ID verification tech vendor Tokenworks and one of its clients, cannabis product seller Pharmacann, have joined the growing list of those targeted by class action lawsuits under Illinois' biometrics privacy law.
Named plaintiffs Christopher Koltas and Kyle Morrell filed the lawsuit in Cook County Circuit, accusing the companies of allegedly violating the Illinois Biometric Information Privacy Act (BIPA) by allegedly scanning and collecting people's facial images without their consent or without providing notices allegedly required by the law.
Pharmacann is a national supplier cannabis based wellness products operating in dispensaries across North America, including Illinois. Tokenworks, also operating in Illinois provides authentication products and software for industries requiring age verification, auto form filling, or fake ID detection in places like bars, casinos, liquor stores, and dispensaries.
According to the complaint, Tokenworks partners with Pharmacann to provide ID authentication services at Pharmacann's Verilife branded dispensaries located in Illinois. According to the complaint, Pharmacann uses one of Tokenworks' proprietary bio-authentication devices, IdDentiFake at its retail dispensaries to authenticate consumer identities.
According to the complaint, IDentiFake devices use biometric scanning technology to verify a customer’s age and identity after scanning their ID cards. According to the complaint, IDentiFake utilizes an identity verification platform which quickly performs multiple forensic checks and detects microprint, holographic and other security features in IDs provided by consumers visiting an establishment.
According to the complaint, IDentiFake is cloud compatible with the ability to network multiple ID scanners to one central database. Thus, when the IDentiFake device extracts facial biometrics from an individual’s ID, the system allegedly transmits the collected biometrics to networks, servers, and hosted environments.
In the past eight years, thousands of similar lawsuits have been filed against businesses operating in Illinois. The bulk of the lawsuits have targeted employers who use biometric scanning tech to track workers' hours or to limit access to sensitive areas in a work place.
However, a growing number of the lawsuits have also taken aim at vendors who provide technology to help businesses detect fake IDs and monitor customer traffic.
Such lawsuits can prove very costly. Under recent Illinois Supreme Court decisions, plaintiffs can demand damages of $1,000-$5,000 per violation, multiplied across thousands or even millions of possible violations dating back five years. This can quickly cause potential damages to run into the many millions or even billions of dollars, should the case go to trial and a jury find in favor of the plaintiffs.
Some judges have labeled the potential payouts as "astronomical" and "absurd," given that to date no BIPA-related claim has ever asserted that the business actually caused any real harm through their biometric scans. Rather, they have claimed the mere technical violation of the law is enough to justify potentially ruinous damages against a business.
In the case against Pharmacann and Tokenworks, the plaintiffs are seeking damages of up to $5,000 per violation, plus attorney fees.
They are represented by attorneys Eugene Y. Turin, Colin P. Buscarini, and Jordan R. Frysinger of the firm McGuire Law P.C., of Chicago.