Opinion
1-20-0563
09-17-2021
JOROME TIMS and ISAAC WATSON, Individually and on Behalf of All Others Similarly Situated, Plaintiffs-Appellees, v. BLACK HORSE CARRIERS, INC., Defendant-Appellant.
Attorneys for Appellant: David M. Schultz, John P. Ryan, Adam R. Vaught, and Louis J. Manetti Jr., of Hinshaw & Culbertson LLP, of Chicago, for appellant. Attorneys for Appellee: Ryan F. Stephan, James B. Zouras, and Catherine T. Mitchell, of Stephan Zouras, LLP, of Chicago, for appellees. Amicus Curiae: Melissa A. Siebert and Matthew C. Wolfe, of Shook, Hardy & Bacon LLP, of Chicago, for amicus curiae Illinois Chamber of Commerce.
Appeal from the Circuit Court of Cook County No. 19 CH 3522 Honorable David B. Atkins, Judge presiding.
Attorneys for Appellant: David M. Schultz, John P. Ryan, Adam R. Vaught, and Louis J. Manetti Jr., of Hinshaw & Culbertson LLP, of Chicago, for appellant.
Attorneys for Appellee: Ryan F. Stephan, James B. Zouras, and Catherine T. Mitchell, of Stephan Zouras, LLP, of Chicago, for appellees.
Amicus Curiae: Melissa A. Siebert and Matthew C. Wolfe, of Shook, Hardy & Bacon LLP, of Chicago, for amicus curiae Illinois Chamber of Commerce.
JUSTICE HARRIS delivered the judgment of the court, with opinion. Justice Mikva and Justice Oden Johnson concurred in the judgment and opinion.
OPINION
HARRIS, JUSTICE
¶ 1 This case concerns a class action brought by plaintiffs Jorome Tims and Isaac Watson against defendant Black Horse Carriers, Inc., under the Biometric Information Privacy Act (Act). 740 ILCS 14/1 et seq (West 2018). Defendant brings this interlocutory appeal from circuit court orders denying its motion to dismiss on limitation grounds, denying reconsideration of the same, and certifying a question to this court: whether the limitation period in section 13-201 or section 13-205 of the Code of Civil Procedure (Code) applies to claims under the Act. 735 ILCS 5/13-201, 13-205 (West 2018). On appeal, defendant contends that the one-year limitation period under section 13-201 governs claims under the Act, while plaintiffs contend that the five-year period in section 13-205 governs. As explained below, we answer the certified question as follows: section 13-201 governs actions under section 15(c) and (d) of the Act, and section 13-205 governs actions under section 15(a), (b), and (e) of the Act. 740 ILCS 14/15 (West 2018).
¶ 2 I. JURISDICTION
¶ 3 Plaintiffs filed and amended their complaint in 2019 and the trial court denied defendant's motion to dismiss in September 2019. The court denied reconsideration and certified the aforesaid question to this court on February 26, 2020. Defendant applied to this court for leave to appeal on March 27, 2020, which we granted on April 23, 2020. Thus, we have jurisdiction pursuant to article VI, section 6, of the Illinois Constitution (Ill. Const. 1970, art. VI, § 6) and Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019), governing interlocutory appeals upon certified questions of law.
¶ 4 II. BACKGROUND
¶ 5 Plaintiff Tims filed his class action complaint in March 2019, raising claims under section 15 of the Act. 740 ILCS 14/15 (West 2018). The complaint alleged that Tims worked for defendant from June 2017 until January 2018. It alleged that defendant scanned and was still scanning the fingerprints of all employees, including plaintiff, and was using and had used fingerprint scanning in its employee timekeeping. "Defendant continues to collect, store, use, and disseminate individuals'] biometric data in violation of the" Act.
¶ 6 All counts alleged that defendant had violated and was violating the Act by not (a) properly informing plaintiff and other employees of the purpose and length of defendant's storage and use of their fingerprints; (b) receiving a written release from plaintiff and other employees to collect, store, and use their fingerprints; (c) providing a retention schedule and guidelines for destroying the fingerprints of plaintiff and other employees; or (d) obtaining consent from plaintiff and other employees to disclose or disseminate their fingerprints to third parties.
