Illinois High Court Sets Five-Year Privacy Violation Window (1)

The Illinois Supreme Court on Thursday held the state’s biometric privacy law allows complainants to bring claims within five years of an alleged violation, potentially increasing employer exposure to liability under the statute.

The decision is the first of two highly anticipated rulings from the state’s high court in 2023 on the scope of liability for entities using biometric technology under the Illinois Biometric Information Privacy Act.

The high court reversed in part an appellate ruling that said a one-year statute of limitations period applied to some claims under the statute and a five-year period applied to other claims.

Applying two different time limitations to different sections of the law “would create an unclear, inconvenient, inconsistent, and potentially unworkable regime as it pertains to the administration of justice for claims under the Act,” Justice P. Scott Neville Jr. wrote for the court.

The state legislature’s policy concerns are accomplished by applying a longer limitations period, he wrote.

Still to come is the court’s ruling in Cothron v. White Castle System Inc., where the court will decide whether workers have separate claims for each swipe of their fingerprints into the company’s timekeeping system or just a single claim for the initial scan.

One Year or Five?

The high court’s ruling keeps alive a case in which Jorome Tims alleged his former employer, Black Horse Carriers, a unit of Penske Corp. Inc., violated two sections of the BIPA when it scanned his fingerprint to clock him into and out of work.

Black Horse claimed the case should be governed by the one-year limitations period for violations of privacy rights contained in a separate section of the state law. If the one-year limitation was effective, the company argued the plaintiff didn’t file his complaint in a timely fashion. The plaintiffs responded that Illinois law’s five-year catchall limitations period should apply to their claims.

Writing for a unanimous court, Neville Jr. said all claims under the BIPA fall within the purview of the five-year limitations period.

Practical Effect

The ruling is unlikely to result in a significant increase in liability for entities facing claims under the BIPA, said Jason Rosenthal, a principal with Much Shelist PC in Chicago.

This is because most claims under the statute that would have had a one-year statute of limitations period under the court of appeals ruling were paired with claims that had a five-year statute of limitations period, he said.

“In most cases, if a party isn’t complying with one section of the BIPA, it usually isn’t in compliance with any,” he said. “In terms of straightforward liability, I don’t think this will have a major impact on pending lawsuits.”

The liability impact would be increased if the courts were to determine that a violation of each subsection of the statute constituted a separate violation for liability purposes, Rosenthal said.

The ruling would then have the effect of preserving claims that would have been thrown out under a one-year statute of limitations, he said.

But the courts haven’t reached that issue yet.

The case is Tims v. Black Horse Carriers Inc., Ill., No. 2023 IL 127801, opinion 2/2/23.