Walmart: Illinois Court Considers Biometric Data Collection BIPA

• Walmart customers have filed a class action lawsuit against the retail giant, alleging that it is illegally collecting their biometric data.
• The plaintiffs claim that Walmart creates a voiceprint or biometric identifier every time they call customer service without informing them of the specific purposes for which it is being collected, stored, or used.
• Walmart's practice violates the Illinois Biometric Information Privacy Act (BIPA), which regulates the collection and use of biometric identifiers.
• The plaintiffs are seeking statutory damages of $1,000 to $5,000 for each of Walmart's violations of the Illinois law, though recent amendments to BIPA limit damages to one violation per person for the same collection method.

The unauthorized collection and storage of biometric identifiers exposes consumers to serious and irreversible privacy risks.

A group of Walmart customers has filed a class action lawsuit against the retail giant, alleging that it is illegally collecting their biometric data. The plaintiffs claim that every time they call Walmart's customer service line, the company creates a voiceprint or biometric identifier using an artificial intelligence system without informing them of the specific purposes for which it is being collected, stored, or used. This practice, according to the complaint, violates the Illinois Biometric Information Privacy Act (BIPA), which regulates the collection and use of biometric identifiers. The plaintiffs are seeking statutory damages of $1,000 to $5,000 for each of Walmart's violations of the Illinois law.

The Illinois Biometric Information Privacy Act (BIPA) was enacted in 2008 to regulate the collection and use of biometric identifiers. The statute requires companies to inform individuals that their biometric data is being collected, stored, or used, and to obtain a written release from the individual before doing so. In addition, BIPA prohibits companies from collecting, capturing, purchasing, receiving through trade, or otherwise obtaining a person's or customer's biometric identifiers or biometric information without first complying with these requirements. The statute also provides for statutory damages of $1,000 to $5,000 for each violation. However, amendments to BIPA, effective August 2, 2024, clarified that a private entity can generally only be found liable for one BIPA violation per person for the same method of collection, regardless of the number of times the biometric information was collected from that person.

The lawsuit against Walmart highlights the importance of companies complying with local laws and regulations regarding biometric data collection. As the plaintiffs note, the unauthorized collection and storage of biometric identifiers exposes consumers to serious and irreversible privacy risks. The case also underscores the need for companies to be transparent about their data collection practices and to obtain informed consent from individuals before collecting their biometric data. Lawyers should be aware of the potential for statutory damages under BIPA and advise clients to review their company's biometric data collection practices to ensure compliance with local laws.

Lawyers should be aware of the potential for statutory damages under the Illinois Biometric Information Privacy Act, and advise clients to review their company's biometric data collection practices to ensure compliance with local laws.

Source: Original reporting via Courthouse News Service