In a unanimous decision, the Illinois Supreme Court held that an appellate court erred “in applying two different statutes of limitations” to Illinois’ Biometric Information and Privacy Act (BIPA). Accordingly, all BIPA claims are subject to a uniform five-year statute of limitations.
Background
It is now well established in Illinois that BIPA requires private entities to follow certain consent, notice and disclosure procedures when collecting, storing or using individuals’ biometric data. BIPA’s legislative text, however, does not include an express statute of limitations. Thus, before the recent decision in Tims v. Black Horse Carriers, Inc., lower courts in Illinois had no guidance on what limitations period applied to BIPA claims.
In 2019, the Circuit Court of Cook County held in Tims that the absence of an express limitations period in the statute means the five-year catchall limitations period of the Illinois Code of Civil Procedure applied. The Illinois Appellate Court for the First Judicial District overturned this decision and held that two separate statutes of limitations apply to BIPA. The Appellate Court ruled that a five-year statute of limitations applied to claims under BIPA Sections 15(a)-(b) and (e), while the one-year statute of limitations applied to Sections 15(c) and (d) because “publication … is clearly an element.” Under this ruling, which limitations period applied was claim dependent.
Illinois Supreme Court
On Feb. 2, 2023, the Supreme Court of Illinois overturned the Appellate Court’s piecemeal approach and held that a five-year limitations period controls all claims under BIPA.
The Supreme Court provided four reasons for this determination: (1) one uniform limitations period should govern the act; (2) the plain language of BIPA and the legislature’s intent encourage a five-year limitations period; (3) BIPA does not provide a statute of limitations; and (4) the biometric policy concerns articulated by the General Assembly within the BIPA statute (discussed below) align with a longer limitations period.
First, one limitations period “reduces uncertainty and create[s] finality and predictability in the administration of justice.” Applying two separate limitations runs contrary to this consideration. If two limitations periods were applied, future litigants may be confused about when claims are time-barred. The Supreme Court highlighted a hypothetical where the same facts could support causes of action under more than one subsection of BIPA. A uniform statute of limitations would avoid any confusion as to which limitations period applies to each of the plaintiff’s BIPA claims. “Because statutes should be interpreted with the presumption that the legislature did not intend absurd, inconvenient, or unjust consequences when enacting the statute,” the Supreme Court rejected the application of two statutes of limitations to BIPA.
Second, BIPA was enacted to regulate the collection, use, safeguarding, handling, storage, retention and destruction of biometric identifiers and information. BIPA Sections 15(a)-(e) all regulate similar conduct: “the collection, retention, disclosure, and destruction of biometric identifiers and biometric information.” Accordingly, the Supreme Court held that, when considering “the plain language, intent of the legislature, the purposes to be achieved by the statute, and the fact that there is no limitations period in BIPA,” it would be best to apply the five-year statute of limitations.
Third, BIPA does not contain a limitations period. The Supreme Court noted how Illinois courts “routinely” apply the five-year catchall limitations period to other statutes that do not have a limitations period. Thus, the court reasoned, because BIPA lacks a specific limitations period, the five-year catchall limitations period applies.
Fourth, a five-year statute of limitations also aligns with the General Assembly’s policy concerns as articulated in the preamble of the BIPA statute. The General Assembly listed BIPA’s goals, including securing the public welfare, security, and safety of the public by regulating the collection, use, safeguarding, handling, storage, retention and destruction of biometric identifiers and information. The General Assembly also found that a majority of the public was weary of the use of biometrics when such information is tied to finances and other personal information. The Supreme Court held that shortening the time that an aggrieved party would have to assert claims would thwart this expressly articulated legislative intent.
Takeaways for Employers
Illinois employers are cautioned that, in light of the Tims decision, a five-year statute of limitations will apply to BIPA claims going forward. While clarity is a positive aspect, this ruling expands the BIPA limitations period to the maximum possible length, which may increase liability for BIPA violations, and was a unanimous ruling by the Illinois Supreme Court (albeit with two newly elected justices not participating). The court’s broad interpretation of BIPA’s statute of limitations continues a history of liberally construing the statute and may signal how the court will interpret other BIPA provisions and issues in future rulings. Therefore, Illinois employers would be especially wise to continue to adhere to BIPA’s requirements and to revisit their policies and procedures to ensure they are doing so.
For further information on or questions regarding BIPA’s requirements or the topics covered in this legal alert, please contact the authors, your McGuireWoods contact or a member of the firm’s labor and employment team.