Cybersecurity Policy Report, Judge Allows Biometric Privacy Lawsuit to Proceed, (Feb 22, 2023)

By WK Editorial Staff

A federal judge has allowed a biometric data privacy lawsuit to proceed against identity verification firm Jumio but acknowledged that the company may be able to prevail in the litigation later.

On Feb. 14, U.S. District Judge Andrea R. Wood of the U.S. District Court for the Northern District of Illinois denied Jumio’s motion to dismiss the suit, brought by an Illinois resident under the Illinois Biometric Information Privacy Act (BIPA).

In Cory Davis v. Jumio Corp. (no. 22-CV-00776), the plaintiff alleges that Jumio violated the law’s notice and consent requirements when it collected his biometric information while verifying his identity to participate in the Binance online cryptocurrency marketplace. The plaintiff is suing on behalf of himself and a putative class of similarly situated Illinois residents.

Jumio uses facial recognition software to provide identity verification services for businesses. Individuals are prompted to upload a photograph of their face and a copy of an identification document, such as a driver’s license, as part of the verification process. Junio’s software scans the photograph and creates a biometric template of the customer’s face to compare the customer’s facial biometrics to the customer’s image in the identification document.

In its motion to dismiss, Junio made the following two arguments: (1) The plaintiff’s suit is barred by BIPA’s exemption for financial institutions subject to Title V of the Gramm-Leach-Bliley Act of 1999; and (2) BIPA does not apply extraterritorially, and the plaintiff does not allege Junio engaged in any relevant conduct primarily and substantially in Illinois.

On the first argument, the court wrote that whether Binance qualified as a financial institution for purposes of the BIPA exemption was a question of fact that couldn’t be determined based on the allegations in the complaint. Further, the court expressed skepticism that requiring Jumio to comply with BIPA meant the law applied to Binance, which the court said would not have any affirmative obligation under the statute because those duties would fall on Jumio.

As to the second argument about extraterritorial application, the court wrote that the plaintiff had plausibly alleged Jumio’s BIPA violations occurred primarily and substantially in Illinois. However, the court acknowledged that discovery might reveal that the connection to Illinois was “sufficiently tenuous as to warrant revisiting the matter at the summary judgment stage of the proceedings.”

News: StateLegislation LitigationEnforcement DataPrivacy