Any company in Illinois that captures anyone's likeness - even on video surveillance cameras - should be aware they could be the next target for a class action by plaintiffs' lawyers suing under Illinois' biometrics privacy law, a lawyer who specializes in cybersecurity and other related issues said.
Recently, the country's two biggest home improvement retailers, The Home Depot and Lowes, were the latest hit with class action lawsuits, alleging violations of the Illinois Biometric Information Privacy Act. The suits allege that facial recognition cameras in Home Depot and Lowes stores "augmented ... in-store security cameras with software that track[s] an individual's movements throughout the store using a unique scan of face geometry."
The complaints also allege the national retailers "surreptitiously attempt to collect the faceprint of every person who appears in front of one of their facial-recognition cameras."
Michael F. Buchanan
| Patterson Belknap
"BIPA covers a wide range of entities," said said Michael F. Buchanan, a litigating partner with Patterson Belknap Webb & Tyler in New York. "And, unlike biometric privacy legislation in some other states, BIPA (in Illinois) applies regardless of the purpose for which the information was collected. So we could see, and have seen, various businesses face suit under it—including a fast food chain, hotel, social media company, and airline.
"Simply put, BIPA is indiscriminate in its application."
Illinois was the first state to implement biometric privacy legislation, in 2008. The law regulates the collection, use and storage of biometric data, and allows individuals to sue for violations.
"Companies should be working with counsel to address essential implementation issues," Buchanan said. "Are they covered under BIPA, do they maintain biometric information, and in what form, and what steps do they need to take to ensure they are positioned to comply with the law’s core provisions regarding consumer notice, disclosure and storage, among others.
"Businesses also need to be thinking critically about their incident response plans, privacy and data security policies, and ensuring that senior management is involved with the company’s cyber defense regime, especially considering BIPA’s reasonableness requirement for security measures."
Lowes and Home Depot face statutory damages of up to $5,000 each time a shopper's information is collected in violation of llinois' BIPA law. They join Facebook, Six Flags and others in defending its use of technology to protect its inventory.
More commonly in Illinois, the law has been used to hit a wide range of hundreds of employers for requiring employees to use so-called biometric time clocks, which require them to scan a fingerprint or other biometric identifier to verify their identity when punching in or out of a work shift.
"Indeed, there’s been hundreds of class actions brought under BIPA over the last few years," Buchanan said. "And given the Illinois Supreme Court’s and the Ninth Circuit’s decisions in Rosenbach v. Six Flags Entertainment Corp. and Patel v. Facebook, Inc., respectively, that, generally, plaintiffs need only allege a violation of BIPA’s requirements to bring suit, the number of cases may only grow."
The California Consumer Privacy Act of 2018 takes effect Jan. 1, 2020. Fines up to $7,500 per violation are allowed. In addition, Texas, Washington state and New York have laws on the books protecting consumers against these facial scans.
"BIPA applies to any 'individual, partnership, corporation, limited liability company, association, or other group' that captures biometric information," Buchanan said. "So the class actions against Lowe’s and Home Depot merely serve as reminders to any entity collecting biometric information to apprise itself of BIPA’s, and other states’, requirements concerning the collection, use and storage of biometric data."
Legislation limiting biometric collection has been introduced in Alaska, Arizona, Delaware, Florida, Hawaii, Massachusetts, Montana, New Hampshire, New Jersey, Oregon and Rhode Island. However, none of these measures has passed.