On October 8, Asia Hryniewicki filed a class action complaint against Amazon Web Services in the Circuit Court of the Nineteenth Judicial Circuit, Lake County, Illinois (Asia Hryniewicki v. Amazon Web Services, Inc. 19CH00001155); the case was removed to the Northern District of Illinois federal court (Hyrniewicki v. Amazon Web Services, Inc. 1:19-cv-07569) on November 15. Amazon is represented by Morgan, Lewis & Bockius.
The complaint stated, “BIPA defines a ‘biometric identifier’ as any personal feature that is unique to an individual, including fingerprints and hand geometry. ‘Biometric information’ is any information based on a biometric identifier, regardless of how it is converted and stored.” BIPA was designed to protect this unique individual information.
Amazon is a cloud server provider that allows customers to store data. Amazon also has business cloud storage services that handle biometrics. For example, a business that requires employees to be fingerprinted to check in and out of work may store biometric information on Amazon’s cloud servers. BIPA regulates the storage of this sensitive information. BIPA requires that certain criteria be met before an establishment such as Amazon can store peoples’ biometric information.
Hryniewicki’s biometrics were captured by Amazon’s business customer and stored on Amazon’s cloud storage service. Amazon does not have a publicly available biometric data retention and destruction policy as required by BIPA section 15(a). The complaint alleged that Amazon did not obtain Hryniewicki’s consent nor inform her of the duration and purpose for storing her biometrics as required by BIPA section 15(b).
Hryniewicki alleged that Amazon failed to comply with BIPA; she has sought damages and an injunction and equitable relief for this violation. Hryniewicki has defined the Class in the complaint as “All residents of the state of Illinois whose biometric identifiers or biometric information was stored by Defendant on behalf of a third-party at any time within the applicable limitations period.” She has requested to be appointed as the class representative and her counsel as class counsel. BIPA provides for statutory damages of $5,000 for each willful/reckless violation and, alternatively, damages of $1,000 for each negligent violation.
Vimeo was also recently sued for violating BIPA in relation to editing software that automatically captured and stored “face templates” from uploaded videos.
