The franchisee of a number of Illinois Wendy’s restaurants faces a proposed class action in which a former crew member alleges defendant All-Star, Inc. collected, used, stored and disclosed employees’ biometric data without adhering to the state’s Biometric Information Privacy Act (BIPA).
The lawsuit out of Cook County Circuit Court states that when All-Star hires an employee, that individual is enrolled in the company’s database by way of a fingerprint scan. According to the complaint, the defendant uses fingerprint scans to monitor employees’ work time.
While obtaining and tracking employee work time with fingerprints is not illegal, the Illinois BIPA lays out specific regulations with regard to the collection and use of this biometric data and how it’s stored and disclosed. The BIPA, the case explains, mandates that employers who capture workers’ biometric data:
Properly inform employees in writing of “the specific purpose and length of time” for which their biometric identifiers will be collected, stored and used;
Publish a publicly available retention schedule and guidelines for the permanent destruction of employees’ biometric data;
Obtain a written release from each employee authorizing the collection, storage, dissemination and use of their biometric data; and
Obtain consent from each employee to “disclose, redisclose, or otherwise disseminate” their biometric data to a third party.
The Wendy’s operator, the plaintiff argues, “has violated and continues to violate” the BIPA with its failure to meet each of the above guidelines. According to the complaint, although the Illinois BIPA passed through the state’s legislature in mid-2008, All-Star, Inc. has “failed to take note of the shift in how” companies are directed to handle employees’ biometric identifiers.
Among the plaintiff’s concerns with regard to the defendant’s apparent BIPA violations is that the company apparently fails to inform employees what happens to their biometric information should they go work for another company or, worse, if the business folds. Moreover, All-Star employees, the suit claims, have “no idea” whether their biometric information is disclosed or redisclosed to third parties, nor the identity of those potential third parties. The defendant’s alleged conduct amounts to a grave identify theft risk for proposed class members, the case stresses.
“No amount of time or money can compensate Plaintiff if her biometric data has been compromised by the lax procedures through which Defendant captures, stores, uses, and disseminates her and other similarly-situated individuals’ biometrics,” the lawsuit posits. “Moreover, Plaintiff would not have provided her biometric data to Defendant if she had known that Defendant would retain such information for an indefinite period of time without her consent."