On September 17, 2021, the First District of the Illinois Appellate Court (which covers Cook County) issued a highly anticipated opinion answering the question of what statute of limitations applies to claims brought under the Illinois Biometric Information Privacy Act (BIPA), a statute that has spawned thousands of class actions in Illinois. The court handled the issue by dividing the statute and applying different limitations periods to different sections of the statute that have been the basis for plaintiffs’ claims under BIPA.
According to the court, the one-year statute of limitations under Section 13-201 of the Illinois Code of Civil Procedure “does not encompass all privacy actions but only those where publication is an essential element or inherent part of the action.” The court explained that, of five potential claims under BIPA, “at least three of them have absolutely no element of publication or dissemination.” These include:
- Section 15(a) claims for a company’s failure to develop a written policy establishing a retention schedule and destruction guidelines for biometric information;
- Section 15(b) claims for a company’s failure to first obtain written notice and consent before collecting biometric information; and
- Section 15(e) claims for a company’s failure to take reasonable care in storing, transmitting, and protecting biometric information.
For each of these three sections of BIPA, the court applied the catch-all five-year statute of limitations in Section 13-205 of the Illinois Code of Civil Procedure.
In contrast, the court held that a one-year statute of limitations applied to some BIPA claims. The court held that the one-year statute of limitations applied to claims under Sections 15(c), which forbids a party to “sell, lease, trade[,] or otherwise profit from” biometric data, and 15(d), which prohibits “disclosing or otherwise disseminating” biometric information. In applying a shorter limitations period to claims under Sections 15(c) and 15(d), the court reasoned that “publication or disclosure of biometric data is clearly an element” of claims under those sections.
While this is the first appellate guidance on this topic, it likely is not the last. Other districts of the Illinois Appellate Court are currently weighing similar arguments in other BIPA litigation, including whether a two-year statute of limitations also may apply. It seems likely that the Illinois Supreme Court will ultimately weigh in on this issue. Regardless, the Illinois Appellate Court’s decision is another reminder of the importance of compliance with BIPA and other state-law regimes governing biometric data. Nixon Peabody assists clients in numerous business sectors to ensure compliance with biometric privacy laws and avoid or mitigate potential liability.