One of the recurring questions about Illinois’ Biometric Information Privacy Act (BIPA) is how much time a would-be plaintiff gets to file a lawsuit. One Illinois appellate court has finally taken steps towards settling this important issue.
In Tims v. Black Horse Carriers, Inc. (2021 IL App (1st) 200563), the plaintiff alleged that his defendant-employer violated BIPA through the improper use of fingerprint scanning for employee timekeeping. The principal plaintiff stopped working for the defendant in January 2018, and the lawsuit was not filed until March 2019. The defendant moved to dismiss on statute-of-limitations grounds, and the trial court granted an interlocutory appeal on the issue.
BIPA itself has no limitations period, but other Illinois laws set various default periods. The issue is whether to apply the 1-year period for “for publication of matter violating the right of privacy” under 735 ILCS 5/13- 201 or the 5-year for “all civil actions not otherwise provided for” under 735 ILCS 5/13- 205.
The appellate court reasoned that although BIPA protects a right to privacy, but not all BIPA violations involve “publication of matter.” For the court, this was the key. BIPA itself specifies five different duties, at 740 ILCS 14/15. To summarize:
(a) Duty to establish a retention schedule and destruction guidelines.
(b) Forbidding collection biometrics without written consent.
(c) Forbidding the sale of biometrics.
(d) Forbidding disclosure of biometrics without written consent.
(e) Duty of care in storing biometrics.
The court ultimately determined that (a) making retention schedules, (b) collecting biometrics, and (e) storing biometrics do *not* involve “publication of matter,” and so, these causes of action have a 5-year limitations period. On the other hand, (c) selling biometrics, and (d) disclosing biometrics *do* have an element of publication, and so these causes of action have just a 1-year limitations period. For now, the case has been remanded to the trial court, and it is unknown whether either party will appeal to the Illinois Supreme Court. However, at the moment, this decision will likely serve as an easy precedent for other courts to follow. Any would-be defendants who were relying on a uniform 1-year limitations period should tread cautiously and be prepared. Any would-be plaintiffs who were counting on a uniform 5-year limitations period should act quickly. And anyone who plans collects biometric data in the future should take care to have a retention and disposal policy in place, as well as the appropriate notices and waivers, so as not to end up in court in the first place.