Important Developments in the Illinois Biometric Information Privacy Act

Brian J. Massimino • October 20, 2021
An illinois bipa poster with a fingerprint on it


In the past few months, state and federal courts have issued important decisions regarding the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq., commonly known as “BIPA”. This article will summarize the key holdings in three such decisions and extract some important lessons from each. The decisions address three aspects of BIPA and BIPA litigation: (1) the applicable statute of limitations; (2) the scope and reach of BIPA’s “possession” language; and (3) the availability of insurance coverage for alleged violations.

 

By way of background, the Illinois legislature recognized that unlike other personal identifiers, like social security numbers, biometrics are “biologically unique” to each individual and cannot be altered or changed once compromised. The Illinois legislature, therefore, enacted BIPA to regulate the collection, use, and storage of “biometric information” and “biometric identifiers” as defined by the statute.

 

(1) Statute of Limitations. One of the most significant and hotly debated issues in the BIPA universe is the applicable statute of limitations. The statute of limitations is a deadline for an injured party to file their lawsuit. The Illinois legislature did not identify a specific statute of limitations in the text of the BIPA statute.

 

Those representing plaintiffs have generally argued that the statute of limitations should be five years citing the Illinois “catchall” statute of limitations. Those representing the defendants have generally argued that the statute of limitations should be one year citing the established one-year statute of limitations in 735 ILCS 5/13-201 for cases involving “slander, libel or for publication of matter violating the right of privacy.”

 

On September 17, 2021, the Illinois First District Court of Appeals essentially determined that both sides are (partially) right. Tims v. Black Horse Carriers, Inc. 2021 IL App (1st) 200563 (1st Dist. Sep. 17, 2021). After carefully dissecting the various types of claims that could be brought under BIPA, the Tims court held that claims under BIPA Sections 15(a), (b), and (e) are subject to a five-year statute of limitations and claims under Sections (c) and (d) are subject to a one-year statute of limitations.

 

It is likely that the Illinois Supreme Court will weigh in on the statute of limitations issue at some point. In the meantime, the Tims holding provides both sides with a clearer picture of the shelf life of a BIPA claim. 

 

(2) Possession of Protected Information. BIPA regulates private entities’ “possession” of biometric identifiers and information. Specifically, 740 ILCS 14/15(a) mandates that private entities: “Develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information …”

 

The U.S. District Court for the Southern District of Illinois recently tackled the possession issue in Hazlitt v. Apple, 2021 WL 2414669 (S.D. Ill. 2021). In Hazlitt, the putative class alleged that Apple violates BIPA by, among other things, using software and facial recognition technology that scans facial features of individuals whose images are captured using Apple devices, including iPhones. On the narrow issue of possession, Apple argued that the individual users, not Apple, are in “possession” of the devices and can opt to delete any image at any time.

 

The court denied Apple’s motion to dismiss the complaint and determined that the plaintiffs adequately alleged a violation of BIPA Section 15(a). The court underscored certain allegations made by the plaintiffs that, if true, would establish a violation of BIPA. Those allegations include: Apple possesses the biometrical data because it has complete and exclusive control over the data on the devices, including what biometric identifiers are collected, what biometric data is saved, and for what period of time.

 

It is important to note that the Hazlitt decision was merely a ruling on a motion to dismiss. The plaintiffs will still need to prove their allegations but will have the benefits of the discovery process. In addition, the ruling by the U.S. District Court for the Southern District of Illinois is not binding on Illinois state courts. Nonetheless, businesses that “possess” biometric information ought to reevaluate their business practices and be prepared for BIPA litigation.

 

(3) Insurance Coverage. One of the most significant considerations in BIPA litigation is the existence or nonexistence of insurance coverage. In the absence of such coverage, only the largest companies would be able to absorb significant litigation expenses and judgments. Many smaller businesses would likely close their doors, file bankruptcy, or both. The Illinois Supreme Court’s decision in May 2021 in the case West Bend Mutual Insurance v. Krishna Schaumburg Tan, Inc., 2021 IL 125978 is a significant milestone in the evolution of BIPA litigation.

 

The underlying complaint against Krishna Schaumburg Tan (“Krishna”) shares many of the allegations seen in other BIPA litigation. Krishna operates an LA Tan franchise. Customers were required to scan their finger to gain access to the tanning salon. A class of plaintiffs alleged that Krishna violated BIPA in several ways, including transmitting the individuals’ biometric identifiers to a third party, in this case, the vendor that contracted with Krishna to provide the technology platform.

 

Krishna submitted the complaint to its insurer, West Bend Mutual Insurance, and requested that West Bend defend and indemnify Krishna. West Bend initiated its own litigation seeking a decision that it had no duty to defend and no duty to indemnify Krishna based on the language in the insurance policy. In support of its position, West Bend argued that the Krishna customers did not allege a publication to the public at large, but merely a transmittal to a single third party.

 

The Illinois Supreme Court held that a communication to a single party can be considered a “publication” for purposes of determining insurance coverage. The high court’s decision included other important elements (including coverage arising out of alleged advertising and personal injuries) that are beyond the scope of this article.

 

Both BIPA plaintiffs and defendants are likely pleased with the West Bend decision. Any BIPA defendant should promptly consider the implications of the West Bend decision on any denial of coverage.

