Important Developments in the Illinois Biometric Information Privacy Act

In the past few months, state and federal courts have issued important decisions regarding the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq., commonly known as “BIPA”. This article will summarize the key holdings in three such decisions and extract some important lessons from each. The decisions address three aspects of BIPA and BIPA litigation: (1) the applicable statute of limitations; (2) the scope and reach of BIPA’s “possession” language; and (3) the availability of insurance coverage for alleged violations.

By way of background, the Illinois legislature recognized that unlike other personal identifiers, like social security numbers, biometrics are “biologically unique” to each individual and cannot be altered or changed once compromised. The Illinois legislature, therefore, enacted BIPA to regulate the collection, use, and storage of “biometric information” and “biometric identifiers” as defined by the statute.

(1) Statute of Limitations. One of the most significant and hotly debated issues in the BIPA universe is the applicable statute of limitations. The statute of limitations is a deadline for an injured party to file their lawsuit. The Illinois legislature did not identify a specific statute of limitations in the text of the BIPA statute.

Those representing plaintiffs have generally argued that the statute of limitations should be five years citing the Illinois “catchall” statute of limitations. Those representing the defendants have generally argued that the statute of limitations should be one year citing the established one-year statute of limitations in 735 ILCS 5/13-201 for cases involving “slander, libel or for publication of matter violating the right of privacy.”

On September 17, 2021, the Illinois First District Court of Appeals essentially determined that both sides are (partially) right. Tims v. Black Horse Carriers, Inc. 2021 IL App (1st) 200563 (1st Dist. Sep. 17, 2021). After carefully dissecting the various types of claims that could be brought under BIPA, the Tims court held that claims under BIPA Sections 15(a), (b), and (e) are subject to a five-year statute of limitations and claims under Sections (c) and (d) are subject to a one-year statute of limitations.

It is likely that the Illinois Supreme Court will weigh in on the statute of limitations issue at some point. In the meantime, the Tims holding provides both sides with a clearer picture of the shelf life of a BIPA claim. 

(2) Possession of Protected Information. BIPA regulates private entities’ “possession” of biometric identifiers and information. Specifically, 740 ILCS 14/15(a) mandates that private entities: “Develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information …”

The U.S. District Court for the Southern District of Illinois recently tackled the possession issue in Hazlitt v. Apple, 2021 WL 2414669 (S.D. Ill. 2021). In Hazlitt, the putative class alleged that Apple violates BIPA by, among other things, using software and facial recognition technology that scans facial features of individuals whose images are captured using Apple devices, including iPhones. On the narrow issue of possession, Apple argued that the individual users, not Apple, are in “possession” of the devices and can opt to delete any image at any time.

The court denied Apple’s motion to dismiss the complaint and determined that the plaintiffs adequately alleged a violation of BIPA Section 15(a). The court underscored certain allegations made by the plaintiffs that, if true, would establish a violation of BIPA. Those allegations include: Apple possesses the biometrical data because it has complete and exclusive control over the data on the devices, including what biometric identifiers are collected, what biometric data is saved, and for what period of time.

It is important to note that the Hazlitt decision was merely a ruling on a motion to dismiss. The plaintiffs will still need to prove their allegations but will have the benefits of the discovery process. In addition, the ruling by the U.S. District Court for the Southern District of Illinois is not binding on Illinois state courts. Nonetheless, businesses that “possess” biometric information ought to reevaluate their business practices and be prepared for BIPA litigation.

(3) Insurance Coverage. One of the most significant considerations in BIPA litigation is the existence or nonexistence of insurance coverage. In the absence of such coverage, only the largest companies would be able to absorb significant litigation expenses and judgments. Many smaller businesses would likely close their doors, file bankruptcy, or both. The Illinois Supreme Court’s decision in May 2021 in the case West Bend Mutual Insurance v. Krishna Schaumburg Tan, Inc., 2021 IL 125978 is a significant milestone in the evolution of BIPA litigation.

The underlying complaint against Krishna Schaumburg Tan (“Krishna”) shares many of the allegations seen in other BIPA litigation. Krishna operates an LA Tan franchise. Customers were required to scan their finger to gain access to the tanning salon. A class of plaintiffs alleged that Krishna violated BIPA in several ways, including transmitting the individuals’ biometric identifiers to a third party, in this case, the vendor that contracted with Krishna to provide the technology platform.

Krishna submitted the complaint to its insurer, West Bend Mutual Insurance, and requested that West Bend defend and indemnify Krishna. West Bend initiated its own litigation seeking a decision that it had no duty to defend and no duty to indemnify Krishna based on the language in the insurance policy. In support of its position, West Bend argued that the Krishna customers did not allege a publication to the public at large, but merely a transmittal to a single third party.

The Illinois Supreme Court held that a communication to a single party can be considered a “publication” for purposes of determining insurance coverage. The high court’s decision included other important elements (including coverage arising out of alleged advertising and personal injuries) that are beyond the scope of this article.

Both BIPA plaintiffs and defendants are likely pleased with the West Bend decision. Any BIPA defendant should promptly consider the implications of the West Bend decision on any denial of coverage.

If you would like more information on this subject, please contact Attorney Brian Massimino at Lavelle Law at 312-332-7555 or via email at bmassimino@lavellelaw.com.