Antech Diagnostics Fingerprints and Handprints Illinois BIPA Class Action

The complaint for this class action describes Antech Diagnostics, Inc. as “a veterinary diagnostic and lab testing facility” in Illinois. According to the complaint, Antech requires employees to scan their fingerprints or handprints for timekeeping purposes. However, the complaint brings suit against Antech and Vicar Operating, Inc. (which does business as VIPA), alleging the companies do not fulfill the requirements of the Illinois Biometric Information Privacy Act (BIPA) before collecting, storing, and using biometrics.

The class for this action is all persons who had their fingerprints or handprints collected, captured, received, otherwise obtained, or disclosed by Antech while they were in Illinois.

When workers scan their fingers or hands, their biometrics go to Antech’s database and, the complaint claims, “broadcast through Antech’s software and web-based data collection and storage system.” However, the complaint alleges that taking and storing biometrics present greater risks to the subjects than ordinary types of identification or personal information.

For example, the complaint alleges, if the number for an ID badge or a credit card is stolen, the person can cancel the badge or credit card and get another, with a different number. But if a handprint or fingerprint is stolen, the person cannot get another finger or hand that produces a different print. BIPA attempts to provide some basic guidelines for the collection, storage, and use of biometrics.

Biometrics include things like fingerprints, hand scans, facial geometry scans, voiceprints, and retina and iris scans.

Under BIPA, private businesses that wish to collect, store, or use biometrics must do certain things:

• They must tell the subject in writing that their biometrics are being collected or stored.
• They must tell the subject in writing of the specific purpose and length of time for which the biometrics are being collected, stored, or used.
• They must receive a written release from the subject.
• Before they disclose or disseminate the information to others, they must obtain consent from the subject.
• They must maintain a publicly-available retention schedule and guidelines for permanently destroying the biometrics.

The complaint alleges that the companies have not done these things.

Also the complaint alleges that Antech does not give subjects full information about the storage and use of their biometrics. “Upon information and belief,” it says, Antech also does not tell its employees “that it discloses their fingerprint data to at least one out-of-state third-party vendor” or “that it discloses their fingerprint data to other, currently unknown third parties, which host the biometric data in their data centers.”

Finally, the complaint alleges that Antech does not have a publicly-available retention schedule and does not follow BIPA’s requirement to destroy the biometrics “when the initial purpose for collecting or obtaining such data has been satisfied or within three years of the employee’s last interaction with each company.”

The sole cause of action in the complaint is violation of BIPA.

Article Type: Lawsuit
Topic: Privacy
Tags: BIPA, Biometric Data, Biometric Fingerprint Violations, Taking/Storing/Using Biometric Data, Your Privacy