Locke Lord QuickStudy: Illinois Supreme Court Says Five Year ‎Statute of Limitations for ‎BIPA Claims

Today, the Illinois Supreme Court issued its much anticipated decision in Tims v. Black Horse Motor Carriers, Inc.,^[1] deciding that the Biometric Information Privacy Act’s (“BIPA”) prohibition against sale of biometric data, or its disclosure or dissemination without consent, is subject to the state’s general, five-year statute of limitations, rather than the state’s one-year statute of limitations which applies to cases involving the alleged publication of private data.^[2]

In applying the five-year statute of limitations, the Court reasoned that “it would thwart legislative intent to (1) shorten the amount of time an aggrieved party would have to seek redress for a private entity’s noncompliance with the Act and (2) shorten the amount of time a private entity would be held liable for noncompliance with the Act.” ^[3]

Because BIPA is silent as to the applicable statute of limitations, courts were left to decide whether BIPA is subject to the state’s general five year statute of limitations, which applies to all civil cases unless otherwise prescribed by law; the state’s one year statute of limitations, which applies to alleged privacy violations involving publication; or some combination of the two. Tims clarifies that the two sections prohibiting the sale of biometric data or its disclosure or dissemination to third parties without consent^[4] is subject to the same five-year statute of limitations as the sections addressing policies on biometric data collection and retention.^[5]

Practical Implications. The Court’s opinion significantly increases the litigation exposure of private entities that allegedly sold or failed to obtain consent prior to disclosing or disseminating biometric data. The longer, five-year statute of limitations increases the number of potential plaintiffs, the scope and cost of litigation, and the likely statutory damages for each plaintiff. We continue to advise clients that the best defense is compliance.