Sysco Use of Facial Scans to Judge Driver Fatigue Illinois BIPA Class Action

Sysco Chicago, Inc. and its parent company, Sysco Corporation, have facial scans taken of the drivers operating their trucks and delivery vehicles, using facial recognition software provided by Samsara, Inc. This system is intended to monitor drivers’ fatigue and levels of distraction, but the complaint for this class action alleges that for drivers in Illinois, it has involved violations of the state’s Biometric Information Privacy Act (BIPA).

The class for this action is all Sysco delivery drivers who scanned their faces using Samsara’s high-definition AI dash cameras while operating and driving Sysco’s delivery vehicles and trucks in Illinois, without first executing a written release, between December 2, 2017 and the resolution of this action.

The systems at issue, the complaint alleges, involve high-definition artificial intelligence (AI) dash cameras and facial recognition software that use facial scans “to monitor and manage drivers of commercial fleets and industrial operations.”

The complaint alleges, “Samsara’s business model relies on identifying and capturing the actions of its customers’ drivers to monitor their fatigue and level of distraction by placing a camera on them.” It quotes Samsara’s website as saying, “we rely on facial recognition information derived from images of drivers.”

Sysco installed the systems in its trucks around June 2020, the complaint alleges.

The problem is that the facial recognition information involves biometric information which poses particular risks to privacy. Unlike other identifying information, biometrics are, as the complaint says, “unique and permanent” to each person. That is, if facial scan information is stolen, victims cannot get another face with different facial information.

Because of the increased privacy risks with biometrics, the Illinois legislature passed BIPA, to begin to regulate the collection, storage, and use of this kind of information. BIPA sets forth some basic requirements for private entities that want to collect, store, or use biometrics in Illinois.

Among BIPA’s requirements is that such entities, before capturing or collecting biometric identifiers, must tell the subject the biometrics are being captured or collected and must obtain the subject’s written consent to it. The private entity must also tell the subject the purpose of the collection of the information and the length of time the information will be retained.

The private entity must also have a written policy that is available to the public that sets forth a retention schedule and guidelines for permanently destroying the information. Finally, the private entity cannot disclose or disseminate the information unless it first gets the subject’s consent to it, except in certain situations.

The complaint alleges that Sysco did not fulfill these requirements.

Article Type: Lawsuit
Topic: Privacy
Tags: BIPA, Biometric Data, Facial Scans, Taking/Storing/Using Biometric Data, Your Privacy