In the summer of 2017, a supermarket chain owned by Kroger was hit with a putative class-action lawsuit for allegedly violating a law protecting individuals’ biometric data and information. This is illustrative of a growing trend of lawsuits over the collection, use, and protection of biometric data and information. In this still-pending case, the Kroger subsidiary utilized a timecard system for clocking employees in and out of work by scanning their fingerprints, which is a form of biometric data. The plaintiffs allege that the time card system violates Illinois law because, among other things, employees never gave written consent to the grocer to store their biometric data in the form of fingerprints.
The suit highlights the growing body of law around the country regarding the collection, use, and protection of biometric information. As this article explains, Illinois has led the charge to protect biometric information, and businesses around the country should learn from Illinois law regarding how to safeguard biometric information and shield themselves from liability stemming from its collection and use.
Broadly speaking, biometric information and data are measurements of a person’s physical characteristics, including fingerprints, iris or retina scans, facial scans, and even voiceprints. In recent years, technology has made collection and usage of these markers easier, and the unique nature of biometric information makes it a powerful security feature for anything from signing into your phone to authenticating your identity when calling a financial institution.
However, the unique nature of biometric information also makes it vulnerable to corruption. Unlike a password or PIN, biometric information cannot be changed. If a password or PIN is compromised, it can be reset; once compromised, biometric information is compromised forever. Lawmakers around the country have taken notice of the special need to protect biometric information and are taking steps to regulate its collection, use, and protection.
Illinois Biometric Information Privacy Act
In 2008, Illinois became the first state to enact a law regarding biometric identifiers and information. Illinois’ law has since served as a model for other states’ laws and proposed legislation. Texas and Washington followed Illinois’ example by passing laws aimed at protecting biometric information. As additional states grapple with how best to protect biometric information, lawmakers will...
