Takeaways from Illinois Supreme Court decision on BIPA’s applicable statute of limitations

By David J. Oberly, Biometric Privacy & Data Privacy Attorney

For years, litigants involved in Illinois Biometric Information Privacy Act (“BIPA”) class action litigation have faced significant uncertainty as to whether claims asserted under Illinois’s biometrics statute are subject to a one-, two-, or five-year statute of limitations. On February 2, 2023, the Illinois Supreme Court definitively resolved this issue in Tims v. Black Horse Carriers, Inc., 2023 IL 127801, holding that Illinois’s five-year catchall limitations period is applicable to all claims alleging BIPA non-compliance.

The Tims decision is a notable victory for BIPA plaintiffs, while at the same time significantly raising the stakes for companies that use biometric data to increase the effectiveness of their operations. With that said, Tims may prove to be a drop in the bucket when all is said and done, as another biometric privacy class action appeal slated to be decided by Illinois’s highest court on the issue of BIPA claim accrual may push potential damages awards in BIPA disputes into truly stratospheric levels.

Background

In September 2021, the Illinois First District Court of Appeals held in Tims that claims brought under BIPA Sections 15(a) (privacy policy and data destruction requirements), 15(b) (notice and consent requirements), and 15(e) (data security requirements) are subject to a five-year statute of limitations. Conversely, the appellate court held that a much shorter, one-year limitations period pertaining to “actions for slander, libel or for publication of matter violating the right of privacy” is applicable for claims asserted under Sections 15(c) (prohibition on selling or profiting from biometric data) and 15(d) (disclosure limitations).

The Illinois Supreme Court decides BIPA’s applicable limitations period

On appeal, the Illinois Supreme Court found the one-year limitations period to be wholly inapplicable in the context of BIPA disputes. Instead, the Court held that Illinois’s five-year catchall limitations period applies to all five subparts of Section 15.

The Court acknowledged that the one-year limitations period “could” be applied to Sections 15(c) and 15(d) because those claims could arguably be interpreted as involving a “publication,” but nonetheless concluded that it “would be best” to apply the five-year limitations period to ensure certainty and predictability through the imposition of a single, unified limitations period to govern all claims encompassed under BIPA.

The Court further reasoned that the five-year period was appropriate to align with BIPA’s legislative history and intent—and, more specifically, the list of goals intended to be accomplished and the range of ills intended to be ameliorated through enactment of the statute by the Illinois General Assembly.

Takeaways and impact

Expanded Scope of Liability Exposure

The Tims decision will likely have an immediate impact on BIPA class action litigation moving forward in several material respects.

First, the Illinois Supreme Court’s decision further increases the scope of legal risk and liability exposure faced by companies that collect and use biometric data in their day-to-day operations, as plaintiffs will now have five years from the date that alleged BIPA violations took place to file suit for purported non-compliance with the law, regardless of the type of claim asserted under Section 15.

More than that, Tims allows plaintiffs to fashion the largest putative class sizes permitted under Illinois law in BIPA litigation, encompassing all individuals who allegedly had their privacy rights violated due to BIPA non-compliance over a five year period dating back from the time suit is filed—making it more important than ever for companies to ensure their biometric privacy compliance programs are legally sound.

Increase in Volume of Section 15(c) and (d) Claims

Second, the Illinois Supreme Court’s holding that Section 15(c) and 15(d) are also subject to Illinois’s extended five-year limitations period, as opposed to a much tighter one-year window, will likely energize plaintiff’s attorneys to pursue a higher volume of unlawful sales/profiting and disclosure claims in future BIPA class actions. This is especially so in light of the trend seen in BIPA litigation over the course of 2022 in which courts shifted from their original, relatively narrow interpretation of BIPA Section 15(c) profiting claims to a much more expansive view of this particular BIPA compliance requirement, with several courts finding that even the most conclusory allegations set forth in BIPA disputes were sufficient to withstand motions to dismiss for failure to state a claim.

From a broader perspective, by no means will Tims have any appreciable impact on stemming the tide of BIPA filings that has continued apace since the Illinois Supreme Court’s seminal 2019 opinion in Rosenbach v. Six Flags Ent. Corp. 2019 IL 123186, which held that plaintiffs do not have to suffer any actual injury or harm to pursue BIPA claims. Just the opposite, Tims all but ensures that a high volume of BIPA class actions—along with expanded putative class sizes—will continue to be filed for the foreseeable future.

Further Inflated Settlement Amounts

Third, Tims will likely further increase the already-inflated values of BIPA claims, as plaintiffs will no longer be required to give consideration to the prospect of Section 15(c) and 15(d) claims being subject to a one-year limitations period. Rather, plaintiff’s counsel can now use a five-year limitations period in calculating potential damages as it relates to these two subparts of Section 15—resulting in even higher demand figures during settlement negotiations.

