Husch Highlight
- The appropriate limitations period for a cause of action alleging violation of sections 15(a), (b) or (e) of the Illinois Biometric Information Privacy Act (BIPA) is the five-year statute of limitations under section 13-205 of the Illinois Code of Civil Procedure, while the one-year statute of limitation under section 13-201 of the Illinois Code governs actions alleging violations of sections 15(c) and (d) of BIPA.
On September 17, 2021, the Appellate Court for the First District of Illinois released a decision in the class action, Tims et al., v. Black Horse Carriers, Inc., holding that a one-year statute of limitations under section 13-201 of the Illinois Code applies to a cause of action filed under sections 15(c) and 15(d) of BIPA, the two sections that contain the element of publication. All other BIPA claims alleging violations of section 15(a), (b) or (e) are subject to the five-year statute of limitations under 13-201 of the Illinois Code. This Illinois Appellate Court decision is significant because BIPA does not specify a statute of limitations applicable to its provisions. The decision likely will be appealed to the Illinois Supreme Court.
The class action claims
Plaintiffs’ class action alleges that defendant has and continues to collect, store, use and disseminate employees’ fingerprints for time-keeping purposes in violation of BIPA. Specifically, plaintiffs allege the following violations of BIPA:
- Failure to institute, maintain and adhere to a retention schedule for biometric data in violation of section 15(a) of the Act;
- Failure to obtain consent and a written release from plaintiff and other employees to collect, store and use employees’ fingerprints in violation of section 15(b) of the Act; and
- Unlawful disclosure or dissemination of biometric data without first obtaining consent in violation of section 15(d) of the Act.
BIPA does not contain a limitations period that governs claims filed under its provisions. Plaintiffs argued that in the absence of a stated statute of limitations, the Court should apply the five-year statute of limitations under section 13-205 of the Illinois Code, the limitations period used for all civil actions where the statute of limitations is not otherwise provided. Conversely, defendant argued in its motion to dismiss that section 13-201 of the Illinois Code, a one-year statute of limitations applicable to “actions for slander, libel or for publication of matter violating the right of privacy…,” governs BIPA claims and that the class action was filed outside the limitations period.
BIPA provisions and the applicable statute of limitations
BIPA obligates private entities that possess biometric identifiers or information to comply with the following requirements:
- Section 15(a) – to develop a written policy that establishes a retention schedule and guidelines for permanently destroying biometric identifiers and information when the initial purpose for the collection of such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the entity, whichever occurs first;
- Section 15(b) – to inform persons in writing that biometric identifiers and information is being collected or stored, the purpose for which it is being collected or stored, the period it will be stored or used, and to obtain a written release;
- Section 15(c) – to not sell, lease, trade or otherwise profit from a person’s biometric identifier or information;
- Section 15(d) – to not disclose, redisclose or otherwise disseminate a person’s biometric identifier or information without consent, request, authorization by the subject, a legal requirement or a court order; and
- Section 15(e) – to store, transmit and protect from disclosure all biometric identifiers and information using a reasonable standard of care and in a manner that is the same or more protective than the private entity uses to store, transmit and protect other confidential information.
Limitations period determined by existence of the element of publication in each claim
The Court concluded that privacy actions fall into two categories, those that: 1) require publication of confidential information and 2) address unlawful intrusion into the private domain of another or “intrusion upon seclusion.” Publication is not an element of the type of privacy action that alleges intrusion upon seclusion.
With regard to the limitations periods, the Court held that the one-year statute of limitations in section 13-201 applies only to privacy actions involving the element of publication. Because the duties of private entities under each section of BIPA are separate and distinct, the applicable limitations period applied will depend on the specific BIPA section at issue. The one-year limitations period would apply only to BIPA sections that include an element of publication or disclosure of biometric data.
Consequently, the five-year limitations period under section 13-205 of the Code applies to BIPA claims alleging violation of sections 15(a), 15(b) and 15(e) which contain “no element of publication or dissemination.” Conversely, the one-year limitations period under section 13-201 of the Code which applies to “actions for publication of matter involving a right of privacy” governs actions alleging violation of sections 15(c) and (d) which require publication or disclosure of biometric information as an element of the claim.
What this means to you
Based on the Appellate Court decision, the more lengthy five-year limitations period applies to three types of BIPA claims for statutory damages, including two frequently raised claims against companies alleging the unlawful: 1) collection, storage, or use of individuals’ biometric data without providing written notice and obtaining consent and a release from those individuals, and 2) failure to maintain and adhere to a written retention schedule and guidelines regarding permanent destruction of the biometric data. While the case may be appealed to the Illinois Supreme Court, the Illinois Supreme Court has consistently applied the statute in an expansive manner.
Another significant BIPA decision for employers that impact the issues of damages and limitations periods is Cothron v. White Castle Sys. Inc., which was argued before the Seventh Circuit on September 14, 2021. The Seventh Circuit will decide whether BIPA claims accrue each time a company violates the law or only in the first instance of a violation. The Lower Court ruled that the plaintiff alleged multiple timely violations of BIPA at each instance of collection and disclosure of the plaintiff’s biometric information.
Tracey Oakes O’Brien, Legal Content and Knowledge Manager, is a co-author of this content.
[View source.]
