Biometrics have long been used in science fiction on television and in the movies. Back in 1966 Star Trek started using voice id, then moved on to retina scans, basic vitals, and face recognition.  The Starship Enterprise was not alone. Other famous sci-fi adventures such as 2001: A Space Odyssey, Back to the Future 2, Robo Cop, and I Robot – to name a few – have also used biometrics for their characters to gain access to secure places and information.  Life has begun imitating art with the use of biometrics, but what art didn’t show us are the legal pitfalls of using this form of identification for security purposes.

Earlier this year Roundy’s supermarkets, a chain owned by Kroger Co., was named by plaintiff Norman Baron in a putative class action for allegedly storing the fingerprint information if its employees without having provided the required disclosures and obtaining a fully executed authorization (Baron v. Roundy's Supermarkets Inc. et al., case number 1:17-cv-03588). This is a violation of Illinois Biometric Information Privacy Act (BIPA). The fingerprints are used as part of a time card system where employees have to scan their fingerprint to clock in and out of work.

In additional to the complaint of Roundy’s not having obtained a written release to collect and store the biometric identifiers, the suit also addresses the lack of a way to reassign information in case of a breach. As stated by Baron, “A person can obtain a new social security number, but not a new fingerprint, which makes the protection of, and control over, biometric data particularly important – particularly given the increasing use of biometric information or identifiers in the stream of commerce and financial transactions.”

While this case is on-going, a similar case against L.A. Tan has been settled out of court (Sekura v. L.A. Tan Enterprises, Inc. Circuit Court Of Cook County, Illinois County Department, Chancery Division Case No. 2015-CH-16694). They stored fingerprints in a national membership database as a way to allow customers to check in at any franchise location more easily.  L.A. Tan also failed to provide disclosures to their customers about the collection and retention of the data and used an out of state third party software Company.  Both were in violation of the BIPA.

While the law was enacted in 2008, it is only recently that litigation has ramped up. There are suits pending against companies such as Facebook, Snapchat, and Google. Illinois and Texas are currently the only states which have such laws, but Illinois seems to be the state of choice when it comes to litigation.

Any company considering the use of biometric data should give significant consideration to how they will use, store, and dispose of such information. Also, as is the case with background verifications, those companies must make sure to obtain written consent for the use of that information after having provided all required disclosures.

Sources:  chicagotribune.com, fingerprintsettlement.com, forbes.com, topclassactions.com, law360.com