¶ 7 The first count alleged that defendant violated section 15(a) by failing to institute, maintain, and adhere to a retention schedule for biometric data. The second count alleged that it violated section 15(b) by failing to obtain informed written consent and release before obtaining biometric data. The third count alleged that it violated section 15(d) by disclosing or disseminating biometric data without first obtaining consent. Each count sought a declaratory judgment, injunctive relief, statutory damages for each violation of the Act, and attorney fees and costs.
¶ 8 Defendant appeared and, in June 2019, filed a motion to dismiss under section 2-619 of the Code (735 ILCS 5/2-619 (West 2018)), alleging that the complaint was filed outside the limitation period. The motion noted that the Act itself has no limitation provision and argued that the one-year limitation period for privacy actions under Code section 13-201 applies to causes of action under the Act because the Act's purpose is privacy protection.
¶ 9 Plaintiff Tims responded to the motion to dismiss, arguing that the Act's purpose is to create a prophylactic regulatory system to prevent or deter security breaches regarding biometric data. Plaintiff argued that, in the absence of a limitation period in the Act, the 5-year period in section 13-205 for all civil actions not otherwise provided for should apply to the Act. Plaintiff argued that the one-year period in section 13-201 does not govern all privacy claims but only those privacy claims with a publication element, while the Act does not have a publication element. Plaintiff noted that defendant's motion did not claim destruction or deletion of plaintiff s biometric information so that the alleged violations of the Act regarding plaintiff were ongoing or continuing.
¶ 10 Defendant replied in support of its motion to dismiss, arguing that a privacy claim involving publication as provided in section 13-201 need not require publication as an element. Defendant argued that publication for purposes of section 13-201 consists of disclosure to any third party and that the Act involves publication because it prevents the disclosure or publication of biometric information. Defendant argued that adopting plaintiffs argument would entail applying section 13-201 to the provisions in the Act requiring publication and section 13-205 to the provisions that did not require publication. Lastly, defendant argued that there was no ongoing violation because the alleged violation occurred when plaintiff s fingerprints were initially scanned for defendant's timekeeping system without his written release and the subsequent fingerprint scannings as he clocked into and out of work were merely continuing ill effects from that violation.
¶ 11 In September 2019, the trial court denied defendant's motion to dismiss. Noting that plaintiff Tims was claiming that defendant violated the Act, rather than claiming a general invasion of his privacy or defamation, the court found section 13-201 inapplicable and instead applied the catchall limitation provision in section 13-205 to the Act, which did not have its own limitation period. The complaint was therefore timely, as it was filed within five years of plaintiffs claim accruing, whether that was at the beginning or the end of his employment by defendant.
¶ 12 Later in September 2019, the complaint was amended to add Isaac Watson as a plaintiff, alleging that Watson was employed by defendant from December 2017 until December 2018.
¶ 13 In December 2019, defendant moved for reconsideration of the denial of its motion to dismiss, reiterating its argument that section 13-201 applies to the Act because both statutes concern the right to privacy. The motion also asked the court to certify to this court the question of which limitation period applies to the Act. Plaintiffs responded, arguing that reconsideration and certification were unnecessary, as the denial of the motion to dismiss was not erroneous.
¶ 14 On February 26, 2020, the trial court denied reconsideration but certified the question of whether the limitation period in section 13-201 or section 13-205 applies to claims under the Act.
¶ 15 III. ANALYSIS
¶ 16 The trial court has certified to this court the question of whether the one-year limitation period in section 13-201 or the five-year limitation period in section 13-205 governs claims under the Act. Defendant and amicus the Illinois Chamber of Commerce contend that the Act concerns privacy and section 13-201 governs privacy actions. Plaintiffs contend that section 13-201 governs privacy actions only where publication is an element and that publication is not an element of actions under the Act, so that the default limitation period of section 13-205 should apply.
¶ 17 An appeal pursuant to Rule 308 on certified questions presents a question of law subject to de novo review. Sharpe v. Westmoreland, 2020 IL 124863, ¶ 6.
¶ 18 A. Limitation Statutes
¶ 19 The applicability of a statute of limitation to a cause of action presents a legal question subject to de novo review, and the sole concern in determining which limitation period applies is ascertaining and effectuating the legislature's intent. Uldrych v. VHS of Illinois, Inc., 239 Ill.2d 532, 540 (2011). In ascertaining legislative intent, that intent is best determined from the plain and ordinary meaning of the statutory language. Sharpe, 2020 IL 124863, ¶ 10. If the language is plain and unambiguous, we shall not read into the statute exceptions, limitations, or conditions the legislature did not express. Id. ¶ 14. Similarly, when legislative intent can be ascertained from the statutory language, it must be effectuated without resorting to aids for construction such as legislative history. Id. ¶ 13.
