Illinois’ biometric privacy law strengthened by latest high court ruling

SPRINGFIELD – People who’ve been subject to fingerprinting, face or retinal scans as either employees or customers of Illinois companies have five years to file lawsuits if they believe the business violated a stringent state privacy law, the Illinois Supreme Court ruled this week.

It’s the latest in a handful of cases that have reached Illinois’ high court in recent years, all refining the state’s Biometric Information Privacy Act. Also known as BIPA, the first-of-its-kind law has, since 2008, made Illinois the only state that grants a private right of action to sue over the improper collection and mishandling of biometric data.

The justices on Thursday ruled BIPA has an unequivocal five-year statute of limitations on all claims under the law – not a one-year window as employers and business groups had hoped for.

In this case, logistics company Black Horse Carriers Inc., which has since been acquired by trucking giant Penske, faced a class action lawsuit. A former employee initiated the suit, alleging the company violated BIPA by requiring time clock fingerprint authentication without maintaining a publicly available policy on how the company would treat employees’ biometric data.

The suit also claimed Black Horse failed to provide notice to employees that the timeclock was collecting their fingerprints, and didn’t explicitly get employees’ consent. The company argued the court should’ve applied the one-year statute of limitations under Illinois’ Right of Publicity Act. But the court unanimously disagreed.

In issuing a blanket five-year statute of limitations for all BIPA claims, the 5-0 majority of the court emphasized that “the full ramifications of the harms associated with biometric technology is unknown.” Without the law, the court wrote, individuals whose biometric data was improperly collected or disseminated might never even know it – at least until they felt the consequences.

“We find that a longer limitations period would comport with the public welfare and safety aims of the General Assembly by allowing an aggrieved party sufficient time to discover the violation and take action,” the court ruled.

Danielle Kays, an attorney with Chicago-based firm Seyfarth Shaw LLP with experience in cases involving biometric information, said employers like her clients were already working under the assumption that a five-year statute of limitations was likely to prevail. But this week’s ruling, she said, provides more clarity in a law that’s still taking shape in a sea of legal challenges.

Nearly 1.5 million Illinoisans were eligible for their share of a $650 million class action settlement with Facebook under BIPA in 2020, a five-year case that was one of the first among thousands of suits filed under the law, with the trend really taking off around 2018, Kays said.

She said she advises clients to stay on top of compliance that may evolve with each major decision, including this week’s, which solidifies a five-year statute of limitations.

“Many cases have been stayed waiting for those decisions,” Kays said. “So there are many factual and legal defenses that have not been litigated still.”

Thursday’s opinion was another legal victory for proponents of BIPA – especially a handful of law firms specializing in filing class action cases over biometric data. Those attorneys have made the same basic argument in thousands of lawsuits over the last several years: if someone’s identity is stolen, they can obtain a new social security number. But if their biometric data is stolen, it’s impossible to get a new fingerprint or face.

So far, Illinois’ high court has agreed – as did a federal jury in October, granting $228 million in damages in a class action BIPA case against BNSF Railways, the first jury test of the law.

The Black Horse Carriers case was argued in front of the court in September, but Kays and other attorneys involved in BIPA litigation are waiting on an even more consequential decision in a class action suit against fast food chain White Castle.

In that case, the court is being asked to decide whether each time an employee clocks in and out using his or her fingerprint constitutes a separate violation of BIPA. Such a ruling could prove extremely costly to employers, as damages under the law start at $1,000 for negligent violations and $5,000 for violations deemed “reckless.”