Earlier this quarter the Illinois Supreme Court issued two significant rulings impacting litigation under Illinois’ Biometric Information Privacy Act (the “BIPA”). In Tims v. Black Horse Carriers, Inc., 2023 IL 127801, the Illinois Supreme Court addressed the applicable statute of limitations period for claims brought under namely, whether a one-year or five-year limitations period applied to a putative class action lawsuit alleging violations of the BIPA. Two weeks later, in Cothron v. White Castle Sys., 2023 IL 128004, the Illinois Supreme Court held that a separate claim accrues under the BIPA each time a private entity scans or transmits an individual’s biometric identifier or information in violation of the statute.
As previously written in this blog, the Illinois BIPA imposes restrictions on how private entities collect, retain, disclose, and destroy biometric identifiers, including retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, or biometric information. Under the BIPA, any person “aggrieved” by a violation of its provisions “shall have a right of action [. . .] against an offending party” and “may recover for each violation” the greater of liquidated damages or actual damages, reasonable attorney fees and costs, and any other relief, including an injunction, that the court deems appropriate. Notably, the statute itself does not specify a statute of limitations on claims under the act.
In Tims, Plaintiff Jorome Tims filed a class action lawsuit against his former employer, Black Horse Carriers, Inc. (“Black Horse”), alleging that Black Horse required its employees to use a fingerprint identification time clock. The complaint alleged the scanning of Tims’s fingerprints amounted to violations of section 15(a) of the BIPA, providing for the retention and deletion of biometric information, and sections 15(b) and 15(d) of the act, providing for the consensual collection and disclosure of biometric identifiers and biometric information. Black Horse initially moved to dismiss the complaint, arguing Tims’s claims were barred by the one-year statute of limitations set forth in section 13-201 of the Illinois Code of Civil Procedure (the “Code”), which applies to actions for slander, libel or publication of matter violating the right of privacy. According to Black Horse, Tims’s claims concerned violations of privacy, such that the one-year limitation of section 13-201 should apply.
Conversely, Tims maintained the five-year catchall limitation period codified in section 13-205 should apply to claims under the BIPA. Section 13-205 of the Code provides, in pertinent part, “actions on unwritten contracts, expressed or implied, [. . .] and all civil actions not otherwise provided for, shall be commenced within 5 years next after the cause of action accrued.” Tims argued that section 13-201 applies to privacy claims where “publication” is an element of the cause of action, and that claims under BIPA do not necessarily involve publication of biometric data, nor was the BIPA intended to “regulate the publication of biometric data.”
In the end, the Illinois Supreme Court agreed with and rejected a one-year limitation period: “However, when we consider not just the plain language of section 15 but also the intent of the legislature, the purposes to be achieved by the statute, and the fact that there is no limitations period in the Act, we find that it would be best apply the five-year catchall limitations period codified in section 13-205 of the Code.” This conclusion was bolstered by the Court’s recognition that the BIPA does not contain a limitations period, and that Illinois courts have routinely applied the five-year limitations period to statutes that do not include a specific limitations period within their language.
Two weeks after its opinion in Tims, the Illinois Supreme Court issued its decision in Cothron v. White Castle Sys. Upon a certified question from the Seventh Circuit Court of Appeals, the Illinois Supreme Court was asked to answer the following: “Do section 15(b) and 15(d) claims accrue each time a private entity scans a person's biometric identifier and each time a private entity transmits such a scan to a third party, respectively, or only upon the first scan and first transmission?” According to the Court, the plain language of section 15(d) supported the conclusion that a claim accrued upon each scan or transmission of a person’s biometric identifier or information without prior informed consent. The Court rejected the employer’s argument that it should limit a claim under the BIPA to the first time that a private entity scanned or transmitting a party’s biometric identifier or biometric information as no such limitation appeared in the statute. The Court further reasoned that a party violated the BIPA when it collected, captured, or otherwise obtained a person’s biometric information without prior informed consent, regardless of whether it was the first time an entity scanned a fingerprint or otherwise collected biometric information, or at each subsequent scan or collection.
Tims and Cothron not only clarify, but dramatically change litigation under the BIPA. The Illinois Supreme Court has again signaled its support for consumer protection. The Court not only adopted the longer of two potentially applicable limitations periods—5 years—but also held that a claim under the BIPA accrues upon each scan or transmissions. Together, these rulings significantly expand potential exposure and damages under the BIPA. Unless the Illinois Legislature is to act, the liability and exposure for BIPA violations for private entities is expected to increase considerably.
