A class action lawsuit has taken aim at Patronscan, a vendor providing systems to help bar and nightclub owners in the U.S. and elsewhere to detect fake IDs, saying the company's technology violates Illinois' biometrics privacy law in the way it is used to scan the faces of people visiting entertainment venues.
Erica Norman, on behalf of herself and others filed a new class action lawsuit on March 23 in Cook County Circuit Court against Servall Biometrics, which does business as Patronscan Inc. Norman is accusing Patronscan of violations against the Illinois Biometric Information Privacy Act (BIPA) for allegedly using facial recognition technology on event goers without first obtaining their consent or providing notices concerning usage, storage, and privacy protection.
Last January, Norman attended a concert featuring the band Pajamas in Chicago at nightclub venue, Bourbon on Division. At the door, the bouncer allegedly used Patronscan facial recognition technology to compare her face against the driver's license she presented, to verify her age prior to entry.
Using advanced facial recognition technology, the Patronscan device allegedly performed a full facial geometry scan on Norman's face, using multiple biometric identifiers to compare her face with the photograph on her ID. Norman alleges in her complaint that she was not asked to provide her consent prior to being required to undergo a scan to enter the event. She also claims that Patronscan allegedly did not disclose the data retention policy, both of which the suit asserts are in violation of BIPA.
The complaint describes Patronscan's system as "Orwellian" in nature. The suit states Patronscan goes well beyond simple facial recognition to compare multiple mapped data points against thousands of others in Patronscan's database to determine if there is a match between known criminals, more than 50,000 flagged "troublemakers," and VIPs whose biometric information is stored and shared within Patronscan's vast business customer network.
Further, the suit contends, if a previously unflagged customer enters a venue and is involved in an altercation, Patronscan flags them as a problematic customer and retains their biometric data making it available on its "flagged" database. It then allegedly uses this as marketing fodder for potential new business claiming business owners now have the ability through their service to have the ultimate bouncer, one which never forgets a face.
Passed in 2008, the BIPA law has imposed various requirements on businesses in the name of protecting people from the mishandling of biometric identifiers. Among the requirements, the law requires businesses to obtain consent from people before scanning their biometric identifiers, including fingerprints, retinal scans and facial geometry. The law also requires businesses to provide certain notices concerning how the scanned data will be used, stored, shared and ultimately destroyed.
Since 2015, businesses in Illinois have been blitzed by a storm of class action lawsuits under the BIPA law, generally accusing businesses of violating the technical notice and consent provisions, While the lawsuits rarely accuse businesses of causing any actual harm, courts have generally allowed the plaintiffs to still use the law to demand massive potential payouts from the businesses. Under the law, plaintiffs are allowed to demand damages of $1,000 or $5,000 per violation. Under two new Illinois Supreme Court decisions, those damages can be multiplied by each time a person's biometric identifier is scanned, stretching back over the preceding five years.
As a result of such risk, many companies have chosen to settle out of court. Facebook and Google, for instance, famously opted to pay $650 million and $100 million, respectively, to end class action lawsuits accusing them of improperly scanning people's faces in photos uploaded to their photo and media sharing platforms. This newest class action against Patronscan represents another in an ever expanding trend to target supposed BIPA violators.
The Plaintiffs are demanding a trial by jury and are seeking damages of $1,000 to $5,000 per violation, as allowed by the BIPA law, plus attorney fees and court costs.
Plaintiffs are represented by attorneys Kenneth A. Wexler, Justin N. Boley and Eaghan S. Davis of the firm of Wexler, Boley & Elgersma, of Chicago; Ryan F. Stephan, James B. Zouras and Catherine Mitchell, of the Stephan Zouras firm, of Chicago; and Kevin Landau, of Taus, Cebulas and Landau, of Chicago.