Bloomberg Law
Feb. 10, 2023, 9:00 AM

What to Expect from Biometric Info Privacy Litigation in Illinois

Kristine Argentine
Kristine Argentine
Seyfarth Shaw
Paul Yovanic
Paul Yovanic
Seyfarth Shaw

Following an exceptional year of litigation, the Illinois Biometric Information Privacy Act remains the only standalone US biometric privacy statute with a private right of action, steep statutory fines, and an attorneys’ fee provision.

And though BIPA standards have long been undeveloped, the landscape continues to take shape and recent decisions signal more litigation to come.

Statute of Limitation

For years, litigators eagerly awaited final word on the appropriate statute of limitation for BIPA claims. Last month, the Illinois Supreme Court finally weighed in on Tims v. Black Horse Carriers and decided that the general five-year statute of limitation under 735 ILCS 5/13-205 applies to all BIPA claims. In hindsight, the decision comes as no surprise.

At the oral argument last September, Illinois Supreme Court Justice Michael Burke commented that the appellate court’s decision to apply different limitations for different subsections of BIPA seemed “unworkable.”

The court reminded that the purpose of a limitations period is “to reduce uncertainty and create finality in the administration of justice” and that “[t]he appellate court’s decision to invoke two different statutes of limitations to different [sections of BIPA] does not align with this purpose.”

In its decision to apply the five-year statute of limitation to all BIPA claims, the court pointed to statutory construction. Since Sections 15(a), (b), and (e) contain no words that suggest meaning publication, there was no support that such claims could fall under the limited one-year statute of limitations under 735 ILCS 5/13-201.

And while the court recognized that the one-year statute of limitation could be applied to Sections 15(c) and (d), given its publication-esque buzzwords, it referred back to legislative intent and purpose and its unwillingness to split claims like the appellate court, holding that “it would be best to apply the five-year catchall limitations period” for BIPA.

The court concluded that “because [BIPA] does not have its own limitations period; because subsections are causes of action ‘not otherwise provided for’ [citing the 5-year language of § 13-205]; and because we must ensure certainty, predictability, and uniformity as to when the limitations period expires in each subsection,” the appropriate limitation period is five years.

What’s Coming

With a large majority of the lawsuits stayed while the Tims decision was on appeal, plaintiffs will likely move to lift the stay in the days and weeks to come, forcing businesses to defend or settle lawsuits at an overwhelming rate.

But another key matter currently on appeal is Cothron v. White Castle, which will determine whether claims asserted under Sections 15(b) and 15(d) of BIPA accrue only once upon the initial collection or disclosure of biometric information, or each time a private entity collects or discloses biometric information. Resolution of claim accrual is crucial for BIPA litigation.

For example, suppose the court decides that a claim accrues upon each scan without addressing the damages component—i.e., whether a separate statutory damage exists for each scan. In that case, penalties for even the smallest companies could be astronomical.

Though such a damages theory would likely run afoul of due process considerations, courts may be inclined to hold off on lifting stays until the Illinois Supreme Court decides Cothron, likely this quarter.

To the extent that Cothron does not address the damages component, the issue is likely to cause another round of delays in BIPA litigation while the issue works its way through the Illinois appellate system.

Business Response

But now that many initial procedural issues are, or will soon be, decided, businesses will have to find creative ways to defeat BIPA claims. Indeed, BIPA provides for a limited number of exemptions, some of which have already been successful.

For example, the court in Powell v. DePaul University dismissed a BIPA lawsuit because the university is ‘engage[d] in student aid and lending funds,’ making it a financial institution subject to Title V of the GLBA and exempt from BIPA.

The court in Svoboda v. Frames for America, Inc. dismissed a BIPA lawsuit under the health care exemption where defendant used a virtual try-on feature to try on glasses, whereas the court equated the feature to services similarly offered in optometrists’ offices.

Another way for defendants to combat BIPA lawsuits is to consider how biometric information is collected and whether the collection is connected enough to Illinois to give rise to a claim.

For example, in Vance v. Microsoft Corp., the court granted summary judgment in favor of Microsoft because, relying on the Illinois extraterritoriality doctrine, the biometric information was not captured or collected by Microsoft agents in Illinois—thereby making “any connection between Microsoft’s conduct and Illinois [ ] too attenuated and de minimis for a reasonable juror to find that the circumstances underlying Microsoft’s alleged BIPA violation ‘occurred primarily and substantively in Illinois.’”

Both sides will continue to seek a competitive advantage in an otherwise underdeveloped statute. With more than 250 BIPA actions filed in 2022, litigation will continue at a strong pace.

Plaintiffs will continue to creatively apply BIPA—as with the shift from biometric time clocks to other technologies and industries—and will remain focused on business use of virtual try-on, voice recognition technologies, and other artificial intelligence technology that scans or recognizes photos or videos.

And businesses will look to minimize exposure under the statute—or at least raise those arguments to create appellate issues so to provide greater clarity on the law.

This article does not necessarily reflect the opinion of Bloomberg Industry Group, Inc., the publisher of Bloomberg Law and Bloomberg Tax, or its owners.

Write for Us: Author Guidelines

Author Information

Kristine Argentine is a partner in Seyfarth Shaw’s consumer class actions practice, with a focus on consumer class action defense, complex commercial disputes, trade secrets, restrictive covenants, and fraud.

Paul Yovanic is an associate in Seyfarth Shaw’s commercial litigation practice.