Plaintiffs Now Have Five Years to Bring Illinois Biometric Privacy Claims

In late January, the Illinois Supreme Court ruled that individuals bringing suit under the state's biometric privacy law (BIPA) will have five years to file their claims. The ruling reversed a lower court decision that limited the time to file certain BIPA claims to one year. The statute itself does not prescribe a time period.

Why It Matters

The opinion is a clear statement of support for the privacy of biometric information. In holding that five years is more appropriate for biometric privacy violations, the Supreme Court stated that "the full ramifications of the harms associated with biometric technology is unknown, and absent the Act's protections, it is unclear when or if an individual would discover evidence of the disclosure of his or her biometrics in violation of the Act."  

Five years is a very long time in the world of data. Any company that collects fingerprints, retina scans, facial recognition, or similar information should be especially cautious about its collection, retention, and use. Given the lengthy limitations period now applicable to BIPA claims, the collection, storage, and management of biometric data should be done with clear documentation of the procedures in use at the company. We advise that business owners consult with counsel when deciding the appropriate balance between how long to keep such material and when to dispose of it, in light of this new decision.