By Danielle Kays, Sarah Bauman, and James Nasiri

The Illinois Supreme Court issued its highly-anticipated decision in Tims v. Black Horse Carriers today, ruling that a five-year statute of limitations applies to all claims under the Illinois Biometric Privacy Act (“BIPA”).  The Court’s decision (available here) answers a years-old question regarding the timeliness of BIPA claims, and offers insight into future litigation.

Background On Tims v. Black Horse Carriers

As a refresher, in March 2019, the Plaintiff filed a class action complaint alleging that Black Horse Carriers violated BIPA by using timeclocks that allegedly scanned and stored employees’ fingerprints.  The complaint asserted that the Defendant violated subsection 15(a) of BIPA in failing to institute, maintain, and adhere to a retention schedule for biometric data; and subsections 15(b) and (d), respectively, by obtaining their employees’ biometric data and disclosing it to third-parties without first obtaining their written, informed consent.  The Plaintiff did not allege claims under the remaining subsections 15(c) or (e) of BIPA which prohibit the sale of a person’s biometric data for a profit, and impose a duty of reasonable care in storing and protecting biometric data from disclosure, respectively.

The Defendant moved to dismiss the Plaintiff’s claims as untimely.  The Defendant argued that because BIPA does not contain a specific statute of limitations, the trial court should apply the one-year limitations period set forth in section 5/13-201 for privacy actions.  Under that limitations period, the Plaintiff’s claims would be time-barred.  The Plaintiff countered that the five-year “catch-all” limitations period contained in section 5/13-205 was more appropriate for actions under BIPA.  And under that limitations period, the Plaintiff’s claims would be viable. 

In September 2019, the trial court denied the motion to dismiss, holding that section 13-201 does not apply because the Plaintiff alleged a violation of the Act itself, rather than a general violation of privacy.  As such, the trial court opined that a five-year limitations period applies to the Plaintiff’s claims.  The Defendant appealed the decision to the Illinois First District Appellate Court. 

Illinois Appellate Decision Highlights

In an anomalous ruling on interlocutory appeal, the Illinois Appellate Court held that three subsubsections of BIPA had a five-year time limitation, while the remaining two subsections were subject to a one-year time limitation.  Specifically, the Illinois Appellate Court held that the one-year limitations period in section 201 applies to BIPA subsections 15(c) and 15(d) because these subsections involve “publication” of biometric data, which is a term explicitly used in section 201.  Conversely, the Illinois Appellate Court found that subsections 15(a), (b), and (e) of BIPA were subject to a five-year limitations period to the extent such subsections do not contain the word “publication.”  The Defendant subsequently appealed the Illinois Appellate Court’s decision to the Illinois Supreme Court.

Illinois Supreme Court Oral Argument Highlights

At oral argument, the Defendant—utilizing cannons of statutory interpretation and Illinois Supreme Court precedent—argued that BIPA is a privacy statute and therefore should be governed by the one-year statute of limitations period codified in section 13-201.  The Plaintiff countered that while BIPA is a privacy statute, “publication” is not an element of a claim under BIPA, and thus the five-year catchall limitations period codified in section 13-205 of the Code should apply to all claims under the Act.

The Illinois Supreme Court Justices asked few questions and made few remarks during oral argument.  Notably, Justice Michael Burke (who is no longer on the bench, and did not take part in this opinion) opined that the Illinois Appellate Court’s holding seemed “unworkable.”  For further comment on the oral argument, visit our blog post here.

Illinois Supreme Court’s Landmark Decision

First, the Court observed that both parties: (1) agreed that the Illinois Appellate Court erred in applying two different limitations periods to BIPA; and (2) requested the Court to apply either a one-year or a five-year limitations period to the entire Act.  The Court agreed, holding that the Illinois Appellate Court erred in this respect.  The Court observed that one of the purposes of a statute of limitations is “to reduce uncertainty and create finality and predictability in the administration of justice.”  Echoing Justice Michael Burke’s articulated concern at oral argument, the Court held that two different limitations periods applied to a single Act “does not align with this purpose,” reasoning this would “create an unclear, inconvenient, inconsistent, and potentially unworkable regime.”

The Court next analyzed whether a one-year or five-year statute of limitations period should apply to all BIPA claims by “employing established principles of statutory construction.”  The Court first utilized the “cardinal rule”—i.e., the plain and ordinary meaning of BIPA’s statutory language.  The Court observed that, consistent with the Illinois Appellate Court’s analysis, neither subsection 15(a) (requiring a BIPA-compliant biometric data policy), 15(b) (requiring BIPA-compliant informed consent procedures), nor 15(e) (prohibiting negligence in storing, transmitting, or disclosing biometric information), “contain words that could be defined as involving publication.”  Thus, the Court held that subsections (a), (b), and (e) are subject to the five-year catch-all limitations period contained in section 13-205 of the Code. 

As to subsections (c) and (d), the Court agreed  that a one-year statute of limitations could be applied to those subsections, but ultimately ruled otherwise.  Again utilizing the “cardinal rule” of statutory interpretation, the Court observed that subsections 15(c) and (d) “contain the words ‘sell,’ ‘lease,’ ‘trade,’ disclose,’ ‘redisclose,’ and ‘disseminate,”’ and thus “could be defined as involving publication and would fall within the purview of the one-year limitations period in section 13-205 of the Code.”  However, the Court rejected the Illinois Appellate Court’s choice to apply such a limitations period to those subsections to the extent the Court “consider[s] not just the plain language of [BIPA,] but also the intent of the legislature, the purposes to be achieved by the statute, and the fact that there is no limitations period in the Act.” 

Accordingly, the Court held that a five-year statute of limitations applies to all BIPA claims.  The Court reasoned that a five-year time limitation is appropriate because Illinois courts have routinely applied the catch-all limitations period to other statutes that lack a specific statute of limitations, which BIPA similarly lacks.  The Court also observed the General Assembly’s “thorough list of goals intended to accomplish as well as the ills it intended to ameliorate”—namely, the uniqueness of biometric information and statement that (15 years ago) the “full ramifications of biometric information technology are not fully known.” 

Coming Up Next

Looking ahead, the Illinois Supreme Court will soon resolve the issue of when BIPA claims accrue—upon the first biometric collection (or here, fingerprint scan) versus the final biometric collection—in Cothron v. White Castle System.  Indeed, the decision has been fully briefed and argued as of May 2022—approximately four months before the Tims decision—so we can expect that ruling any day now. 

Additionally, companies continue to appeal to the Illinois Supreme Court to resolve largely untested defenses to BIPA claims, such as the various exceptions to BIPA, e.g., the HIPAA exemption and preemption under the Labor Management Relations Act.  See 740 ILCS 14/10.

Implications For Employers

Thousands of cases have been filed under BIPA over the past few years against companies, and this lengthy statute of limitations continues to make BIPA litigation lucrative for plaintiffs.  While BIPA litigation against Illinois employers largely targeted employee timekeeping systems (such as in the Tims case), the technology targeted under BIPA continues to grow—especially as technologies used by companies continue to evolve.  New technologies being targeted under BIPA include voice-activated headsets, and virtually any technology that may use finger or hand scans, face or eye scans, voice-recognition technology, and other artificial intelligence technology used to scan or recognize photos or videos.  Therefore, employers should continue to review their technology, policies, and procedures before implementing new technological advancements. For more information about the Illinois Biometric Information Privacy Act and how this decision may affect your business, contact the authors—Danielle Kays, Sarah Bauman, and James Nasiri—your Seyfarth attorney, or Seyfarth’s Workplace Privacy & Biometrics Practice Group.