Subway, HP Collection of Biometrics of Restaurant Workers Illinois Class Action

Two companies—Doctor’s Associates, LLC (DAL) and HP, Inc.—are accused in this class action of violating the Illinois Biometric Information Privacy Act (BIPA). The complaint alleges that they have been responsible for the collecting, storing, and using biometrics at Subway sandwich franchises without fulfilling the notice and consent or other requirements this law sets forth.

Two classes have been defined for this action:

• The Subway Class is all individuals whose fingerprint reference template was stored on any Biometric System at a Subway restaurant in Illinois, on or after June 7, 2016.
• The HP Class is all individuals whose fingerprint reference template was stored on any HP point-of-sale system in Illinois on or after June 7, 2016.

DAL is the American franchisor of Subway, which the complaint calls “the world’s largest quick-service restaurant chain.” One requirement for Subway franchises is that they use specific equipment at their locations. Franchisees must enroll in a program that offers hardware for its “Restaurant Technology as a Service” (RTaaS) for a point-of-service (POS) system.

That system is supplied by HP, which makes computers and other hardware, including POS systems. Franchisees pay monthly fees to HP. The software is SubwayPOS, licensed to the franchisee by DAL.

The system includes a biometric scanner that enables workers to use their fingerprints to do things such as unlock registers and clock in and out.

The plaintiff in this case, Mariel Ronquillo, worked for a Subway franchise in Chicago, Illinois. The Subway restaurant had HP POS system with the SubwayPOS software. The system captured Ronquillo’s fingerprint, the complaint says, and “create[d] a reference template, an algorithmic representation of the features of the fingerprint used to subsequently identify” her. She then was required to use that system for clocking in and out for her shifts and breaks.

The complaint lists a number of ways in which DAL and HP violated BIPA with the use of the system in Illinois:

• They “did not explain the Biometric System to Subway workers.”
• They “did not tell Subway’s workers how they used data collected through the Biometric System.”
• They “did not tell Subway’s workers how long they kept the data collected through the Biometric System.”
• “Subway’s workers did not consent to [DAL’s and HP’s] capture, collection, use, or retention of their fingerprints or the identifying data derived from them.”

BIPA has been in effect in Illinois since 2008. The complaint alleges that by the beginning of the class period in this case, it had been in the news for a while, with Facebook, Google, and Shutterfly all accused of BIPA violations.

Article Type: Lawsuit
Topic: Privacy
Tags: BIPA, Biometric Fingerprint Violations, Taking/Storing/Using Biometric Data, Your Privacy