Illinois Policy – by Amy Korte
On Sept. 5, two lawsuits were filed in Cook County Circuit Court alleging that Wow Bao, a restaurant chain owned by Lettuce Entertain You Enterprises Inc., and gas station and convenience store chain Speedway LLC violated Illinois’ Biometric Information Privacy Act, or BIPA, by collecting and storing people’s biometric, or biologically derived, information without complying with the consent and notice procedures mandated by the law.
In the suit against Wow Bao and Lettuce Entertain You, the plaintiff has alleged the restaurant violated the BIPA by improperly collecting and storing customers’ facial scans through self-order kiosks.
The lawsuit against Speedway alleges the company violated the BIPA by collecting employees’ fingerprints without obtaining their written consent, by failing to abide by the other notice requirements of the statute, and by improperly sharing the data with Kronos Inc., a third-party vendor of fingerprint-operated time clocks.
These lawsuits are just the most recent in a flurry of litigation against businesses for alleged violations of Illinois’ biometric privacy law.
Illinois’ Biometric Information Privacy Act
In 2008, Illinois enacted the BIPA, the most stringent law of any state regarding the consent, notice and disclosure procedures private entities must follow when collecting, storing or using people’s biometric information such as fingerprints, iris scans and face prints.
Under the BIPA, Illinoisans have the right to sue private parties for violations of the act and to collect the greater of $1,000 or actual damages for each violation negligently committed, and the greater of $5,000 or actual damages for each violation recklessly or intentionally committed.
Illinois consumers have sued under the BIPA for alleged violations by companies that use facial recognition technology, such as Facebook, Shutterfly, Google, Snapchat, Take-Two Interactive Software and others, as well as companies that have used fingerprint scans, such as L.A. Tan.
A recent avenue for BIPA litigation is lawsuits by employees against employers based on the use of biometric information in the workplace, such as fingerprint-operated time clocks. Since March, Roundy’s, which operates the Mariano’s grocery store chain, InterContinental Hotels Group and Zayo Group have been sued under the BIPA over the allegedly improper collection and storage of employee biometrics such as fingerprints and hand scans. Plaintiffs in these cases have sought class-action status, alleging that their claims are representative of those of numerous other employees.
Wow Bao and Speedway facing BIPA lawsuits
Wow Bao has self-order kiosks that can capture and store images of customers’ facial features to recognize customers and facilitate speedier future orders.
The BIPA complaint against Wow Bao alleges the company does not disclose to customers the purposes or length of time for which the self-order kiosks collect their biometric data, or provide a schedule for retaining and destroying the face scan information. The plaintiff further claims the restaurant fails to obtain customers’ written consent to collect and store their facial images, as required under the BIPA.
The plaintiff in the Speedway lawsuit has alleged the gas station violated the BIPA by requiring employees to use a fingerprint-operated system to clock in and out of work without informing employees about the company’s policy for use, storage and ultimate destruction of the fingerprint data. The plaintiff also claimed Speedway never obtained his written consent to collect and store his fingerprints, and has improperly disclosed the information to Kronos in violation of the BIPA. Kronos, which provides the time clocks, is also named as a defendant in the lawsuit, and the plaintiff alleges Kronos violated the BIPA by failing to comply with the statute’s notice and consent procedures.
Both lawsuits, which were filed by the same law firm, request class-action status, and assert that there are “hundreds or more” people whose biometric data might have been improperly obtained or handled by Wow Bao and Speedway.
In the Wow Bao case, the complaint names as would-be class members “all customers of Defendants in the State of Illinois who had their facial biometrics collected, captured, received, … or disclosed by the Defendants” since the BIPA was enacted.
In the Speedway case, the complaint requests that “all individuals who worked for Defendants in the State of Illinois who had their fingerprints collected, captured, received, … or disclosed by the Defendants” since the BIPA came into effect be included in the class.
Potential impact of employee BIPA lawsuits
The BIPA is a relatively new and developing area of law, and the extent of potential recoveries in BIPA cases isn’t yet clear. Many of the lawsuits, including those against Facebook and Google, are still working their way through the courts, while others, such as one against Take-Two Interactive, have been dismissed. Meanwhile, parties have settled cases involving Shutterfly and L.A. Tan.
Employees, consumers and others have every reason to be concerned about the privacy and security of their biometric information. As the General Assembly noted, “Biometrics … are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.”
It is not yet known whether the defendants in the Wow Bao and Speedway BIPA cases failed to comply with the requirements under the statute. Nor is it known whether, even assuming the defendants had not followed the mandated consent, notice and disclosure procedures, the plaintiffs’ face scan or fingerprint data were ever put at risk of being compromised or the plaintiffs were harmed in any way. And in the event the court grants class-action status, it is also unclear to what extent any monetary recoveries would benefit the victims of the alleged statutory violations – or whether attorneys would take the lion’s share, with comparatively small sums going to the actual plaintiffs in the cases.
It remains to be seen to what effect the proliferation of BIPA litigation will have on technological innovation in the Prairie State. Such innovation has the potential to make life easier for Illinoisans, as well as to stoke a job-creation engine Illinois desperately needs.
One thing is certain, however: Litigation against businesses does have the potential to drive up costs – and make employing people more difficult and more expensive. In a state where recent jobs growth has been less than half the national average and worse than every neighboring state, this is not a minor concern.
‘Facebook and Google, are still working their way through the courts, while others, such as one against Take-Two Interactive, have been dismissed. Meanwhile, parties have settled cases involving Shutterfly and L.A. Tan.’ …Settled? How? Money? Once they have your biometrics you can sue all you want…they have YOU!