Neutrogena Skin360 Collects User Biometrics Illinois BIPA Class Action

The Neutrogena brand is owned by Johnson & Johnson Consumer, Inc. (JJCI). This class action sues JJCI for the actions of its Neutrogena Skin360 facial recognition and skin analysis program that collects, stores, and uses the biometrics of those who use it. The complaint alleges that JJCI has violated the Illinois Biometric Information Privacy Act (BIPA) by not fulfilling the requirements before it takes, stores, or uses the biometrics of subject in Illinois.

The class for this action is all individuals whose biometrics were captured, collected, stored, used, transmitted, or otherwise used by JJCI through its Neutrogena Skin360 and associated technologies, within Illinois, at any time within the applicable limitations period.

Biometrics are different from other forms of personal identification. If a person’s credit card information is stolen, the person can get a new card with a different number. But if fingerprints are stolen, the person cannot get a new set of fingers with different prints. Illinois therefore passed a law that aimed to provide some minimal requirements that private businesses must meet before they can collect store or use people’s biometrics.

The Neutrogena Skin360 program, the complaint alleges, takes biometric facial scans of the consumers who use it. The complaint alleges, “Neutrogena Skin360 deploys the Perfect Corp’s YouCam’s technology, which utilizes precise face detection and facial tracking as well as face mapping and advanced facial recognition.” It also claims that JJCI retains the biometric information it has collected.

BIPA requires that private businesses must do a number of things before they collect biometrics:

• They must inform the subject in writing that their biometrics are being generated, collected, and stored.
• They must tell the subject in writing of the particular purpose and length of time for which the biometrics are to be collected, stored, or used.
• They must get a written release from the subject.

BIPA also requires another thing from private businesses that use biometrics. That is, they “must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying” the biometrics that have been collected. This should be done either when the initial purpose for collecting them has been satisfied or at least within three years of the subject’s last interaction with them, whichever comes first.

The complaint alleges that JJCI does not provide these disclosures in writing and does not get written releases from those who want to use its Neutrogena Skin360 program. According to the complaint, JJCI, “intentionally or recklessly, disregarded, and continues to disregard, its obligations under BIPA to protect the privacy interests of its consumers located in Illinois.

Article Type: Lawsuit
Topic: Privacy
Tags: BIPA, Biometric Data, Taking/Storing/Using Biometric Data, Your Privacy