Jumio Facial Scans for Identity Verification for Airbnb Illinois Class Action

Jumio Corporation handles mobile payments and identity verification for Airbnb, among other companies. In providing this service, the complaint for this class action alleges, Jumio obtained photos of various people’s faces and of their government-issued IDs, and scanned and stored their facial geometry together with personally identifying information (PII). The complaint alleges that in taking, storing, and using this information, Jumio did not fulfill the requirements of an Illinois law, the Biometric Information Privacy Act (BIPA).

The class for this action is all Illinois Airbnb users whose biometric data Jumio collected between February 18, 2017 and February 18, 2022.

Jumio is described in this class action complaint as “an online mobile payments and identity verification company that provides card and ID scanning and validation products for mobile and web transactions.” The complaint alleges that Jumio “verifies the identities of Airbnb users before those users complete transactions using the Airbnb app.”

The complaint alleges, “Unlike other forms of personal identification, such as photo IDs or passwords, biometrics are immutable aspects of our bodies.” Collecting, storing, and using biometrics presents a greater risk to the subjects than collecting, storing, and using other types of PII. For example, if a driver’s license number is stolen, the person can have it cancelled and get a new license with a different number. However, if a facial scan is stolen, the person cannot get a new face that provides a different scan.

Illinois has made a start on protecting its citizens by passing BIPA, to require very basic requirements that must be fulfilled before a business can collect, store, or use their biometrics. But the complaint alleges that Jumio took and stored Illinois Airbnb users’ facial scans without fulfilling the requirements of the law.

According to the complaint, Jumio violated BIPA in the following ways:

• It did not tell the subjects, in writing, that their biometrics were being collected, used, or stored.
• It did not tell the subjects, in writing, of the specific purpose and length of time for which their biometrics would be collected, used, or stored.
• It did not get the subjects’ written consent to collect, use, or store their biometrics.
• It did not tell the subjects about any third parties with which it would share, disclose, or otherwise disseminate the biometrics.

The complaint alleges, “Plaintiffs and class members have not been notified where their biometric data is being stored, for how long [Jumio] will keep their biometric data, and what might happen to this valuable information.”

Article Type: Lawsuit
Topic: Privacy
Tags: BIPA, Facial Scans, Taking/Storing/Using Biometric Data, Your Privacy