocutory appeal to resolve the certified question of law under Rule 308.

In today’s opinion, the First District Appellate Court resolved the certified question of law and found “from the language of section 13-201 including actions ‘for publication of matter violating the right of privacy’” that 13-201 “does not encompass all privacy actions but only those where publication is an element or inherent part of the action.” The appellate court found that “publication or disclosure of biometric data is clearly an element” of an action under either Section 15(c) (prohibiting a private entity from selling, leasing, trading or otherwise profiting from a person’s or a customer’s biometric information) and Section 15(d) (proscribing a private entity from disclosing or disseminating biometric data without first obtaining consent). However, as to Sections 15(a), (b) and (e), the court ruled that a plaintiff could bring an action alleging a violation of these sections of the Act “without having to allege or prove that the defendant private entity published or disclosed any biometric data to any person or entity beyond or outside itself.” Accordingly, the court ruled that the five-year period in section 13-205 to claims arising under Sections 15(a), (b) and (e) of the BIPA.

By: Jamie L Filipovic, Esq. and Matthew Szwajkowski, Esq.