¶ 20 Section 13-201 establishes a one-year limitation period for "[a]ctions for slander, libel or for publication of matter violating the right of privacy." 735 ILCS 5/13-201 (West 2018). Under the common law, publication means communication to both a single party and the public at large. West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978, ¶ 42.
¶ 21 Courts have recognized two types of privacy interests in the right to privacy: secrecy ("the right to keep certain information confidential") and seclusion ("the right to be left alone and protecting a person from another's prying into their physical boundaries or affairs"). Id. ¶ 45. The "core of the tort of intrusion upon seclusion is the offensive prying into the private domain of another" rather than publication. Benitez v. KFC National Management Co., 305 Ill.App.3d 1027, 1033 (1999). Thus, section 13-201 does not apply to intrusion upon seclusion. Id. at 1034. Conversely, section 13-201 applies to public disclosure of private facts, appropriation of the name or likeness of another, and false-light publicity. Id.
"Publication is an element of each of the three former torts, whereas publication is not an element of unreasonable intrusion upon the seclusion of another. [Citation.] The fact that publication is not an element of intrusion upon seclusion is crucial, since the plain language of section 13-201 indicates that the one-year statute of limitations governs only libel, slander and privacy torts involving publication [citations]." Id.
¶ 22 Section 13-205 provides for a five-year limitation period for, in relevant part, "all civil actions not otherwise provided for." 735 ILCS 5/13-205 (West 2018).
¶ 23 B. The Act
¶ 24 The Act includes findings that "[b]iometrics *** are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft" and that "public welfare, security, and safety will be served by regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information." 740 ILCS 14/5(c), (g) (West 2018). As our supreme court has stated, the Act:
"imposes numerous restrictions on how private entities collect, retain, disclose, and destroy biometric identifiers, including retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, or biometric information. Under the Act, any person 'aggrieved' by a violation of its provisions 'shall have a right of action *** against an offending party' and 'may recover for each violation' the greater of liquidated damages or actual damages, reasonable attorney fees and costs, and any other relief, including an injunction, that the court deems appropriate." Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, ¶ 1 (quoting 740 ILCS 14/20 (West 2016)).
¶ 25 The Act works "by imposing safeguards to insure that individuals' and customers' privacy rights in their biometric identifiers and biometric information are properly honored and protected" and by "subjecting private entities who fail to follow the statute's requirements to substantial potential liability, including liquidated damages, injunctions, attorney fees, and litigation expenses 'for each violation' of the law [citation] whether or not actual damages, beyond violation of the law's provisions, can be shown." Id. ¶ 36 (quoting 740 ILCS 14/20 (West 2016)). When a private entity violates the Act," 'the right of the individual to maintain [his or] her biometric privacy vanishes into thin air. The precise harm the Illinois legislature sought to prevent is then realized.'" Id. ¶ 34 (quoting Patel v. Facebook Inc., 290 F.Supp.3d 948, 954 (N.D. Cal. 2018)).
"Through the Act, our General Assembly has codified that individuals possess a right to privacy in and control over their biometric identifiers and biometric information. [Citation.] The duties imposed on private entities by section 15 of the Act [citation] regarding the collection, retention, disclosure, and destruction of a person's or customer's biometric identifiers or biometric information define the contours of that statutory right. Accordingly, when a private entity fails to comply with one of section 15's requirements, that violation constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose biometric identifier or biometric information is subject to the breach." Id. ¶ 33 (citing 740 ILCS 14/15 (West 2016)).
¶ 26 In particular, the Act imposes on private entities possessing biometric identifiers or information duties to (a) "develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with the private entity, whichever occurs first"; (b) inform a person in writing that biometric identifiers or information are being collected or stored, the purpose therefor, and the period it will be stored or used, and obtain written release; (c) not "sell, lease, trade, or otherwise profit from" a person's biometric identifier or information; (d) not "disclose, redisclose, or otherwise disseminate" a person's biometric identifier or information without consent, request, or authorization of the subject, a legal requirement of disclosure, or a court order; and (e) "store, transmit, and protect from disclosure all biometric identifiers and *** information using the reasonable standard of care" and "in a manner that is the same as or more protective than the manner in which the private entity stores, transmits, and protects other confidential and sensitive information." 740 ILCS 14/15 (West 2018). The Act thus protects a privacy right of secrecy, "the right of an individual to keep his or her personal identifying information like fingerprints secret." West Bend Mutual Insurance Co., 2021 IL 125978, ¶ 46.
