Illinois Biometric Information Privacy Act: Litigation Update

As the use of facial recognition and other biometric technology expands, so too has litigation under the Illinois Biometric Information Privacy Act (BIPA). Nearly 2,000 cases have been filed, the vast majority of them in Illinois. Late last year, the Illinois First District Appellate Court issued two key decisions. On September 17, 2021, the First District Appellate Court clarified the applicable statute of limitations period for BIPA claims. Depending on the purported violation, the statute of limitations period is either one year or five years. In Tims v. Black Horse Carriers, Inc., 2021 IL App (1st) 200563, the court held that claims under section 15(c) and (d), prohibiting the sale and disclosure of biometric information, have a one-year statute of limitations period. Id. ⁋ 33. The court noted that Illinois establishes a one-year limitation period for "[a]ctions for slander, libel or for publication of matter violating the right of privacy." Id. ⁋ 20. Because selling and disclosing have a publication element, BIPA claims under section 15(c) and (d) are subject to a one-year statute of limitations. Id. ⁋ 32. On the other hand, claims under section 15(a), (b), and (e), requiring developing a written policy on the handling of biometric information, informing a person in writing that biometric information is being collected or stored, and using reasonable care to store and protect biometric information, do not have a publication component. Id. ⁋ 31. As a result, claims under those provisions are subject to the catchall five-year statute of limitations. Id. ⁋ 33. A petition for leave to appeal to the Illinois Supreme Court has been filed but not yet ruled upon by the court. Several months later, the First District Appellate Court published another significant decision, this time on the accrual date for a section 15(b) claim. On December 15, 2021, the court held in Watson v. Legacy Healthcare Financial Services, LLC, 2021 IL App (1st) 210279, that a section 15(b) claim accrues "each and every" time a defendant captures and uses biometric information. Id. ⁋ 60. In Watson, the plaintiff sued his former employers under BIPA because he was required to place his hand on a panel to be scanned each time he clocked in and out of work. Id. ⁋ 9. This was the authentication method used during the plaintiff's employment, which began in 2012 and ended in 2019. Id. The employers argued that the lawsuit is time-barred because the BIPA claims accrued on the first day they collected the plaintiff's biometric information in 2012. Id. ⁋ 13. The plaintiff, however, contended that his lawsuit is not time-barred because the BIPA claims accrued with each capture of his biometric information that the employers obtained without providing notice or obtaining consent. Id. ⁋ 14. The court agreed with the plaintiff and concluded that a section 15(b) claim accrued "each and every" time the employers captured and used biometric information. Id. ⁋ 60. A petition for leave to appeal to the Illinois Supreme Court has been filed and remains pending. Five days after the Watson decision, on December 20, 2021, the Seventh Circuit Court of Appeals stayed its proceedings in Cothron v. White Castle System, Inc., No. 20-3202 (7th Cir. 2021), and certified the following question to the Illinois Supreme Court:

Do section 15(b) and 15(d) claims accrue each time a private entity scans a person's biometric identifier and each time a private entity transmits such a scan to a third party, respectively, or only upon the first scan and first transmission?