Class Action Claims Amazon Web Services Captured, Stored Illinois Consumers’ Biometric Information Without Consent

New to ClassAction.org? Read our Newswire Disclaimer

Amazon Web Services, Inc. is facing a proposed class action lawsuit that claims the cloud storage giant obtained and stored the biometric information of Illinois consumers without adhering to regulations set by the state’s Biometric Information Privacy Act (BIPA).

According to the case, many companies send biometric information collected from employees or customers to Amazon for storage on its cloud-based servers. Such information can include fingerprints from employees who clock in and out of work, hand geometries, and “any personal feature that is unique to an individual,” the complaint explains. For its part, Amazon Web Services, according to the case, converts biometric data obtained from its commercial clients into useable formats and mediums.

While the Illinois BIPA governs the conduct of entities that initially capture, collect and store consumers’ biometric identifiers, the law similarly applies to companies such as Amazon Web Services that come to house data derived from those biometric identifiers, the lawsuit says. According to the complaint, the Illinois BIPA forbids the collection or storage of an individual’s biometric information by a company unless the organization:

• Informs the consumer in writing that their biometric information will be collected or stored;
• Informs the consumer in writing of the specific length and purpose for which their biometric info will be stored;
• Receives a written release from the owner authorizing the storage of their biometric information; and
• Develops a publicly available plan outlining their policies on the storage and destruction of biometric data.

The plaintiff alleges Amazon Web Services has obtained, stored and possessed the biometric data of “thousands” of Illinois consumers without complying with the BIPA. Amazon, the suit alleges, failed to provide a retention and destruction policy, inform consumers of the length and purpose for which their information would be stored, and obtain express written consent to store biometric information.

The suit seeks to represent all Illinois residents whose biometric identifiers were stored by Amazon on behalf of a third party within the applicable period. The suit requests damages of $1,000 per negligent violation and $5,000 per knowing and willful violation for proposed class members.