CVS Violated Illinois Biometric Law, Milberg Lawsuit Claims

CVS Pharmacy, Inc. failed to comply with the Illinois Biometric Information Privacy Act (BIPA) when it collected facial image data from customers obtaining ID photos, claims a class action lawsuit filed by Milberg Coleman Bryson Phillips Grossman PLLC (Milberg).

Illinois residents who had an ID photo taken at a CVS store within the state may be eligible to join the class and receive compensation for violations of their biometric data rights.

Illinois’ Biometric Privacy Law

Illinois has one of the toughest laws in the country when it comes to protecting the biometric data of its residents. Biometric identifiers—which include an iris or retina scan, fingerprint, voiceprint, or scan of an individual’s hand or face geometry—are a type of particularly sensitive personal data. Once compromised, biometrics cannot be changed in the way that, for examples, a victim of identity theft can receive a new Social Security number.

One of the strictest privacy laws in the country, BIPA is designed to protect biometric information, such as face prints for facial recognition.

Recognizing the unique privacy concerns raised by biometric data, Illinois enacted BIPA, which prohibits a private entity from obtaining and/or possessing an individual’s biometrics unless it does the following:

• Informs the data subject in writing that their biometric identifier or biometric information is being collected or stored;
• Informs the data subject in writing about the specific purpose and length of term for which their biometrics are being collected, stored, and used;
• Receives a written release from the data subject for the collection of their biometrics; and
• Makes publicly available written retention schedules and guidelines for permanently destroying biometric data.

In addition, BIPA makes it unlawful to share or sell biometric data for profit without the proper consent. Under BIPA, data subjects whose rights are violated have a private right of action that allows them to sue and recover damages of $1,000 (negligent violation) or $5,000 (intentional or reckless violation) per violation, in addition to attorneys’ fees and costs and appropriate injunctive relief.

Plaintiffs Say CVS Passport Pictures Illegally Collect Biometrics

Among the services that CVS provides is passport and ID photos. CVS states on its website that the company takes passport and ID photos using the KODAK Biometric ID Photo System, which “automatically verifies your photos meet all government requirements.”

Numerous CVS stores in Illinois use the KODAK Biometric ID Photo System, including those where the lead plaintiffs allege they had their biometric data unlawfully collected. CVS uses this system to ensure that the photos it takes meet regulations for passports and other official documents.

For example, when a customer has a passport photo taken at CVS, the digital image is scanned by the KODAK Biometric ID Photo System, which confirms that the photo meets criteria such as correct head size and head position, eyes open and looking straight ahead, and mouth closed and not smiling. As part of this process, it scans the image for biometric identifiers.

CVS violated BIPA because it didn’t adequately inform its consumers of its biometric data collection practices, obtain written consent from them, or provide any data retention or destruction policies to its consumers, states Milberg’s lawsuit.

In doing so, according to Milberg’s complaint, filed in the Chancery Division of the Circuit Court of Cook County, the Biometric ID Photo System collects, captures, stores, and/or otherwise obtains consumers’ biometric data.

“In collecting consumers’ Biometrics, Defendant has violated BIPA because it never adequately informed its consumers of its Biometrics collection practices, never obtained written consent from any of its consumers, and never provided any data retention or destruction policies to any of its consumers,” the complaint states. “Defendant is also unlawfully profiting from the sale or commercial use of the same Biometrics that they unlawfully collect.”

The lead plaintiffs in the case say that they had ID photos taken at CVS locations in Illinois that used the KODAK Biometric ID Photo System and that, in the process, CVS failed to comply with BIPA. They seek to establish a class of similarly situated individuals who meet the following criteria:

All Illinois citizens during the statutorily allowed period whose biometric information or biometric identifiers were collected, captured, stored, purchased, received through trade, or otherwise obtained by CVS via the KODAK Biometrics ID Photo System for ID photos, passport photos, or any other identifying photos.

If the class is certified by the court, anyone who is eligible to become a class member could be in line to receive an equitable share of any resulting settlement or verdict.

To follow this case and other firm news, follow Milberg on Facebook and Twitter. To discuss a possible class action or biometric data lawsuit, please contact us.