Overview
On February 2, 2023, the Illinois Supreme Court held that all causes of action brought under the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/1 et seq., are subject to a five-year statute of limitations. Tims v. Black Horse Carriers, Inc., 2023 IL 127801 (Ill. 2023). The Court’s holding is the latest disappointment for Illinois companies defending BIPA actions. The holding means the scourge of BIPA litigation will continue.
In Depth
WHAT HAPPENED
BIPA, on its face, does not include any express limitations period. The plaintiffs asserted that Illinois’ catch-all five-year limitations period applied while the defendants argued that the one-year limitations period related to privacy speech and publication applied. After a multiyear journey through the courts, the Illinois First District Appellate Court ultimately split the baby in Tims and held that both time periods applied:
- The one-year period would apply to claims made under Sections 15(c) and 15(d) of BIPA.
- The five-year period would apply to claims brought under Sections 15(a), 15(b) and 15(e).
As with most attempts at compromise, the appellate court’s formulation left neither the plaintiffs nor the defendants satisfied, and the appeal followed to the Illinois Supreme Court with the parties seeking one limitations period to rule all BIPA claims.
Ultimately, the Illinois Supreme Court reversed Tims, holding that the five-year limitations period governs all causes of action made under BIPA. Critics of the opinion might suggest that the opinion was written as a justification for a desired result (i.e., another significant BIPA victory for plaintiffs and a further expansion of BIPA liability). However, the Court attempted to justify its ruling by explaining its views that (1) a single limitations period would create finality and predictability and (2) the one-year limitations period was inconsistent with the plain language of BIPA, the intent of the legislature and the purposes to be achieved by the statute, and that court precedent consistently applied the five-year limitations period to statutes lacking a specific limitations period.
KEY TAKEAWAYS
- BIPA is broader than ever. The Illinois Supreme Court’s ruling significantly expands the scope of cognizable BIPA claims. Plaintiffs will now have more time to file actions and more prospective members to include in the class, meaning BIPA class actions are likely to grow in number and size and thus will be more expensive to resolve.
- Plaintiffs have certainty on their side. No matter where you look, from the photograph exemption, to constitutionality, to actual harm, to (now) the statute of limitations, the winning streak for plaintiffs on BIPA defenses is real, and it leaves defendants with few places to turn.
- Urgency for compliance increases. Companies now face up to five years’ worth of BIPA claims. For companies not currently in compliance, the potential universe of claims grows each day. The risk is particularly acute for companies that have only started processing biometric data in the past few years.
- It is past time for BIPA to be amended. An old, poorly written law continues to oppress and burden companies, hamstring litigants and vex the courts in Illinois. There are gaps in application and understanding, and there is inconsistent application, all of which are hallmarks that should lead to a bipartisan desire to make the law better. And yet, here we are. BIPA amendments have crept closer and closer to each of the past legislative cycles, but the time has to come when legislators stop letting the Illinois Supreme Court legislate and take responsibility for curing the deficiencies of BIPA through amendment.
WHAT’S NEXT?
The Illinois Supreme Court remanded the case to the circuit court for further proceedings. While that case continues, the Illinois Supreme Court is expected to soon issue another watershed ruling in Cothron v. White Castle Sys., Inc., where it will settle the question of when claims accrue under BIPA. Specifically, the Illinois Supreme Court is considering whether an injury occurs each time a finger is scanned or whether a violation is on a per-person basis. The significance of Tims will only serve to magnify the ultimate ruling in Cothron, however. The good news for defendants with respect to Cothron is that even some plaintiffs’ counsel are taking the position that an injury is per person.
If you have questions about BIPA compliance or are a facing a BIPA claim, please reach out to your regular McDermott lawyer or contact Daniel Campbell, David Saunders or Jonathan Ende.
