New BIPA decision will have significant impact on insurers’ exposure

In an important new ruling, the Appellate Court of Illinois for the First District held that claims for unlawful trading of biometric data brought under section 15(c) of the Illinois Biometric Information Privacy Act (BIPA or Act), and for unlawful dissemination or disclosure of biometric data under section 15(d) of the Act, are subject to a one-year statute of limitations only. Tims v. Black Horse Carriers, Inc., 2021 IL App (1st) 200563 (Ill. App. Ct. Sept. 17, 2021).

Buttressed by the Illinois Supreme Court’s recent decision in West Bend, numerous BIPA lawsuits have been tendered to CGL insurance carriers under Coverage B for “personal and advertising injury” because of allegations of unlawful disclosure or dissemination of biometric data. Tims will impact coverage obligations and exposure under many of those policies. 

The Tims Decision. BIPA does not specify a limitations period. As a result, trial courts have wrestled with determining what statute of limitations period governs BIPA claims. Generally, parties have argued that one of the following three periods under the Illinois Code of Civil Procedure (the Code) apply:

• Section 13-201, which establishes a one-year limitations period for “[a]ctions for slander, libel or for publication of matter violating the right of privacy.” 735 ILCS 5/13-201.
• Section 13-202, which establishes a two-year limitations period for, among other things, “[a]ctions for damages for an injury to the person . . . or for a statutory penalty.” 735 ILCS 5/13-202.
• Section 13-205, which creates a five-year catch-all period for “all civil actions not otherwise provided for.” 735 ILCS 5/13-205.

Until Tims, no Illinois appellate court had determined which period governs BIPA claims.

The Tims lawsuit alleges that defendant Black Horse Carriers, Inc. unlawfully collected and used employees’ fingerprint scans for timekeeping purposes in violation of BIPA. Tims, 2021 IL App (1st) 200563, ¶ 5. It alleges that Black Horse violated BIPA by:

• Not properly informing plaintiffs and other employees of the purpose and length of its storage and use of their fingerprints;
• Not receiving a written release from plaintiffs and other employees to collect, store, and use their fingerprints;
• Not providing a retention schedule and guidelines for destroying the fingerprints of plaintiffs and other employees; and
• Not obtaining consent from plaintiffs and other employees to disclose or disseminate their fingerprints to third parties.

Id. ¶ 6.

Black Horse moved to dismiss the original complaint, arguing that the one-year limitation period for “[a]ctions . . . for publication of matter violating the right of privacy” under section 13-201 applied because BIPA’s purpose is to provide privacy protection. Id. ¶ 8. The trial court disagreed. Id. ¶ 11. The court reasoned that because plaintiff claimed that Black Horse violated BIPA’s various provisions, rather than claiming a general invasion of his privacy, the one-year statute of limitation under section 13-201 was inapplicable. Id. Instead, the catchall five-year statute of limitation under section 13-205 applied. Id. The trial court later certified its order for appeal. Id. ¶ 14.

On appeal, the appellate court focused its analysis on the express language of section 13-201 to determine its scope. Id. ¶¶ 19-21, 29. Section 13-201 establishes a one-year statute of limitation for, among other things, actions “for publication of matter violating the right of privacy.” Id. ¶ 20. Based on this language, the court concluded that section 13-201 did not apply to all privacy actions, but instead applied only to those actions where “publication is an element or inherent part of the action.” Id. ¶ 29 (emphasis added). The court stated:

[W]e find from the language of section 13-201 including actions “for publication of matter violating the right of privacy” (735 ILCS 5/13-201 (West 2018)) and from our decision in Benitez that section 13-201 does not encompass all privacy actions but only those where publication is an element or inherent part of the action. Had the legislature intended to include all privacy actions, it would have written something like “actions for slander, libel, or privacy” or “actions for slander, libel or violations of the right of privacy.” Similarly, had the legislature intended to include any privacy action that merely concerns or pertains to publication, it would have used such broad language rather the narrower “for publication.”

Id.

Looking to the causes of action under BIPA, the court concluded that “at least” sections 15(a), 15(b), and 15(e) of the Act “have absolutely no element of publication or dissemination.” Id. ¶ 31 (emphasis added). The court categorized those sections as follows:

A private party would violate section 15(a) by failing to develop a written policy establishing a retention schedule and destruction guidelines, section 15(b) by collecting or obtaining biometric data without written notice and release, or section 15(e) by not taking reasonable care in storing, transmitting, and protecting biometric data.

Id. As a result, the court concluded, the one-year statute of limitations under section 13-201 could not apply to those sections because a litigant could file a BIPA lawsuit under those sections without alleging or proving a disclosure or dissemination of any biometric data. Id. “Stated another way, an action under section 15(a), (b), or (e) of the Act is not an action ‘for publication of matter violating the right of privacy.’” Id. (emphasis added).

Conversely, the court held that sections 15(c) and 15(d) of BIPA require a showing of a publication or disclosure of biometric data in order to establish liability. Id. ¶ 32. Section 15(d) is violated by disclosing or otherwise disseminating biometric data absent specified prerequisites, such as consent. Id. Section 15(c) forbids a private party to “sell, lease, trade, or otherwise profit from” biometric data, conduct that the court opined “entails a publication, conveyance, or dissemination of such data.” Id. Due to the nature of these BIPA sections and their express language, the court concluded that “an action under section 15(c) or (d) is an action ‘for publication of matter violating the right of privacy,’” thereby implicating the one-year statute of limitation under section 13-201 for “[a]ctions for slander, libel or for publication of matter violating the right of privacy.” Id. §§ 32-33.

What this case means. For CGL insurers, restricting claims brought under sections 15(c) and 15(d) of BIPA to a one-year statute of limitation may significantly reduce CGL insurers’ exposure to BIPA litigation for several reasons.

• The decision could reduce the amounts of defense costs and settlements incurred in BIPA litigation in general.
• In addition, CGL insurers may have a stronger coverage defense for claims brought under sections 15(a), (b), and (e) under the theory that because those sections “have absolutely no element of publication or dissemination” and are “not an action ‘for publication of matter violating the right of privacy’,” those claims would not satisfy the definition for “personal and advertising injury” in many CGL policies.
• Even under West Bend, a one-year limitation period for sections 15(c) and 15(d) claims would negate coverage under CGL policies previously implicated.

That said, Tims may not be the last word. Tims likely will be appealed to the Illinois Supreme Court. Moreover, the Third District of the Illinois Appellate Court has a statute of limitations appeal pending before it in Marion v. Ring Container Technologies, LLC, No. 3-20-0184; that case currently is stayed. Still, in light of Tims, carriers should consider the impact of Tims when considering new BIPA claims and review those BIPA matters in which they are providing a defense and, where appropriate, consider reevaluating their coverage defenses and/or issuing a supplemental reservation of rights.