How Illinois Decided When a BIPA Claim Accrues, and How Long It Lasts

Two Questions the Statute Left Open

The Biometric Information Privacy Act sets out five obligations in section 15 and a private right of action in section 20 that lets a prevailing party recover liquidated damages “for each violation.” It says nothing about when a claim arises or how long a plaintiff has to bring it. Two decisions in 2023 supplied both answers, and the second produced a legislative response the following year.

Tims v. Black Horse Carriers and the Five-Year Period

The appellate court had split the Act. Reading 735 ILCS 5/13-201, which gives one year to actions for “publication of matter violating the right of privacy,” it held that sections 15(c) and 15(d)—which use the words sell, lease, trade, disclose, redisclose and disseminate—involve publication and drew the one-year period, while sections 15(a), 15(b) and 15(e) contain no word suggesting publication and drew the five-year catchall.

Notably, both parties asked the supreme court to reverse that. The defendant wanted one year for the whole Act; the plaintiffs wanted five. Neither wanted two.

In Tims v. Black Horse Carriers, Inc., 2023 IL 127801, decided February 2, 2023, the court did not hold that the appellate court had misread the words. It went the other way: relying on its own decision in West Bend, which found that publication carries more than one meaning—communication to the general public, or communication to one person—it acknowledged that an argument can be made that those verbs involve publication and that the one-year period could be applied to subsections (c) and (d).

What defeated the split was administrability. The same facts can support claims under more than one subsection, so a plaintiff could hold a timely claim under section 15(a) and a barred one under section 15(c) arising from a single course of conduct. Drawing on Sundance Homes, where the court had refused to bifurcate tax refund claims between law and equity, it concluded that maintaining two time-bar standards was inconsistent with legislative intent and would create an unclear, inconvenient and potentially unworkable regime.

The court added a reason for preferring the longer period specifically. Defamation carries a short limitations period because an aggrieved person is expected to become aware quickly that their reputation has been publicly compromised. Biometric disclosure is not like that: absent the Act's protections, it is unclear when or if an individual would ever discover the disclosure. Two justices took no part in the decision.

Cothron v. White Castle and Per-Scan Accrual

Cothron v. White Castle System, Inc., 2023 IL 128004 answered a question certified by the Seventh Circuit. Justice Rochford delivered the opinion for a four-justice majority; Justice Overstreet dissented, joined by Chief Justice Theis and Justice Holder White, and dissented again upon the denial of rehearing on July 18, 2023.

The majority's section 15(b) analysis rests on how the technology works rather than on privacy theory. White Castle argued that “collect” and “capture” describe gaining control, something that can happen only once. The court answered that a matching system cannot function that way: each time an employee scans a finger to reach a paystub or a computer, the system captures the print anew in order to compare it against the stored copy. The opinion also noted that White Castle had itself argued below that the plaintiff's claim accrued in 2008 with her first scan after the Act's enactment, a position that treats an authentication scan as a collection.

For section 15(d) the court declined to decide what “redisclose” means, holding that the other terms were broad enough on their own. “Disclose” also means to expose to view, and the dictionary's own example is of something happening more than once; and the subsection carries a catchall reaching any way an entity may “otherwise disseminate” the data.

The defendant's strongest argument was not textual. Citing Feltmeier, it argued that where there is a single overt act from which subsequent damages flow, limitations run from that act, and that the loss of control over one's biometrics is exactly such an act, because a person cannot keep information secret from an entity that already has it. The dissent adopted that framework.

The majority rejected it by returning to Rosenbach. None of the decisions White Castle cited had analyzed accrual at all. What Rosenbach held is that a person is aggrieved when a private entity fails to comply with one of section 15's requirements, and that the violation in itself supports the cause of action. If the statutory violation is the injury, then the injury is not confined to an initial loss of control, and nothing in the statute limits a claim to the first scan.

The Damages Consequence

White Castle told the court that if the plaintiff could proceed on behalf of as many as 9,500 current and former employees, class-wide damages might exceed $17 billion, and its amici called that annihilative liability. The majority did not dispute the arithmetic. It answered that where statutory language is clear it must be given effect “even though the consequences may be harsh, unjust, absurd or unwise.”

It then offered two qualifications that the arithmetic tends to obscure. Section 20 says a prevailing party “may recover,” which the court read as making damages discretionary rather than mandatory, and a trial court presiding over a class action possesses the discretion to fashion an award that compensates class members and deters future violations without destroying the defendant's business. There is, the court said, no language in the Act suggesting a legislative intent to authorize an award that would result in the financial destruction of a business.

The opinion closed by asking the legislature to review the policy concerns and make its intent regarding the assessment of damages clear.

The 2024 Amendment Response

Public Act 103-0769, enrolled as SB 2979, amended sections 10 and 20 and nothing else. Its two new subsections are not symmetrical.

• New section 20(b) reaches section 15(b): an entity that more than once obtains the same biometric identifier or information from the same person using the same method of collection commits a single violation, for which the aggrieved person is entitled to at most one recovery.
• New section 20(c) reaches section 15(d) and adds a further qualifier: the disclosures must be to the same recipient, and where they are, there is a single violation regardless of how many times the entity disclosed, redisclosed or disseminated the data.
• In section 10, the amendment defines “electronic signature” as an electronic sound, symbol or process attached to or logically associated with a record and executed or adopted with intent to sign, and adds that term to the definition of “written release.”

Section 20(a) is untouched, so the liquidated damages figures and the fee-shifting provision remain as enacted. Section 99 of the public act reads in full that the Act takes effect upon becoming law; the Illinois Compiled Statutes record the effective date as August 2, 2024.

What Remains Unresolved

The amendment does not answer Tims. The Act still contains no limitations provision of its own, which is precisely why the five-year catchall applies to it as an action “not otherwise provided for.” The legislature reopened both sections the accrual dispute concerned and added no period.

Nor does the amendment reach the whole Act. Sections 15(a), 15(c) and 15(e)—the retention schedule, the prohibition on profiting from biometric data, and the standard of care—are outside the new single-violation subsections.

Two textual limits inside the amendment remain to be construed. Both subsections are keyed to the “same method of collection,” a phrase the Act does not define, and section 20(c) requires identity of recipient as well. And the enrolled text carries no retroactivity clause of any kind, which leaves the application of the amendment to conduct predating August 2, 2024 to be worked out by the courts.

One thing the legislature did not adopt is the majority's own suggestion. Cothron's observation that damages under section 20 are discretionary, and that a trial court may calibrate an award, appears nowhere in the public act.

Frequently Asked Questions