 

If you would like more information on this subject, please contact Attorney Brian Massimino at Lavelle Law at 312-332-7555 or via email at bmassimino@lavellelaw.com.

 

More News & Resources

Lavelle Law News and Events

$9.9 Million Dollar Purchase of Packaged Multi-Unit Properties
By Commercial Real Estate April 18, 2025
Lavelle Law represented a joint venture in its $9.9 million acquisition of four multi-unit buildings.
Type F Reorg offers a means of achieving structural change while preserving tax continuity
By Steven A. Migala and Nathan P. Toy April 14, 2025
A Type F reorganization (“F Reorg”), governed by Section 368(a)(1)(F) of the Internal Revenue Code, provides a strategically significant mechanism for corporate restructuring. Defined as a “mere change in identity, form, or place of organization of one corporation,” an F Reorg permits a corporation to alter its legal existence while being treated for federal tax purposes as the same entity. This recharacterization allows for the uninterrupted preservation of tax attributes while maintaining shareholder continuity.
Estate Planning for Your Pet: Securing Your Pet’s Future with a Pet Trust
By Jackie R. Luthringshausen April 10, 2025
When it comes to estate planning, most people think about providing for their loved ones—but what about the furry, feathered, or scaled members of your family? In the United States, 68% of households own at least one pet, according to the American Pet Products Association’s 2023-2024 National Pet Owners Survey. For many, pets are more than just companions—they’re family. Ensuring their care after your death or incapacity is a vital part of comprehensive estate planning. In Illinois, a Pet Trust offers a powerful solution to guarantee your pet’s well-being long after you’re gone.
IRS Press Release Addresses Payment Plan Options
By Timothy M. Hughes April 10, 2025
IRS Press Release Addresses Payment Plan Options - A recent press release by the IRS addressed the options that are available to taxpayers who may owe more on April 15th than they can pay. The IRS advised taxpayers that they do not need to wait until April 15 to file their 2024 federal return, and if they owe and are unable to pay the balance in full, there are payment plans available to help them pay their tax obligation.
Learn about essential legal protections to strengthen your business and safeguard your interests.
By Lavelle Law April 9, 2025
Join us on May 21 in Schaumburg for an engaging Breakfast Briefs seminar, delving into vital strategies to fortify your business. This session will explore the critical role of crafting ironclad non-compete agreements, shielding your trade secrets, and mastering the nuances of temporary restraining orders (TROs) and injunctive relief. Our presenters, attorneys Matthew Sheahin and Jennifer Tee, bring a wealth of experience in this legal domain. Seize this chance to bolster your company’s legal protections and lay a solid groundwork for enduring success!
FinCEN Eliminates BOI Reporting Obligations!
By Frank P. Portera March 25, 2025
On March 21, 2025, the Financial Crimes Enforcement Network (FinCEN) issued its interim final rule stating that those entities previously classified as "domestic reporting companies" are now exempt from all BOI reporting requirements. On the other hand, all foreign entities registered to do business in the USA must file their own initial BOI reports within 30 days of the initial final rule's publication, if they have not done so already.
Join us April 3, 2025 for Business After Hours 5-7 PM
By Lavelle Law March 19, 2025
Spring is here, and with baseball season kicking off, we’re stepping up to the plate with our annual Lavelle Law Business After Hours event. We’re excited to partner with our friends in the Schaumburg business community for an evening of networking, good vibes, and a few surprises—all hosted in the friendly confines of our Schaumburg office. Bonus points: Feel free to rock your favorite baseball team’s gear and show off your fandom while you’re at it!
Delaware Court  Provides the Standard of Supreme Review for the Redomestication of Corporations
By Steven A. Migala and Anthony Letto March 12, 2025
Delaware corporations seeking to redomesticate to another state should be advised that on February 4, 2025, the Delaware Supreme Court issued its highly anticipated decision in Palkon v. Maffei, C.A. No. 2023-0449-JTL, addressing a challenge to TripAdvisor's redomestication from a Delaware corporation to a Nevada corporation. The case raised important questions regarding the standard of review applicable to such reincorporations, particularly when fiduciaries may derive a benefit from shifting to a legal regime perceived as more friendly.
Illinois residential zoning laws and significant opportunities for property owners.
By Chance W. Badertscher March 12, 2025
Recent legislative efforts in Illinois are reshaping the state’s approach to residential zoning, with significant implications for the housing market. A new bill, House Bill 1814, introduced last week, aims to eliminate single-family zoning in municipalities across Illinois. If passed, this bill will allow for the development of multi-unit buildings in areas currently zoned exclusively for single-family homes. This initiative, alongside a similar bill introduced last year, has the potential to address the state’s growing housing shortage and make housing more affordable for middle-class families.
LATEST UPDATE on the Corporate Transparency Act and BOI Report Filings
By Frank J. Portera and James Berg March 11, 2025
On February 27, 2025, FinCEN issued an immediate press release stating it would not impose fines, penalties, or take any other enforcement actions against companies that fail to file or update Beneficial Ownership Information ("BOI") reports pursuant to the Corporate Transparency Act ("CTA") by the current deadlines. FinCEN also announced that it would be revising BOI reporting deadlines through an interim final rule set to be issued no later than March 21, 2025.
More Posts