The country’s second largest retail pharmacy chain and Illinois’ busiest casino have each been hit with class actions under an Illinois biometrics privacy law, accusing the companies of illegally tracking their customers’ movements using video technology.
On Oct. 15, lawyers with the firm of Werman Salas P.C., of Chicago, and of Fitapelli & Schaffer LLP, of New York, filed suit in Cook County Circuit Court against Midwest Gaming & Entertainment LLC, the owners of Rivers Casino in Des Plaines. The named plaintiff in that putative class action was identified as Leon Martin.
That was followed on Oct. 16 by a class action in Cook County court against Walgreens. Attorneys with the firm of McGuire Law P.C. brought that lawsuit on behalf of named plaintiff Peter Bonahoom.
The lawsuits against both companies said they had violated the Illinois Biometric Information Privacy Act. The law, on the books since 2008, had been intended to prevent the unwitting collection and disclosure of individuals’ so-called biometric identifiers, such as fingerprints, facial geometry and retinal scans, among others. The law had been inspired by a prominent data breach more than a decade ago, which placed a large number of people at heightened risk of identity theft.
The lawsuit against Rivers Casino targeted the casino’s use of facial recognition technology in its video surveillance system to track the movements of people within the casino. The lawsuit said the technology creates a digital record, unique to each person, using each person’s facial geometry. When paired with information from the casino’s customer rewards program, the facial recognition system can create a way for the casino to identify people as they move about the gaming floor and elsewhere in the casino.
According to the lawsuit, which cited the most recent annual report from the Illinois Gaming Board, the casino drew in nearly 3 million visitors in 2018 alone, collecting gross revenues of more than $441 million, fourfold more than any other Illinois casino. The casino welcomed more than 8,100 guests per day in 2018, the complaint said.
The complaint seeks to sue on behalf of everyone who was a member of Rivers Casino’s rewards program since October 2014. The complaint estimates the class of plaintiffs “includes hundreds and likely thousands of members.”
According to the complaint, the casino did not obtain written authorization from casino patrons before scanning and storing their facial geometry, nor did it provide the notices allegedly required by the Illinois BIPA law.
The lawsuit filed against Walgreens levels similar accusations.
However, in that case, the lawsuit targets Walgreens’ deployment of so-called digital cooler doors. The doors, which the company began testing in January, according to a report published in the Wall Street Journal, use a system of sensors and cameras to scan and record customers’ actions and choices at the coolers in which it displays its assortment of chilled beverages, ice creams and other refrigerated or frozen food and drinks.
The technology then allows Walgreens to target customers with advertisements and coupon offers, displayed on the cooler doors, as they browse the stock.
According to the lawsuit, these digital cooler doors have been displayed at Walgreens stores in Chicago and elsewhere in Illinois.
The lawsuit asserts Walgreens did not obtain authorization from customers before scanning their faces, and then allegedly shared that information with “third parties.” The complaint does not identify those “third parties.”
The lawsuit would seek to include anyone “whose biometrics were captured, collected, stored, used, transmitted, or disseminated” by Walgreens in Illinois using the digital cooler doors.
The complaint estimated the class could include “thousands of members.”
The lawsuits seek damages of $1,000-$5,000 per violation, which could be defined under the law as each time a person’s facial geometry was scanned, meaning potential damages could quickly mount into the millions of dollars.
The lawsuits come in the wake of recent lawsuits filed against home improvement retailers Home Depot and Lowes, accusing those retailers of violating the BIPA law by recording customers’ facial geometry as part of anti-shoplifting video technology allegedly used at those stores.
A rising tide of class actions under the BIPA law have also targeted a host of businesses, from tech titans like Facebook and Google, to health care providers and factories in Illinois who use fingerprint scanners to track employees’ work hours, purportedly to reduce workplace fraud.
The lawsuits particularly surged this year in response to an Illinois Supreme Court ruling earlier in 2019, which found plaintiffs don’t need to prove their identities were stolen or placed at risk, or otherwise suffered some other actual harm from the collection of their fingerprints, facial geometry and other biometric identifiers to sue.