Euromarket Designs, Inc., which does business as Crate & Barrel, is in the crosshairs of a proposed class action filed in Illinois circuit court over its allegedly unlawful “collection, use, storage, and disclosure” of consumers’ sensitive biometric data.
The lawsuit says the housewares and furniture retailer enrolls new employees into a database used to monitor work time. Rather than utilize, for instance, a time clock or a more traditional time-keeping method, Crate & Barrel requires employees to have their fingerprints scanned via a biometric timekeeping device. According to the lawsuit, using employees’ fingerprints as a means of tracking work hours poses substantial privacy risks for workers. From the complaint:
“Unlike ID badges or time cards—which can be changed or replaced if stolen or compromised—fingerprints are unique, permanent biometric identifiers associated with each employee. This exposed [Crate & Barrel’s] employees to serious and irreversible privacy risks. For example, if a database containing fingerprints or other sensitive, proprietary biometric data is hacked, breached, or otherwise exposed—like in the recent Yahoo, eBay, Equifax, Uber, Home Depot, MyFitnessPal, Panera, Whole Foods, Chipotle, Omni Hotels & Resorts, Trump Hotels, and Facebook/Cambridge Analytica data breaches—employees have no means by which to prevent identity theft, unauthorized tracking or other unlawful or improper use of this highly personal and private information.”
Citing the Illinois Biometric Information Privacy Act, the lawsuit alleges Crate & Barrel has unlawfully failed to:
- Properly inform proposed class members in writing of “the specific purpose and length of time” for which their fingerprints are collected and stored;
- Provide a publicly available retention schedule and guidelines for permanently destroying proposed class members’ fingerprint data; and
- Obtain a written release from proposed class members with regard to the collection, storage and dissemination of their fingerprints.
Even further, the case charges Crate & Barrel improperly discloses its employees’ fingerprint data to at least one other currently unknown third party.