Use this button to switch between dark and light mode.

Biometrics Litigation Heats Up In 2022

October 12, 2022

By Kevin Hylton | LexisNexis Practical Guidance

The idea of capturing data from a person’s unique physical characteristics for purposes of identification is not new, but the launch of Apple’s Face ID in 2017 ushered in a brave new world in which our faces, voices and eyes are now being widely used every single day to immediately confirm our personal identities. This collection of data that captures a person’s unique physical characteristics for purposes of identification is known as biometrics.

One market report estimated biometrics to be a $49 billion industry this year and that it will grow at an annual rate of 15.8% through 2027.

This steep growth is fueled by growing consumer acceptance of the use of biometrics for purposes of digital identity verification. A 2022 survey found found that nearly half of Americans now feel that the introduction of biometric identifiers have made their lives better.

State and federal legislators are now hustling to catch up with the explosive growth in biometrics, passing laws to regulate how businesses may collect and use this personally identifiable information.

“Not every state has passed comprehensive biometrics or data privacy laws, but Illinois became the first state to adopt a comprehensive biometrics privacy law back in 2008 and that law is quite broad,” said Kristin L. Bryan, a partner in the Data Privacy, Cybersecurity & Digital Assets Practice at Squire Patton Boggs, where she represents clients in complex data privacy, cybersecurity and data breach disputes in federal and state courts nationwide.

Bryan explained that the Illinois Biometric Information and Privacy Act (BIPA) applies to all businesses that collect and maintain biometric data on consumers. It is a broad measure that contains a variety of notice and consent requirements, retention and destruction requirements, disclosure and sale restrictions and security requirements.

“Notably, BIPA contains a private right of action for any individual aggrieved by a violation and a provision of liquidated statutory damages,” said Bryan. “In recent years, BIPA has been one of the most frequently litigated data privacy statutes in the country, with more than one thousand claims filed in which plaintiffs have sought to collect damages under BIPA for both individuals and classes.”

Most of the commercial litigation filed under BIPA relates to the workplace, such as employers’ use of fingerprints or face scans for timekeeping purposes. But litigation has started to heat up this year in other interesting areas beyond the employment context.

“One of the emerging biometrics litigation trends we’re seeing now is related to ‘virtual try-on’ claims,” said Bryan.

Bryan explained that “virtual try-on” technology was widely rolled out by retailers during COVID-19 lockdowns as a tool that allows online shoppers to virtually try on eyeglasses, makeup and other consumer products from the comfort of their own homes.

“This technology is essentially a virtual mirror that allows consumers to try on products, using a camera on their phone or computer, and obtain a personalized image that shows them what they would like if they were to purchase the product,” she said. “It’s not clear that the nature of this technology even falls under BIPA, but that has not precluded plaintiffs’ lawyers from filing many class action lawsuits alleging that virtual try-on tools are scanning facial geometry and there fall under BIPA’s scope.”

These lawsuits have targeted some of the largest cosmetics companies in the world, according to a July 2022 report by Law360.

“Another BIPA litigation trend has unfortunately arrived in the form of unlawful profiting claims filed under Section 15(c) of the legislation,” said Bryan. “This provision prohibits private entities from selling, leasing, trading or otherwise profiting from an individual’s biometric information.”

Bryan noted that plaintiffs are increasingly turning to Section 15(c) as an additional cause of action to include in a larger BIPA lawsuit. She expects to see continued efforts by plaintiffs’ counsel to allege profiting violations against companies that use biometric data to help create a product or service they seek to monetize.

Other trends in biometrics-related litigation in 2022 being monitored by Bryan and her colleagues include:

Voiceprints

Voice biometrics rely on the analysis of unique voice patterns to verify an individual’s identity. There has been an increased volume of BIPA class action filings targeting the use of these “voiceprints” that focus narrowly on the use of voice data for time and attendance monitoring purposes by employers.

Vehicle Cameras

Transportation companies are increasingly relying on cameras mounted on the interior windshields of vehicles in their fleets to monitor driver activity. These cameras rely on AI technology that uses facial recognition to detect certain types of driver behavior and attentiveness. Plaintiffs’ lawyers have filed BIPA class actions alleging that these vehicle cameras scan drivers’ facial geometry and are therefore subject to the law’s data privacy requirements.

Timekeeping

There has been a wave of new BIPA filings focused on employers that utilize facial recognition software in their timekeeping systems. This brings together elements of two popular plaintiffs’ litigation strategies — targeting facial biometrics technology and targeting employer timekeeping systems — to create a new front for class action litigation in 2022.

I had the privilege of interviewing Ms. Bryan on the latest episode of our “Practical Guidance: Data Privacy Series” podcast, where we invite experts to provide insights on timely data privacy and security issues facing legal practitioners. Listen now or download the episode regarding the latest trends in biometrics-related litigation.