The ability to take and store biometric data has opened up a whole new area of legal rights and regulations related to identity and privacy. The complaint for this class action claims that Southwest Airlines has violated Illinois laws by taking and storing the fingerprints of its employees.
The class for this action is all individuals whose biometrics were captured, collected, obtained, stored, or used by Southwest in the state of Illinois, at any time within the applicable statute of limitations.
Biometric identifiers are any personal features that are unique to individuals, such as fingerprints, DNA, and facial, iris, or palm scans. Biometric information is any information that is based on biometric identifiers.
Biometric information is different from other identifying data in that it cannot be changed. If a person’s Social Security number is stolen and used for illicit purposes, the person can apply for a new one; but no one can obtain a new set of fingerprints.
In 2007, a company that specialized in biometric data went through bankruptcy proceedings, which put its collection of millions of fingerprints at risk of sale to the highest bidder. After this, the Illinois state legislature passed the Biometric Privacy Act (BIPA), to regulate the collection, use, and retention of biometric information.
Among other things, BIPA says that private entities (such as Southwest Airlines) may not take or have a person’s biometrics unless it first does the following:
However, the complaint claims that Southwest, the largest carrier in the country, does not do these things before collecting employee fingerprints. The company requires that employees scan their fingers to clock in and out. According to the complaint, Southwest’s collection, storage, and use of biometric identifiers exposes its employees to “serious and irreversible privacy risks” including the risk that their information will be stolen in security breaches.
The complaint claims that no amount of money can compensate persons whose biometric information is exposed or stolen. It asks the court for an injunction requiring the company to destroy its records of biometrics and stop any further unlawful activity relating to biometric capture, collection, and use.
BIPA provides for damages of $5,000 for each willful or reckless violation and $1,000 for each negligent violation.