As long as this ruling stands, the negative implications for companies facing BIPA litigation far outweigh the positives. While defendants may now move to dismiss as untimely any claim brought under BIPA for selling or otherwise profiting from biometric data, or disclosing or disseminating biometric data without consent (or another specified prerequisite), if the case is brought more than one year after the alleged harm occurred, defendants face a lengthy five-year period for the claims that were already a favourite of the plaintiffs' bar.

Background

As BIPA is silent on statutes of limitations, plaintiffs and defendants have sought to rely on other Illinois law to influence courts. Defendants have argued that the applicable period is set forth in in 735 ILCS 5/13-201, which prescribes a one-year limitation period for slander, libel, or 'publication of matter violating the right of privacy'. Plaintiffs, meanwhile, have pointed to 735 ILCS 5/13-205, which is a catch-all provision that sets a five-year limitation period for 'all civil actions not otherwise provided for'.

Procedural history

In September 2019, the trial court in Tims v. Black Horse Carriers, Inc. considered the applicable statute of limitations period for BIPA claims. Since BIPA was not expressly aligned with a specific statute of limitations period, the plaintiff contended that the state's five-year catchall limitation period applied. The defendant countered that Illinois' one-year 'invasion of privacy' limitation period applied.

The trial court initially agreed with the plaintiff. On appeal, the court decided that varying statutes of limitations are in effect for claims brought against specific sections of the Act, as described below:

The Illinois Appellate Court's decision

The three-judge panel held that Illinois' five-year statute of limitations applies to Sections 15(a), (b), and (e) of BIPA as those sections 'have absolutely no element of publication or dissemination'. However, the panel alternatively contended that Illinois' one-year statute of limitations applies to claims brought under Sections 15(c) and 15(d) since these qualify as 'publication of matter violating the right of privacy'. A one-year statute of limitations could not apply to Sections (a), (b), and (e) because a plaintiff could bring an action under those sections without having to allege or prove that the defendant published or disclosed any biometric data to any person or entity beyond itself.

Looking ahead

The Tims appellate court decision is not the last word on this statute of limitations issue. The defendant, which was supported on appeal by the Illinois Chamber of Commerce, could seek a discretionary appeal to the Illinois Supreme Court.

Additionally, this same issue is now before the Illinois Appellate Court's Third District in Marion v. Ring Container Technologies, LLC (though Marion is stayed pending the Illinois Supreme Court's decision in McDonald v. Symphony Bronzeville Park LLC regarding the applicability of the Illinois Workers' Compensation Act to certain BIPA claims).

Meanwhile, companies doing business in Illinois that use biometric devices should continue to consider potential BIPA obligations. Virtually all trial courts to have addressed the issue applied the five-year statute of limitations to all BIPA subsections. Thus, a silver lining in an otherwise pro-plaintiff decision is the ruling that a one-year statute of limitations applies at least to some BIPA claims. However, because under Tims, that one-year limitation does not apply to BIPA's most frequently litigated provisions (Sections 15(a) and 15(b)), the tide of BIPA class action lawsuits should continue to flood Illinois state and federal court dockets.

Aaron K. Tantleff Partner
[email protected]
Samuel D. Goldstick Associate
[email protected]
Foley & Lardner LLP, Chicago