An Illinois court has issued the first appellate guidance on the statute of limitations for a case brought under Illinois’ Biometric Information Privacy Act (“BIPA”). In assessing whether a one-year or five-year statute of limitations period applies to BIPA claims, the court found that the applicable period varies depending on the nature of the claim alleged. Specifically, the court concluded that the statute of limitations for claims brought under BIPA sections 15(a) (requiring development of public retention and destruction policy for biometric data), 15(b) (requiring informed consent to collect biometric data), and 15(e) (requiring safeguarding of biometric data) is five years, while the statute of limitations for claims brought under BIPA sections 15(c) (prohibiting entities from selling or otherwise profiting from biometric data) and 15(d) (requiring consent to disclose biometric data) is just one year.
Because BIPA is silent on statutes of limitations, plaintiffs and defendants have sought to rely on other Illinois law to influence courts. Defendants have argued that the applicable period is set forth in in 735 ILCS 5/13-201, which prescribes a one-year limitation period for slander, libel, or “publication of matter violating the right of privacy.” Plaintiffs, meanwhile, have pointed to 735 ILCS 5/13-205, which is a catch-all provision that sets a five-year limitation period for “all civil actions not otherwise provided for.”
In Tims v. Black Horse Carriers, Inc., on a rare interlocutory appeal, a three-judge panel of the Illinois First District Appellate Court held that section 13-201 does not apply to all “privacy” claims, but rather only to those “where publication is an element or inherent part of the action.” The court reasoned that the legislature’s inclusion of “for publication of matter violating the right of privacy” clearly and unambiguously circumscribed its application, and thus did not consider legislative history. The court then examined the nature of the various BIPA sections and found that only BIPA sections 15(c) and 15(d)—both of which involve the sale or disclosure of data—fall within this scope. In contrast, the court reasoned that BIPA sections 15(a), 15(b), and 15(e)—all of which involve data collection and storage—“have absolutely no element of publication or dissemination” and thus cannot fall within the one-year statute prescribed by section 13-201. As a result, claims brought under 15(a), 15(b), and 15(e) are governed by the catch-all five-year statute of limitations in section 13-205.
While the appellate court remanded the case to the circuit court to apply this guidance and determine which, if any, of the plaintiffs’ claims in Tims are time-barred (for example, the appellate court did not opine on the all-important issue of claim accrual), it is expected that this ruling will be appealed to the Illinois Supreme Court. As long as this ruling stands, the negative implications for companies facing BIPA litigation far outweigh the positives. While defendants may now move to dismiss as untimely any claim brought under BIPA sections 15(c) or 15(d) if the case is brought more than one year after the alleged harm occurred, defendants face a lengthy five-year period for the claims that were already a favorite of the plaintiffs’ bar.
