The BIPA Beat: A Roundup of the Latest Developments From Illinois’s Privacy Law ‘Cottage Industry’

The start of this month has already brought news of a potentially high-profile lawsuit under Illinois’s Biometric Information Privacy Act (BIPA), this time against the online dating platform Tinder, thanks to its use of face biometrics to verify the identities of some of its users. But it’s just the latest in a stream of cases from what some observers have called a cottage industry, as BIPA’s dragnet sweeps up all manner of alleged offenders. Here’s a roundup of cases that caught our attention over the past month:

A New Foe Has Appeared: Mass Arbitration

ClassAction.org and Milberg, a law firm specializing in class action lawsuits, are inviting gamers in Illinois to sign up for a mass arbitration effort directed at the video game maker EA Sports. The latter offers a ‘Game Face’ feature for some of its products that lets an end user upload a picture of their face so that a digital version can be mapped onto a virtual avatar. ClassAction.org says it’s “possible” that EA violated the Biometric Information Privacy Act (BIPA) by collecting players’ biometrics without obtaining written consent and disclosing how the data would be used, and suggests that the mass arbitration could result in as much as $1,000 or more being paid out to each claimant.

Facebook BIPA Plaintiff Found to Have No Standing

A California federal court tossed a putative class action lawsuit against Facebook under Illinois’s Biometric Information Privacy Act (BIPA), on the basis that the plaintiff had no standing in the case. Clayton Zellmer had argued that Facebook failed to provide users with a written policy concerning its retention and deletion of biometric data as required under BIPA; but the court determined that Zellmer did not demonstrate how this had caused him harm – a constitutional requirement for a plaintiff to have standing in a given case.

Third Party Vendor Escapes BIPA Liability

In a potentially significant ruling, an Illinois circuit court judge dismissed a class action lawsuit against a third party vendor under Illinois’s Biometric Information Privacy Act. The lawsuit concerned a trucking company’s use of a driver monitoring system that featured facial recognition, naming both Beelman Truck Co. and dash-cam developer Samsara as defendants. But the latter successfully argued that holding third party vendors responsible for the actions of their customers would lead to absurd results. Samsara also noted that it had provided customers with a sample BIPA policy and consent form, and required them to confirm that they had established consent from their drivers.

That result looks like good news for Sysco. The restaurant food supplier is also facing a BIPA lawsuit stemming from its use of biometric fatigue monitoring systems, provided by Samsara, in its delivery vehicles. Like so many others, the company has been accused of failing to properly obtain written consent from those whose biometrics were collected – in this case its drivers. Sysco says it installed the driver monitoring system in an effort to comply with the U.S. Department of Transportation’s road safety regulations.

BIPA Ensnares Another ‘Virtual Try-On’ Defendant

The jewelry retailer Pandora became the latest ‘virtual try-on’ company to face a proposed class action lawsuit under Illinois’s Biometric Information Privacy Act (BIPA). The retailer offers a virtual try-on service that uses face biometrics technology to let consumers see how items of jewelry would look on them through a digital mock-up; the lawsuit alleges that Pandora failed to properly obtain end users’ consent for the collection of their biometric data through this tool. A number of companies, including major brands like Estée Lauder, have faced similar BIPA complaints over virtual try-on systems.

DePaul University Gets ‘Financial Institution’ Exemption

An Illinois Federal Court judge dismissed a class action lawsuit against DePaul University over its alleged violation of the state’s Biometric Information Privacy Act (BIPA). The plaintiff had argued that the school failed to properly obtain consent for its collection of students’ biometric information through its use of ‘Respondus Monitor’ remote proctoring software. Judge Robert Gettleman agreed with the defendant’s argument that because the school was a participant in the U.S. Department of Education’s Federal Student Aid Program, it was entitled to a BIPA exemption for financial institutions.

Staffing Company Settles BIPA Suit for $5.4M

Ron’s Staffing Service, a Chicago-based employee procurement company focused on light industrial businesses, agreed to pay out almost $5.4 million in compensation to settle a class action lawsuit filed under Illinois’s Biometric Information Privacy Act. The lawsuit alleged that Ron’s Staffing Service had failed to properly obtain consent for the collection of employees’ fingerprint biometrics for use with a biometric time and attendance system.

Plaintiff Drops BIPA Case Against Walmart

A plaintiff dropped his Biometric Information Privacy Act (BIPA) case against Walmart. Illinois resident James Luthe had filed the class action complaint against the retailer over its alleged use of a biometric video surveillance system, arguing that it violated the state’s BIPA by collecting individuals’ biometric data without their consent. Luthe did not provide a reason for the withdrawal of his complaint, and Walmart says it did not reach a settlement with the individual.

… And, of course, we would be remiss if we didn’t mention the latest twist in an ongoing BIPA lawsuit against the controversial facial recognition firm Clearview AI:

Prosecutor Confirmation Puts Clearview’s BIPA Case Back on Track

A class action lawsuit against Clearview AI appears to be back on track, with the US District Court for the Northern District of Illinois confirming that the law firm Loevy & Loevy represents the plaintiffs. Brought forward via claims that Clearview had violated Illinois’s Biometric Information Privacy Act (BIPA), the case had been disrupted when lawyer Scott Drury quit the firm Loevy & Loevy and sought to represent its clients under his own firm, Drury Legal. That hasn’t worked out, nor did things go well for Drury Legal in separate BIPA cases against Amazon and Microsoft, which were dismissed by a federal judge for the US District Court for the Western District of Washington.

That’s the big BIPA news from November, but stay tuned. There’s more where that came from.

–

December 2, 2022 – by Alex Perala