¶ 27 To enforce these duties, "[a]ny person aggrieved by a violation of this Act shall have a right of action" and "may recover for each violation" (1) $1000 liquidated damages or actual damages, whichever is greater, for negligent violations; (2) $5000 liquidated damages or actual damages, whichever is greater, for intentional or reckless violations; (3) reasonable attorney fees and costs; and (4) other relief including injunctions. 740 ILCS 14/20 (West 2018). A person aggrieved by a violation of the Act need not allege or show "actual injury or adverse effect, beyond violation of his or her rights under the Act." Rosenbach, 2019 IL 123186, ¶ 40.
¶ 28 C. Analysis
¶ 29 Here, we find from the language of section 13-201 including actions "for publication of matter violating the right of privacy" (735 ILCS 5/13-201 (West 2018)) and from our decision in Benitez that section 13-201 does not encompass all privacy actions but only those where publication is an element or inherent part of the action. Had the legislature intended to include all privacy actions, it would have written something like "actions for slander, libel, or privacy" or "actions for slander, libel or violations of the right of privacy." Similarly, had the legislature intended to include any privacy action that merely concerns or pertains to publication, it would have used such broad language rather the narrower "for publication." Logically, an action for something has that thing as a necessary part or element of the action.
¶ 30 Turning to the Act, section 15 imposes various duties upon which an aggrieved person may bring an action under section 20. Though all relate to protecting biometric data, each duty is separate and distinct. A private entity could violate one of the duties while adhering to the others, and an aggrieved person would have a cause of action for violation of that duty. Moreover, as section 20 provides that a "prevailing party may recover for each violation" (740 ILCS 14/20 (West 2018)), a plaintiff who alleges and eventually proves violation of multiple duties could collect multiple recoveries of liquidated damages. Id. § 20(1), (2).
¶ 31 While all these duties concern privacy, at least three of them have absolutely no element of publication or dissemination. A private party would violate section 15(a) by failing to develop a written policy establishing a retention schedule and destruction guidelines, section 15(b) by collecting or obtaining biometric data without written notice and release, or section 15(e) by not taking reasonable care in storing, transmitting, and protecting biometric data. Id. § 15(a), (b), (e). A plaintiff could therefore bring an action under the Act alleging violations of section 15(a), (b), and/or (e) without having to allege or prove that the defendant private entity published or disclosed any biometric data to any person or entity beyond or outside itself. Stated another way, an action under section 15(a), (b), or (e) of the Act is not an action "for publication of matter violating the right of privacy." 735 ILCS 5/13-201 (West 2018).
¶ 32 Conversely, publication or disclosure of biometric data is clearly an element of an action under section 15(d) of the Act, which is violated by disclosing or otherwise disseminating such data absent specified prerequisites such as consent or a court order. 740 ILCS 14/15(d) (West 2018). Section 15(c) similarly forbids a private party to "sell, lease, trade, or otherwise profit from" biometric data (id. § 15(c)), which entails a publication, conveyance, or dissemination of such data. In other words, an action under section 15(c) or (d) is an action "for publication of matter violating the right of privacy." 735 ILCS 5/13-201 (West 2018).
¶ 33 We therefore find that section 13-201 governs actions under section 15(c) and (d) of the Act while section 13-205 governs actions under sections 15(a), (b), and (e) of the Act. As we are answering the certified question based on the relevant statutory language, which is not ambiguous, we need not resort to, and shall not address, aids of construction such as legislative history.
¶ 34 IV. CONCLUSION
¶ 35 Accordingly, we answer the certified question: Code section 13-201 governs actions under section 15(c) and (d) of the Act, and section 13-205 governs actions under section 15(a), (b), and (e) of the Act. 740 ILCS 14/15 (West 2018). We remand this cause to the circuit court for further proceedings consistent with this opinion.
¶ 36 Certified question answered; cause remanded.