Illinois Appellate Court Clarifies Applicable Limitations Period in BIPA Class Action Litigation
On September 17, 2021, the Illinois Appellate Court First District delivered its much-anticipated decision in Tims v. Black Horse Carriers, Inc., 2021 IL App (1st) 200563 (1st Dist. Sep. 17, 2021), addressing the applicable statute of limitations for causes of action asserted under the Illinois Biometric Information Privacy Act (“BIPA”).
The court held that claims brought under Sections 15(a), (b), and (e)—pertaining to the law’s privacy policy/data destruction, notice/consent, and data security requirements—are subject to a five-year statute of limitations. Conversely, claims asserted under Sections 15(c) and (d)—relating to the law’s ban on profiting from biometric data and disclosure limitations—are subject to a one-year limitations period.
Importantly, in finding that BIPA’s two most commonly asserted provisions, Sections 15(a) and (b), are subject to the longer five-year limitations period, the opinion ensures that the tsunami of class action BIPA filings will continue to flood the courts for the foreseeable future.
Background
Section 13-201 of the Illinois Code of Civil Procedure provides a one-year statute of limitations for “[a]ctions for slander, libel or for publication of matter violating the right to privacy.” Section 13-205 provides a five-year limitations period for “all civil actions not otherwise provided for.” BIPA itself, however, does not provide an explicit limitations period in the text of the statute.
In Tims, the Illinois appellate court was tasked with determining whether BIPA claims are subject to a one-year limitations period under Section 13-201 or a five-year period under Section 13-205.
To date, trial courts that have tackled this issue have found in almost uniform fashion that the five-year catchall limitations period applies to all BIPA claims. See Stauffer v. Innovative Heights Fairview Heights, LLC, 480 F.Supp.3d 888, 904-05 (S.D. Ill. 2020); Burlinski v. Top Golf USA Inc., 2020 WL 5253150, at *7 (N.D. Ill. Sep. 3, 2020); Quarles v. Pret A Manger (USA) Limited, 2021 WL 1614518, at *4 (N.D. Ill. Apr. 26, 2021); Robertson v. Hostmark Hosp. Group, Inc., 2019 WL 8640568, at *2-4 (Cook Cnty. July 31, 2019).
Section 15(a), (b), and (e) Claims Are Subject to a Five-Year Limitations Period
On appeal, the Tims court held that the longer, five-year catchall period applies to claims brought under Sections 15(a), (b), and (e).
BIPA Section 15(a) requires entities to develop a publicly available written policy establishing a retention schedule and guidelines for the permanent destruction of biometric data and to adhere to their retention schedules and destruction guidelines. Section 15(b) requires entities to provide notice and obtain consent before collecting any biometric data. And Section 15(e) requires entities to maintain reasonable security measures to safeguard biometric data.
In its opinion, the court noted that Section 13-201’s shorter one-year limitations for actions relating to “privacy violations” does not encompass all privacy actions, but rather only those that involve publication as an element or inherent part of the action. This includes claims pertaining to public disclosure of private facts, appropriation of the name and likeness of another, and false-light publicity—where publication is an element of each of these torts.
Applied to the context of BIPA, Sections 15(a), (b), and (e) do not involve claims “for publication of matter violating the right of privacy,” as a plaintiff could bring an action alleging violations of these three subparts of Section 15 without having to allege (let alone prove) that the defendant published or disclosed biometric data to any third party. Consequently, the one-year limitations period has no applicability Section 15(a), (b), and (e) causes of action. By default, then, the five-year catchall provision governs these claims.
Section 15(c) and (d) Claims Are Subject to a One-Year Limitations Period
The court held that the remaining two provisions—Sections 15(c) and (d)—are subject to a shorter, one-year limitations period.
Section 15(c) bars individuals or entities from selling, leasing, trading, or otherwise profiting from biometric data. Section 15(d) requires entities in possession of biometric data to obtain consent (or satisfy other prerequisites) before disclosing, redisclosing, or disseminating a person’s biometric data.
Here, the court reasoned that publication or disclosure of biometric data is “clearly” an element of a Section 15(d) claim, which is violated by disclosing or otherwise disseminating biometric data without first obtaining consent or satisfying other specified prerequisites. Similarly, Section 15(c) bars an entity from selling, leasing, trading, or otherwise profiting from biometric data—which also entails a publication, conveyance, or dissemination of such data. In other words, claims asserted under Sections 15(c) or (d) are actions “for publication of matter violating the right of privacy.”
Takeaways
At first glance, the Tims decision may seem to be a win for defendants as a result of its holding that the shorter, one-year limitations period applies on Section 15(c) and (d) claims—which diverges from the prior trial court decisions which found these claims to be subject to the five-year catchall limitations period. With that said, any “win” may ultimately be a pyrrhic one, as the opinion solidifies application of the much lengthier five-year limitations period for the two most-litigated provisions of Illinois’ biometric privacy statute—Sections 15(a) and (b).
Ultimately, Tims will likely have no appreciable impact on stemming the tide of BIPA class action filings that has continued apace since the Illinois Supreme Court’s January 2019 decision in Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197 (Ill. 2019), holding that plaintiffs do not have to suffer any actual injury or harm to pursue BIPA claims. Instead, companies that utilize biometrics in their operations should expect to see a continued flurry of BIPA class action filings moving forward.
Moreover, while Tims offers some level of clarity on the statute of limitations question, it is by no means the final word on this matter, as a second appeal also addressing this issue, Marion v. Ring Container Techs., LLC, No. 3-20-0184, remains pending in the Illinois Appellate Court Third District at this time. The Marion appeal is currently stayed pending the decision in another BIPA appeal, McDonald v. Symphony Bronzeville, No. 126511, where the Illinois Supreme Court will provide litigants with a definitive answer on whether BIPA claims are preempted by the Illinois Workers’ Compensation Act (“IWCA”). In addition, it is reasonably likely that the Tims decision itself may also be appealed to the Illinois Supreme Court. Thus, it may be some time before we have a definitive answer as to the applicable statute of limitations for BIPA causes of action.
Finally, companies must also take note of the brief but potentially consequential discussion by the Tims court on the issue of liquidated damages, which could have far-reaching consequences in future BIPA litigation by greatly expanding the scope of potential BIPA liability exposure even further. On this issue, the Tims court noted that because BIPA provides the ability for a prevailing party to recover for each violation, “a plaintiff who alleges and eventually proves [a] violation of multiple duties could collect multiple recoveries of liquidated damages.” For example, a plaintiff who proves a violation of Section 15(a)’s duty to establish a guidelines for the permanent destruction of biometric data, as well as a violation of the duty to adhere to those guidelines, may be entitled to two recoveries of liquidated damages, despite the fact that only one subpart of Section 15 has been violated.
© 2021 Blank Rome LLP. All rights reserved. Please contact Blank Rome for permission to reprint. Notice: The purpose of this update is to identify select developments that may be of interest to readers. The information contained herein is abridged and summarized from various sources, the accuracy and completeness of which cannot be assured. This update should not be construed as legal advice or opinion, and is not a substitute for the advice of counsel.
This client alert was reprinted in Class Action Reporter on November 16, 2021.