E.A. Sween Facial Scans for Timekeeping Illinois BIPA Class Action

E.A. Sween Company is one of the many companies that now use employee biometrics for timekeeping purposes. The company requires that employees have their facial geometry scanned and then uses the scans to monitor the amount of time they work. More and more companies are requiring the use of biometrics, for worker identification or authentication, but the complaint alleges that Sween does not fulfill the requirements of an Illinois law, the Biometric Information Privacy Act (BIPA) when it uses the biometrics of Illinois citizens.

The class for this action is all individuals who work or worked for E.A. Sween in Illinois whose facial geometry or other biometric identifiers or information was collected, stored, or otherwise obtained by the company during the applicable statutory period.

Biometrics are different from other forms of identification because they present greater and irreversible privacy risks. For example, if a debit card number is stolen, the card owner can cancel the card and get a new one with a different number. But if a person’s fingerprints are stolen, they cannot get new fingers with a different set of prints.

Biometric data is already at risk. The complaint claims, “In 2015, a data breach at the United States Office of Personnel Management exposed the personal identification information, including biometric data, of over 21.5 million federal employees, contractors, and job applicants.” Similarly, hackers broke into Aadhaar, the largest database of biometrics in existence, holding the information of more than a billion citizens of India.

As late as 2019, the complaint claims, Suprema, a security company that uses fingerprints and facial scans “maintained biometric data and other personal information on a publicly accessible, unencrypted database.”

BIPA was an attempt by the Illinois legislature to begin to protect the privacy of individuals and the security of their information by imposing basic conditions on the collection, storage, or use of biometrics.

BIPA requires that when a private business wants to collect, store, or use the biometrics of a citizen of Illinois, it must do certain things:

• It must inform the subject in writing of the purpose and length of time for which their biometrics are being collected, stored, or used.
• It must have a publicly-available retention schedule as well as guidelines for permanently destroying the biometrics when the original purpose has passed.
• It must get a written release from the subject allowing it to collect, store, or use the biometrics.
• It must get consent from the subject to disclose or share the biometrics with other parties.

The complaint alleges that Sween violated BIPA because it did not do any of these things.

Article Type: Lawsuit
Topic: Privacy
Tags: BIPA, Biometric Data, Taking/Storing/Using Biometric Data, Your Privacy