Heartland Beef in Illinois Biometric Data Collection BIPA Class Action

Employers have begun using biometric data to identify their workers and for clocking-in and clocking-out purposes. In Illinois, the Biometric Information Privacy Act (BIPA) tries to place at least some minimal requirements on the collection and use of such data. The complaint for this class action alleges that Heartland Beef, Inc. does not abide by the law’s requirements.

The class for this action is all citizens of Illinois who have had their fingerprints collected, captured, or otherwise obtained by Heartland Beef in Illinois.

Identity theft is becoming a problem for virtually everyone in the US now, and for many people around the world. Data breaches happen frequently, and they are often enormous in terms of the number of people affected. Consumers can replace credit card numbers; however, they cannot replace things like fingerprints, irises, or palms which provide biometric information.

Heartland Beef is an Arby’s franchisee with twenty-plus locations in the Midwest, seven of them in Illinois. The company’s time-tracking system requires that employees provide fingerprint scans when they go on and off the clock and also when they cash a customer out at the register or whenever a manager provides a customer with a refund.

BIPA regulates two kind of biometric data, biometric identifiers (retina or iris scans, fingerprints, voiceprints, and scans of hands or face geometry) and biometric information (any information based on these biometric identifiers).

The law does a number of things. First, it requires that before a company can collect biometric identifiers or information for a person, it must do the following:

  • Inform the subject in writing that the identifier or information is being collected or stored.
  • Inform the subject of the specific purpose and length of term for which the identifier or information is being stored and used.
  • Obtain a written release from the subject.

The law also has requirements for the disclosure of biometric data to other parties and the exploitation of such data.

Also, the law requires that any entity in possession of biometric data must have a published, written policy “establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first.”

Finally, the law requires proper security for the biometrics. 

The complaint alleges that Heartland Beef does not inform employees of the extent and purpose for the collection of the scans; that it does not maintain a written, publicly-available policy on the retention and destruction of the biometrics; that it does not inform employees of whether it discloses their data; and does not obtain the required written release.

Article Type: Lawsuit
Topic: Privacy

Most Recent Case Event

Heartland Beef in Illinois Biometric Data Collection BIPA Complaint

November 7, 2019

Employers have begun using biometric data to identify their workers and for clocking-in and clocking-out purposes. In Illinois, the Biometric Information Privacy Act (BIPA) tries to place at least some minimal requirements on the collection and use of such data. The complaint for this class action alleges that Heartland Beef, Inc. does not abide by the law’s requirements.

heartland_beef_biometrics_bipa_compl.pdf

Case Event History

Heartland Beef in Illinois Biometric Data Collection BIPA Complaint

November 7, 2019

Employers have begun using biometric data to identify their workers and for clocking-in and clocking-out purposes. In Illinois, the Biometric Information Privacy Act (BIPA) tries to place at least some minimal requirements on the collection and use of such data. The complaint for this class action alleges that Heartland Beef, Inc. does not abide by the law’s requirements.

heartland_beef_biometrics_bipa_compl.pdf
Tags: Biometric Data, Biometric Fingerprint Violations, Taking/Storing/Using Biometric Data, Your Privacy