It was enacted without a statute of limitations for bringing claims, but now the Illinois Biometric Information Privacy Act (BIPA) has two. An Illinois Court of Appeals panel has ruled that claimants have one year to file claims if their injuries have a “publication” element, such as the dissemination of their private data. If there is no publication element, such as failing to have procedures for collecting and retaining data, the statute of limitations is five years, the court determined.
In March 2019, plaintiffs Jorome Tims and Isaac Watson filed a class action suit against Black Horse Carriers, Inc., under the Act. The law recognizes that public welfare is endangered if individuals’ biometric data is not protected. It imposes numerous restrictions on how private entities can collect, retain, disclose, and destroy biometric identifiers, and creates a right of action for any person aggrieved by a violation of its provisions (Tims v. Black Horse Carriers, Inc., 2021 IL App. 1st 200563).
Tims and Watson were employees of Black Horse Carriers from 2017-2018. They alleged that the company’s use of fingerprint scanning in employee timekeeping violated the Act. Specifically, the first count alleged that the defendant violated Section 15(a) by failing to institute and adhere to a retention schedule for biometric data; the second alleged that it violated 15(b) by failing to obtain written consent before obtaining biometric data; the third alleged that it violated Section 15(d) by disclosing biometric data without first obtaining consent.
Black Horse Carriers filed a motion to dismiss in June 2019, arguing that the complaint was filed beyond the one-year limitation period in Section 13-201 of the Code of Civil Procedure, which applies to privacy actions. The Act itself has no limitation provision, but the defendant argued that Section 13-201 applies because the Act’s purpose is privacy protection.
Plaintiffs argued that the Act’s purpose is to create a prophylactic regulatory system to prevent or deter security breaches regarding biometric data. Since the Act had no limitation period, the five-year period in Section 13-205 for all civil actions not otherwise provided for should apply. Moreover, plaintiff argued that Section 13-201 only applies to privacy claims with a publication element, which the Act does not have.
In September 2019, the trial court denied the defendant’s motion to dismiss. Noting that plaintiff was claiming that the defendant violated the Act rather than a general invasion of his privacy or defamation, the court found Section 13-201 inapplicable, applying instead the five-year catchall limitation provision in Section 13-205.
Defendant Black Horse Carriers brought an interlocutory appeal from the circuit court orders denying its motion to dismiss on limitation grounds, denying reconsideration, and certifying a question for the appellate court: Does the one-year or five-year limitation apply to claims under the Act?
The Court of Appeals found that Section 13-201 does not encompass all privacy actions but only those where publication is an element. It based its rationale on the language of Section 13-201 (which applies to actions “for slander, libel or publication of matter violating the right of privacy”) and its finding in Benitez v. KFC National Management Co., 305 Ill. App. 3d 1027, 1033 (1999). In Benitez, the Court noted that courts have recognized two types of interests in the right to privacy: secrecy (the right to maintain certain information confidential) and seclusion (the right to be left alone and keep others out of one’s physical boundaries or affairs), and publication is not an element to the latter; thus, Section 13-201 does not govern all privacy torts but rather only those involving publication.
The Court noted that BIPA imposes various duties upon which an aggrieved person may bring an action, but only some of those duties involve publication and those fall under the one-year limitation of Section 13-201 of the Code.
As such, the Court held that:
- The one-year statute of limitations in Section 13-201 governs actions under BIPA that have a publication element: namely, those under Section 15(c), forbidding a private party to sell, lease, or profit from biometric data, and 15(d), requiring consent or a court order for the dissemination of biometric data.
- The five-year statute of limitations in Section 13-205 governs actions that do not have a publication element, namely Section 15(a), requiring private parties to develop a written policy with a retention schedule and destruction guidelines; 15(b), requiring written consent for the collection of biometric data; and 15(e), requiring reasonable care in storing, transmitting, and protecting biometric data.
The case was remanded to the Circuit Court for proceedings consistent with the opinion. Justice Harris delivered the opinion of the Illinois Court of Appeals; Justice Mikva and Justice Oden Johnson concurred.
Edited by Tom Hagy and Yamile Nesrala for MoginRubin LLP