Individuals now have five years to initiate claims after the Illinois Supreme Court expanded the BIPA stakes by ruling that the Illinois Biometric Privacy Act is not subject to Illinois’ one-year statute of limitations for privacy claims in Tims v. Black Horse Carriers, Inc., 2023 IL 127801, issued February 2, 2023.

Since BIPA plaintiffs are already asserting that damages are calculated for each individual scan or punch involving “biometric identifiers,” broadening the statute of limitations period has the potential to exponentially increase the potential exposure litigation poses. BIPA defendants can expect to see class definitions now covering the five-year statute of limitations period for all types of claims. Entities in possession of biometric information or identifiers should ensure they have a written policy, available to the public, before coming into possession of that information. Similarly, entities collecting, capturing, or disclosing biometric information or identifiers should provide notice and obtain consent before doing so.

The Act

The Illinois “BIPA” was enacted in 2008 and governs the possession, capture/collection, and disclosure of “biometric identifiers” or “biometric information”—retina scans, iris scans, fingerprints, voiceprints, scans of hand or face geometry, or “any information, regardless of how is it captured, converted, stored, or shared,” based on the foregoing categories. As characterized by the Illinois Supreme Court, the BIPA regulates:

• The establishment, maintenance, and adherence to a retention schedule and guidelines for destroying collected biometric information—740 ILCS 14/15(a);
• The provision of notice and obtaining written consent before collecting or storing biometric information—740 ILCS 14/15(b);
• The prohibition of selling or otherwise profiting from collected biometric information—740 ILCS 14/15(c);
• The disclosure or dissemination of biometric information without consent—740 ILCS 14/15(d); and
• The proper storage and protection of collected biometric information—740 ILCS 14/15(e).

The Question

At issue in Tims was a singular certified question: Does a one-year or five-year limitations period govern actions brought under the Illinois BIPA? Both parties to the case agreed that the decided-upon limitations period should apply to the entire Act, rather than the appellate court’s piecemeal application of a one-year statute of limitations to “disclosure” and “selling/profiting” claims (under subsections (c) and (d)) and a five-year statute of limitations to all other BIPA claims.

The Rationale

Though the Court acknowledged that the one-year statute of limitations “could be applied” to subsections (c) and (d) (selling, profiting, disclosure claims), the Court nevertheless decided that it “would be best” to apply the five-year Illinois “catch-all” limitations period. The Court cited concerns that “the full ramifications of the harms associated with biometric technology [are] unknown” and may not be discovered as quickly as other defamation-like torts for “publication” of private information. Generally, though, BIPA plaintiffs do not allege any actual injury stemming from the collection of their biometric identifiers or information. The Illinois Supreme Court has held that such actual injury is not required to bring a claim, leading to an onslaught of BIPA class action litigation in recent years.

What’s Next?

As the Illinois Supreme Court explained in its decision, “[o]ne of the purposes of a limitations period is to reduce uncertainty and create finality and predictability in the administration of justice.”

Yet the BIPA is still a far cry from having certainty, finality, or predictability when, for example, BIPA claims accrue or determining how to calculate damages for “each violation” are unsettled questions that loom large. The Illinois Supreme Court is expected to weigh in on the former issue soon. The Supreme Court’s Tims decision is also difficult to square with BIPA claims for failing to have a retention/destruction schedule, when subsection 15(a) of the BIPA represents a “duty” owed to the public generally” and not to “particular persons whose biometric information” is collected.

A link to the Tims v. Black Horse opinion can be found here.