Retail pharmacy giant CVS has been hit with a class action under Illinois’ biometrics privacy law, claiming customers had their biometric facial geometry captured without their consent when they went to CVS pharmacies in Illinois to have their photos taken by a special passport photo system, which is specifically designed to capture facial geometry to comply with federal biometric passport rules.
The lawsuit was filed on behalf of named plaintiffs Denise Daichendt and Ada “June” Odell, each of whom were identified as residents of Cook County.
Gary Klinger
| Milberg Coleman
According to the complaint, both Daichendt and Odell went to CVS pharmacies in Chicago and Niles, respectively, within the past 12 months for special passport photos to be taken with the Kodak Biometric ID Photo System.
CVS allegedly informs customers who are taking their passport photos at their pharmacies that the Kodak Biometric system “automatically verifies your photos meet all government requirements.”
When photos are taken with the system, it then scans the digital image “for biometric identifiers,” by performing “a scan of face geometry on the consumer’s photo.”
According to the complaint, the system ensures the image meets federal requirements, including verifying the head is in the correct position, eyes are open and the mouth is closed, among other criteria.
“Indeed, CVS could not certify the Biometric Passport Photos as it does without collecting Biometrics because verifying the … specified criteria – eyes open, eyes looking straight ahead, mouth unsmiling, facial position, head size and so on – necessarily requires mapping and measuring these facial features,” the complaint said.
Despite CVS’ notices and advertisements to customers concerning the face scanning and biometric capturing technology in their passport photo system, the lawsuit asserts CVS failed to provide the correct form of notice required by the state law known as the Illinois Biometric Information Privacy Act.
Further, the complaint asserts CVS failed to obtain written consent from customers before scanning their faces during the passport photo session, as allegedly required by the BIPA law.
The BIPA law has been used in recent years by a growing number of plaintiffs’ class action firms to launch thousands of class action lawsuits against businesses of all types and sizes.
The bulk of the litigation has targeted employers, primarily over claims employers failed to get consent and failed to provide notice to workers before requiring them to scan their fingerprints to verify their identity when punching the clock to begin or end work shifts, or to access secure areas in the workplace, such as cash rooms or drug lockers.
However, many other lawsuits have also targeted businesses over so-called biometric scans of customers’ faces. Those lawsuits have claimed businesses failed to abide by BIPA’s notice and consent rules before scanning customers’ faces to help sell cosmetics and eyeglasses, or when tracking users’ photos across social media platforms.
BIPA lawsuits have already produced settlements worth hundreds of millions of dollars from Facebook and Google, and a bevy of other settlements ranging from hundreds of thousands of dollars to as much as $50 million.
To date, no BIPA lawsuit has advanced to trial, even though the first BIPA class actions were filed nearly seven years ago.
The reason, according to lawyers and judges alike, lies in the steep risk companies face from BIPA’s potentially ruinous damages provisions. The law allows plaintiffs to demand damages of $1,000-$5,000 per violation. Lawyers and judges have indicated the law could be interpreted to define such individual violations as each time a biometric scan takes place. For instance, this could mean an employer could be on the hook for as much as $5,000 each time an employee scans their fingerprint during a work day.
Multiplied across dozens, hundreds, or even thousands of employees or customers, the potential damages could quickly run into the many millions, if not billions of dollars, should the case advance to trial and a jury find in favor of the plaintiffs.
Facebook, for instance, estimated it could have faced damages in the billions of dollars, making its $650 million settlement to end the BIPA class action that targeted them much more palatable.
In the case against CVS, plaintiffs estimate the potential class action could include “at least thousands” more plaintiffs who had their passport photos taken at a CVS store in Illinois.
The plaintiffs are asking the court to award them damages of $1,000-$5,000 per violation, placing CVS potentially at risk of many millions of dollars in damages.
In addition to attorney Klinger, the plaintiffs are represented by attorneys Andrei V. Rado, Blake Hunter Yagman, Matthew Lee, Erin Ruben and Jonathan B. Cohen, all of the Milberg Coleman firm, with offices in Garden City, New York; Raleigh, North Carolina; and Knoxville, Tennessee.