Illinois’ Highest Court Holds That BIPA Claims are Subject to a Five-Year Statute of Limitations, Not One Year

In a significant shift in law, the Illinois Supreme Court recently held that all claims under the Biometric Information Privacy Act (BIPA) are subject to a five-year statute of limitations. This reverses prior case law that required certain BIPA claims to be asserted within one year of the alleged violations. This change in law substantially increases potential liability for employers and businesses operating in Illinois.

On February 2, 2023, in Tims v. Black Horse Carriers, Inc., the Illinois Supreme Court rejected the intermediate appellate court’s ruling that a one-year statute of limitations applies to claims brought under some sections of BIPA, whereas a five-year statute of limitations applies to claims brought under other sections. The court held that the five-year period applies to all BIPA claims. 

BIPA does not have its own statute of limitations. As a result, in Tims, the defendant Black Horse contended that the one-year statute of limitations set forth at 735 ILCS 5/13-201 was the proper limitations period because it applies to “[a]ctions for slander, libel or for publication of a matter violating the right to privacy.” In contrast, the plaintiffs contended that the five-year catch-all statute of limitations set forth at 735 ILCS 5/13-205 applied. The appellate court, in a Solomonic ruling that left neither side happy, held that both limitations periods applied: the one-year limitations period applied to claims under those sections of BIPA that involved “publication” of biometric data (BIPA sections 15(c) and 15(d)), and the five-year limitations period applied to claims under the remaining sections of BIPA that did not involve publication (BIPA sections 15(a), 15(d) and 15(e)).

Defendant Black Horse argued that the one-year limitations period should apply to all BIPA claims because the purpose of BIPA is to protect against the unauthorized or otherwise wrongful disclosure of biometric data – and, therefore, all of BIPA’s sections relate to or concern the publication of biometric data. According to Black Horse, even the sections of BIPA that do not explicitly reference disclosure of biometric data to third parties – such as provisions requiring entities to have written policies and retention schedules regarding biometric information – were intended to be prophylactic measures that work together to protect individuals’ biometric data from disclosure.  

The Illinois Supreme Court rejected both of Black Horse’s arguments and the appellate court’s application of different limitation periods to different BIPA claims.  As a threshold matter, the court explained that, in order to reduce uncertainty and create finality and predictability, it would apply a single limitations period to all claims under BIPA. While conceding that “an argument can be made” that claims under BIPA sections 15(c) and 15(d) involve publication such that a one-year limitations period could be applied, the court decided “it would be best” to apply Illinois’ five-year catch-all limitations period to all claims in light of the legislature’s intent, the statutory purposes, and the lack of express limitations period in the BIPA statute.

In light of this Tims holding, Illinois employers and other businesses now face increasing uncertainty regarding potential exposure to BIPA claims. In addition, the increased limitations period will increase the size of potential classes of plaintiffs, which will impact the cost and complexity of litigation. This decision will amplify the existing incentives that prompt BIPA plaintiffs to litigate any instance of non-compliant practices, irrespective of whether biometric data was at risk.

Katten’s Biometric Litigation Team is closely following this issue and can help with questions about BIPA, the Tims decision, or biometric data protection issues in other jurisdictions.