Illinois Supreme Court Sets Statute of Limitations for BIPA Claims

The Illinois Supreme Court has ruled that the state’s Biometric Information Privacy Act (BIPA) has a five-year statute of limitations. The decision is the result of a proposed class action lawsuit against Black Horse Carriers, a logistics firm that is alleged to have violated BIPA through its collection and handling of biometric data from its drivers.

The lawsuit was brought in 2019, alleging that Black Horse had collected its drivers’ fingerprint biometrics and shared the data with a third party contractor without obtaining the drivers’ written consent, as required under BIPA.

In 2021, an Illinois court ruled that BIPA claims involving unlawful information disclosures have a statute of limitations of one year, whereas claims stemming from issues of notice, consent, and data retention have a five-year window. Black Horse appealed that ruling, arguing that only the one-year limitation should apply to BIPA cases.

The Illinois Chamber of Commerce agreed. In an amicus brief filing in the Illinois Supreme Court hearing, the Chamber warned that a five-year statute would lead to “potentially catastrophic damages” for companies. But the Court has reached the unanimous 5-0 conclusion that a five-year statute of limitations would better serve the public interest that had been intended in the establishment of the Biometric Information Privacy Act.

One of the Justices, P. Scott Neville, added that establishing different limitations periods to different kinds of BIPA claims “would create an unclear, inconvenient, inconsistent, and potentially unworkable regime.”

First instituted in 2008, BIPA has seen a swell of cases in recent years, leading some observers to call BIPA lawsuits a kind of legal cottage industry. The wide-ranging privacy law has already resulted in almost 2,000 lawsuits since 2017, sometimes resulting in multimillion-dollar settlements from high-profile companies.

BIPA produced its first jury trial, in a lawsuit against BNSF Railway, last fall, resulting in a penalty against the company that could amount to $228 million.

Source: Reuters

–

February 3, 2023 – by Alex Perala