When You Hear Hoofbeats, Think Privacy. Illinois Case Expands Potential Liability in BIPA Cases

On February 2^nd the Illinois Supreme Court decided Tims v. Black Horse Carriers, clarifying that all claims under Illinois’s Biometric Information Privacy Act (BIPA) are subject to a five-year—not one-year—statute of limitations. 

Tims is a class action suit alleging violations of BIPA, which imposes various requirements on companies’ collection, retention, and deletion of “biometric information”—in this case, employees’ fingerprints. The case came up on interlocutory appeal to decide the question of which limitations period controlled claims under the Act: the one-year limitations period (sought by defendants) applicable to “publication of matter violating the right of privacy” under 735 ILCS 5/13-201, or the five-year catch-all limitations period (sought by plaintiffs) under section 13-205. The Illinois Supreme Court found as a threshold matter that the appellate court erred in applying a different limitations period depending on which section of BIPA was at issue, holding instead that only one limitations period should govern the entire Act to reduce uncertainty and predictability. The Court then held that the five-year catch-all limitations period should apply, finding that nothing in Illinois’s BIPA related to the “publication” of material required under section 13-201.

The impact of Tims on the evolving patchwork of state biometric laws remains to be seen. Notably, many states, including New York, California, Maryland, and Minnesota, are currently considering “copy-cat” laws largely modeled after BIPA. Like BIPA, many of these laws currently lack any explicit statute of limitations on biometric claims. With Tims bringing debate over the appropriate statute of limitations into focus, state legislatures may feel more inclined to set explicit limitations rather than deferring to existing default rules. Time will tell whether such consideration ultimately results in lengthy limitations periods or more limited exposure. In either case, proposed BIPA-like biometric laws are sweeping the country. We therefore recommend Companies review their biometric collection, use, and disclosure policies and practices to limit potential exposure to an increasingly aggressive biometric plaintiffs’ bar.

BIPA is already a popular class-action mechanism given its potential to generate significant settlement awards and individual payouts. In the wake of Tims, companies nationwide now face a marked increase in potential liability if they fail to comply with the Illinois privacy statute. And the BIPA landscape continues to evolve—companies should keep an eye out for the Illinois Supreme Court’s forthcoming decision in Cothron v. White Castle System, Inc., which may further extend the statute of limitations for prospective plaintiffs.  In Cothran, the Seventh Circuit certified the question of whether claims under section 15(b) and 15(d) of BIPA accrue each time a company scans or transmits an individual’s biometric identifier, or only upon the first scan or transmission. If the Illinois Supreme Court finds that every subsequent violation of BIPA is a discrete legal claim, it would not only extend the reach of the (already lengthy) five-year limitations period but also guarantee plaintiffs high damages awards for successful claims under the Act, which provides for statutory damages up to $5,000 “for each violation.” The Illinois Supreme Court heard argument on Cothron in early 2022, and a decision is imminent. Given the liberal constructions of BIPA that have thus far prevailed, as well as the plaintiff-friendly climate around privacy laws generally, companies should prepare for an expansive reading of the statute that spurs new class action litigation in this space.

---

Citations:

Tims v. BLACK HORSE CARRIERS, INC., 2023 IL 127801 - Ill: Supreme Court 2023

Cothron v. White Castle System, Inc., 20 F.4th 1156 (7th Cir. 2021).

• Illinois Supreme Court – Cothron v. White Castle System, Inc., Case No. 20-3202.