1-800 Contacts Got Facial Scans in Acquisition Illinois Class Action

The complaint for this class action alleges that 1-800 Contacts, Inc. acquired the facial scans of many individuals when it acquired a company called Ditto Technologies, Inc. It brings suit on behalf of those individuals who live in Illinois, alleging that 1-800 Contacts has violated a law of that state called the Biometric Information Privacy Act (BIPA), which sets rules for the collection, storage, retention, and use of biometrics by private businesses.

The class for this action is all individuals whose biometrics were collected, captured, purchased, received through trade, or otherwise obtained by 1-800 Contacts in Illinois at any time within the applicable statute of limitations period.

Biometrics are different from other private identifying information because they cannot be changed or replaced. If credit card numbers are stolen, for example, individuals can cancel that card and get a replacement with new numbers. But if fingerprints are stolen, individuals cannot get a set of replacement fingers with new prints.

This case is about 1-800 Contacts acquisition of individuals’ biometrics in the form of scans of their facial geometry, including of individuals in Illinois, without following any of BIPA’s requirements.

If a business wants to collect, store, use, or share biometrics, BIPA requires that it do certain things:

• It must tell the subject whose biometrics are being collected, in writing, that the biometrics will be collected and/or stored.
• It must tell the subject, in writing, of the specific purpose and length of time for which the biometrics are being collected, stored, or used.
• It must receive a written release from the subject allowing the capture or collection of their biometrics.
• It must also make publicly available a written policy for storage and destruction of the biometrics.

The complaint alleges that 1-800 contacts has not done these things, saying that “[1-800 Contacts] has actively collected, captured, purchased, or otherwise received through trade—without providing notice, obtaining informed written consent, or publishing data retention policies—the biometrics of thousands of individuals throughout Illinois through its acquisition of Ditto Technologies, Inc. (‘Ditto’), a provider of facial geometry ‘virtual try-on’ technology.”

It has therefore, the complaint alleges, “obtained thousands of templates of facial geometry … [that] have been created through sophisticated facial recognition technology…”

The complaint claims that 1-800 Contacts “has obtained the facial geometry of users in Illinois without first receiving those individuals’ informed written consent and informing them how long it intends to keep such biometric identifiers and information” and without publishing a written policy as to how long it intends to keep the biometrics and when they will be destroyed.

Article Type:
Topic: Privacy
Tags: BIPA, Facial Scans, Taking/Storing/Using Biometric Data, Your Privacy