Two former warehouse workers claim in a proposed class action lawsuit that PersonalizationMall.com, LLC unlawfully collected and stored employees’ fingerprints for timekeeping purposes without obeying Illinois law.
The two plaintiffs, who both worked at the Bed Bath & Beyond subsidiary’s Burr Ridge, Illinois location in 2017 and 2018, claim they were required to scan their fingerprints every time they clocked in and out of work, including before and after meal breaks. While the use of fingerprints for timekeeping purposes is not unlawful, the women argue that the personalized products company never obtained their consent to collect their sensitive biometric information, nor informed them of its policies for storing and destroying the data.
The case explains that under the Illinois Biometric Information Privacy Act (BIPA), a company must meet the following requirements before collecting and storing individuals’ biometric information:
Inform the individuals in writing that their biometric information will be collected and stored;
Explain in writing the purpose and length of time for such collection, storage, and use;
Receive a written release from the individuals for the collection of their information; and
Publish a publicly available retention schedule and guidelines for the destruction of the collected biometric data.
The lawsuit alleges that PersonalizationMall.com failed to fulfill each of the BIPA’s stipulations before collecting its warehouse workers’ fingerprints.
Noting that fingerprints are unlike social security numbers or other means of identification in that they’re permanent and unique to each individual, the case stresses that the defendant’s “lax” procedures for the collection of such sensitive data has exposed workers to “serious and irreversible privacy risks.”
“For example,” the complaint reads, “if a fingerprint database is hacked, breached, or otherwise exposed, the workers and individuals have no means by which to prevent identity theft and unauthorized tracking.”
Providing that “no amount of time or money” can compensate the plaintiffs and similarly situated individuals for the defendant’s “invasive program,” the suit seeks to cover anyone whose biometrics were captured, collected, obtained, stored, or used by the defendant in Illinois “within the applicable limitations period.”
Originally filed in Illinois state court, the lawsuit has since been removed to the state’s northern district court.