Does a Security Company Have the Right to Collect Biometric Identifiers?
An interesting case was filed in the United States District Court in California. The plaintiffs filed a class action complaint against the defendant, alleging two causes of action violating the Illinois’ Biometric Information Privacy Act (BIPA). The defendant filed a motion to dismiss.
One of the plaintiffs worked as an Uber Eats and DoorDash delivery driver making deliveries to customers’ homes. As part of his regular delivery process, the plaintiff alleged that he walked to the front door of a customer’s residence to make a delivery. On multiple deliveries, the defendant’s security system captured scans of plaintiff’s face and/or hands.
Another plaintiff worked as an Amazon, DoorDash, Postmates, Dispatch, Veho, Axlehire, and Roadie delivery driver making deliveries to customers’ homes. As part of his regular delivery process, he walked to the front door of a customer’s residence to make a delivery. On multiple deliveries, the defendant’s security system captured scans of his face and/or hands.
Other plaintiffs alleged exactly the same facts when they make deliveries to customers’ homes.
The defendant company sells different security camera models, each equipped with on-device AI monitoring capabilities. These cameras included multiple models of doorbell cameras, exterior mounted and floodlight cameras, and a series of base stations. Each of the defendant’s technologies is categorized as either “AI” or “BionicMind AI.” The latter has “the ability to recognize similar faces, body shapes/positions, different objects and even human behavior with its machine self-running system,” according to the company.
The defendant is capable of making identifications by storing and analyzing biometric-identifier data so that the AI can “keep learning the details of the characteristics of people, including different angles of the face and bodies [to] help the AI recognize a person more accurately and quickly.”
In sum, unbeknownst to the plaintiffs, the defendant collected, scanned, and indefinitely stored in an electronic database the plaintiffs’ faces and/or hand geometry, each time that the plaintiffs and class members made a delivery to the defendant’s customers’ homes.
The court pointed out that the plaintiffs failed to state a claim because they do not allege that the defendant captures, collects, or obtains their biometric identifiers, nor does the statute require that the defendant provide notice to plaintiffs. Further, the court indicated that the plaintiffs failed to state a claim because they do not allege that the defendant is in possession of their biometric data.
The court pointed out that BIPA, Section 15(b) provides that “No entity may collect, capture, purchase, receive through a trade, or otherwise obtain a person’s or a customer’s biometric identifier or biometric information unless it first (1) informs the subject in writing that a biometric identifier or biometric information is being collected or stored; (2) informs the subject in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and (3) receives a written release executed by the subject of the biometric identifier or biometric information.”
In conclusion, the court held that the plaintiffs did not allege that the defendant collected, captured, purchased, received, or obtained their biometric identifiers and they failed to state a claim under BIPA. Therefore, the court granted the motion to dismiss with leave to amend as to the first cause of action. As to the second cause of action, BIPA Section 15(a) provides that “(a) private entity in possession of biometric identifiers or biometric information must develop a written policy made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information. The complaint lacked any allegation that the defendant specifically collected or obtained the plaintiffs’ biometric identifiers, nor was the court able to identify any allegations in the complaint that the defendant independently possessed the plaintiffs’ biometric data.
Therefore, the court found that plaintiffs failed to state a claim under BIPA Section 15(a) and dismissed the complaint with leave to amend.
Looking for a reprint of this article?
From high-res PDFs to custom plaques, order your copy today!
