Judges Define Statute of Limitations for BIPA Lawsuits

The Illinois First District Appellate Court has issued a ruling that sets clearer guidelines for those filing a civil suit under the Biometric Information Privacy Act. The ruling comes from a three-judge panel in Chicago, and specifically concerns a dispute between the Black Horse Carriers trucking company and a pair of former Black Horse drivers.

The drivers had filed their initial suit in 2019, alleging that Black Horse had violated BIPA by gathering and storing their fingerprint data without the proper consent. They also accused Black Horse of unlawfully sharing that biometric data with a third party timekeeping company.

For its part, Black Horse moved to dismiss the case on procedural grounds. BIPA does not provide a statute of limitations for biometric cases, and instead refers to the existing Illinois Code of Civil Procedure. That code lays out a one-year statute of limitations for issues of slander, libel, and unlawful privacy disclosures, and a five-year statute of limitations for all other civil matters.

Black Horse claimed that the plaintiff’s complaint was moot because it described an unlawful disclosure violation, and detailed actions that occurred more than a year before the suit was filed. A state judge disagreed with that assessment, and applied the full five-year statute of limitations to the case.

The appellate court, on the other hand, decided to split the difference. The judges ruled that Black Horse’s sharing of information with the timekeeping company met the legal definition of publication as a private communication between two parties, and was therefore subject to the one-year statute of limitations. However, they said that the same was not true of the consent and data retention violations, which was more of an internal transgression.

In doing so, they settled one of the primary procedural debates of the BIPA era. Plaintiffs have five years to bring a legal action against a company that unlawfully collects or stores biometric data, and one year to bring a suit against a company that simply shares data improperly. The Black Horse plaintiffs, meanwhile, can now move forward with that part of their case.

The ruling comes shortly after a separate District Court decision that determined that BIPA laws still apply to products built with biometric data, even if a company is not selling the data itself. BIPA lawsuits have led to several major settlements in the past year, with TikTok and Facebook agreeing to pay $92 and $650 million in class action lawsuits, respectively.    

Source: Reuters

–

September 23, 2021 – by Eric Weiss