A class action lawsuit accuses Chicago area car dealership Lincolnwood Toyota of violating Illinois' biometrics privacy law by requiring workers to scan their fingerprints to access a secure vehicle keybox at the dealership.
"When a Defendant employee wishes to access a vehicle key to show a customer a car or for a test drive, for example, they are required to scan their fingerprint into the biometric system," says the suit, filed in Cook County Circuit Court. "This key inventory then grants an employee access to a key and creates an audit trail identifying the employee who checked out a key."
While there are advantages to this system, there are also security risks to employees, the suit says.
"Unlike key fobs or identification cards - which can be changed or replaced if stolen or compromised - fingerprints are unique, permanent biometric identifiers associated with the employee," the lawsuit says. "This exposes employees to serious and irreversible privacy risks."
Illinois state laws requires employers to obtain a written release form before requiring fingerprints and also to provide in writing a schedule for how long the information will be kept before being destroy, the suits says. It seeks a court order declaring the dealership is in violation of the state law plus monetary damages and legal fees.
Lawsuits like these have become an increasingly lucrative opportunity for a group of plaintiffs' law firms from Illinois and elsewhere, targeting businesses with potentially costly class actions over technical violations of the law known as the Illinois Biometric Information Privacy Act.
The class actions, worth potentially many millions or even billions of dollars, depending on the size of the company, have been aimed at businesses of all types and sizes in the past few years. The bulk of the lawsuits have targeted employers, who use so-called biometric systems to track workers' paid hours or to control access to secured or sensitive areas in a workplace, like cash rooms, medication lockers or car key boxes.
Under the BIPA law, plaintiffs are allowed to demand damages of up to $5,000 per violation, even if no one was actually harmed by the collection of the data. The Illinois Supreme Court has in recent months issued rulings declaring that the law should be interpreted to allow plaintiffs to define individual violations of the BIPA law as each time a worker scans their fingerprint, not just the first violation. Further, the decisions allow them to demand damages for each worker fingerprint scan dating back over the preceding five years, potentially setting the stage for damages worth many millions of dollars.
Facing such risk, nearly every company targeted by such class actions has ultimately opted to settle, rather than chance a trial. Settlements have ranged from hundreds of thousands to dollars to tens of millions, with plaintiffs' lawyers typically claiming 25-40% of the payouts as legal fees.
The plaintiffs vs Lincolnwood Toyota are represented by David Fish, Mara Baltabols and John Kunze of the firm of Fish Potter Bolaños, P.C.