Clock blocker: Woman sues bosses over fingerprint clock-in tech
Worker time-keeping system at center of biometric privacy legal battle in the US
A former employee at a nursing home is alleging the company and its equipment provider violated the US state of Illinois' biometric privacy laws with a fingerprint-scanning time clock system.
Judge Matthew Kennelly, of the northern Illinois district court, has agreed to hear the claims of Cynthia Dixon against Smith Senior Living and its equipment provider Kronos Inc. Dixon is suing for damages after what she claims is an invasion of privacy.
Dixon claimed the violations as part of a larger negligence and pay violations claim against Smith, her former employer. The complaint includes the allegation that the clock-in system Smith used, a fingerprint scanning system from Kronos, collected, transmitted, and stored her prints without prior permission, a violation of the state's Biometric Information Privacy Act (BIPA).
Bungling cops try to use dead chap's fingers to unlock his smartmobeREAD MORE
Specifically, Dixon says, she was never notified or asked to sign a waiver acknowledging that the clock-in system she used to log her work hours would not just read her prints, but store and transmit them to Kronos.
"Smith required Dixon to clock in and out of work by scanning her fingerprint, which Smith stored in a database after the first time it was scanned. Smith did not inform Dixon of the specific purpose or length of time for which her fingerprint was to be collected, stored, and / or used," a case summary reads.
"Nor did Smith make available information about its biometric data retention policy (if it had such a policy) or other guidelines regarding the permanent destruction of the biometric information it possessed. Smith also neglected to obtain a written release from Dixon authorizing Smith to collect or store her fingerprints."
The Illinois' BIPA law is among the strictest biometric privacy laws in the US, establishing that any private company who collects or transmits biometric info first obtain permission and a written release from the subject, or face liability and fines.
Kennelly ruled (PDF) that Smith and Kronos could not dismiss the BIPA charge, finding that Smith has more than enough evidence of both violations and damages to make a case.
"It is reasonable to infer from the allegations in the complaint that Kronos obtained Dixon's biometric data without her knowledge or consent," the Judge decided.
"The Court has already concluded that BIPA established a right to privacy in such information and that obtaining or disclosing a person's biometric data without her consent or knowledge necessarily infringes on the right to privacy in that data."
The case will now proceed to a status hearing, set for June 7. ®
Sponsored: Becoming a Pragmatic Security Leader