At the same time, plaintiff’s attorneys will also be less likely to reduce these inflated demands by any appreciable amount during the course of negotiations, and will generally be more apt to take an aggressive stance during settlement talks, as the recent Rogers v. BNSF Ry. Co. BIPA jury trial—which resulted in a $228 million verdict in favor of the plaintiff—is viewed by many plaintiff’s attorneys as a strong indication that it may be preferable to try a case before a jury in the event a defendant refuses to capitulate to their oversized settlement demands.

The Outsized Role Played by BIPA’s Legislative History & Intent in Deciding the Outcome of BIPA Disputes

Finally, litigants and their counsel should take note of the significant weight given by the Tims Court to the legislative history and intent of Illinois’s biometrics statute—and the role that legislative intent played in the outcome of that appeal—as this issue is likely to arise frequently in future BIPA disputes.

In holding that a five-year limitations period should apply to all BIPA claims, the Tims Court repeatedly emphasized how the Illinois legislature’s policy concerns were best addressed by applying the longer statute of limitations vis-à-vis a much stricter one-year period. As indicated above, in its opinion the Court highlighted Section 5 of BIPA, which contains a list of goals the Illinois legislature set to accomplish through enactment of the state’s biometrics statute, as well as the ills it intended to ameliorate. In light of the extensive consideration lawmakers gave to the fears of and risks to the public surrounding the disclosure of highly sensitive biometric data, the Court concluded that it would thwart legislative intent to apply a more condensed one-year statute of limitations to BIPA causes of action. At the same time, the Court found that a longer, five-year limitations period would comport with the public welfare and safety aims of the Illinois General Assembly by allowing an aggrieved party sufficient time to discover violations of the law and take action.

Importantly, the reasoning set forth in Tims demonstrates how courts tend to heavily favor plaintiff-friendly, liberal interpretations of BIPA’s statutory text, often reasoning that these interpretations align with the stated intent and purposes of Illinois’s biometrics statute. More than that, plaintiff’s attorneys will almost undoubtedly leverage the Tims Court’s reliance on BIPA’s legislative history/intent in future arguments when attempting to advocate for the application of a more expansive, plaintiff-friendly interpretation of other key aspects of BIPA’s statutory text. This argument has proven to be a difficult hurdle for defendants to overcome in BIPA class actions to date, and will only become a more complex challenge for companies involved in BIPA disputes moving forward—making strict compliance with the law even more critical to limit legal risks and mitigate liability exposure.

Looking ahead: Illinois Supreme Court to resolve claim accrual question in BIPA class action litigation

Beyond Tims, the Illinois Supreme Court is set to issue another much-anticipated opinion in Cothron v. White Castle Sys., No. 128004, sometime in the immediate future, which will definitively resolve the currently unsettled issue of claim accrual in BIPA litigation. Depending on how the Court answers the question of whether every discrete failure to comply with BIPA’s requirements amounts to a separate, independent violation of the statute, the scope of liability exposure and potential damages underlying BIPA class actions may further increase yet again. Importantly, if the Cothron Court adopts the more expansive view of claim accrual, the value of BIPA claims will spike exponentially—with companies that once faced millions of dollars in liability exposure finding themselves being exposed to billions in the event the court adopts the continuing violation theory of liability.

What to do now

Should the Cothron Court rule in favor of the continuing violation theory of claim accrual (which, at this juncture, is the likely outcome), BIPA class action liability exposure may soon be exponentially broader vis-à-vis what BIPA defendants faced as recently as January 2023. In turn, strict compliance with Illinois’s biometric privacy statute will be even more critical moving forward to mitigate the significant legal risks and liability exposure faced by companies for non-compliance with the law.

As such, at this time all companies that use biometric data for business or operational purposes should ensure they have implemented the following practices as part of their comprehensive biometric privacy compliance programs:

• maintain a publicly-available, biometrics-specific privacy policy;
• permanently destroy biometric data in a timely manner;
• supply individualized notice before any biometric data is collected;
• obtain written consent before any biometric data is collected and before any disclosures of biometric data;
• maintain security measures to safeguard biometric data;
• strictly prohibit the sale or any other for-profit transactions of biometric data; and
• ensure strict vendor compliance with the mandates of Illinois’s biometrics statute.

About the author

David J. Oberly is an attorney in the Cincinnati office of Squire Patton Boggs LLP and a member of the firm’s global Data Privacy, Cybersecurity & Digital Assets practice. David’s practice focuses on counseling and advising clients on a wide range of biometric privacy, artificial intelligence, and data privacy/security compliance and risk management matters. He can be reached at david.oberly@squirepb.com. You can also follow David on Twitter at @DavidJOberly.

DISCLAIMER: Biometric Update’s Industry Insights are submitted content. The views expressed in this post are that of the author, and don’t necessarily reflect the views of Biometric Update.

Article Topics

biometric data  |  biometric identifiers  |  Biometric Information Privacy Act (BIPA)  |  biometrics  |  data protection  |  David Oberly  |  lawsuits