March 27, 2023

Volume XIII, Number 86


March 24, 2023

Subscribe to Latest Legal News and Analysis

Illinois Supreme Court Rules on BIPA Class Action Lawsuit

On February 2, 2023, the Illinois Supreme Court reversed in part and remanded a judgment of the lower appellate court in a class action lawsuit alleging violation of the Illinois Biometric Information Privacy Act (“BIPA”).

In Jorome Tims v. Black Horse Carriers, Inc., Jorome Tims sued his former employer, Black Horse, and alleged that it violated (1) Section 15(a) of BIPA by failing to institute, maintain and adhere to a publicly available biometric information retention and destruction policy; (2) Section 15(b) of BIPA by failing to provide notice and to obtain consent when collecting his biometric information; and (3) Section 15(d) of BIPA by disclosing or otherwise disseminating his biometric information to third parties without consent.

The lower appellate court had ruled that two different limitations periods apply to a cause of action under BIPA: the one-year limitations period in 735 ILCS 5/13-201 (applicable to defamation torts) and the five-year “catchall” limitations period in 735 ILCS 5/13-205. The appellate court reasoned that the one-year limitations period applies to claims based on section 15(c) and 15(d) of the Act where “publication or disclosure of biometric data is clearly an element” of the claim, and the five-year limitations period applies to section 15(a), 15(b), and 15(e) of the Act because “no element of publication or dissemination” exists in those claims.

The Illinois Supreme Court found that the appellate court erred when it applied two different limitations periods to a cause of action under BIPA, and that the five-year limitations period contained in section 13-205 of the Code controls claims under BIPA.

Because BIPA itself does not specify a statute of limitations, this case provides significant guidance to future BIPA cases.

Copyright © 2023, Hunton Andrews Kurth LLP. All Rights Reserved.National Law Review, Volume XIII, Number 37

About this Author

In today’s digital economy, companies face unprecedented challenges in managing privacy and cybersecurity risks associated with the collection, use and disclosure of personal information about their customers and employees. The complex framework of global legal requirements impacting the collection, use and disclosure of personal information makes it imperative that modern businesses have a sophisticated understanding of the issues if they want to effectively compete in today’s economy.

Hunton Andrews Kurth LLP’s privacy and cybersecurity practice helps companies manage data and...

212 309 1223 direct