Whole Foods Market Settles Biometric Information Case for $300,000

A reminder that the Illinois' Biometric Information Privacy Act (BIPA) requires that companies obtain consent before using biometric information, which includes fingerprints, face prints, voice prints, retina and iris scans, and other similar information. In addition to BIPA, Texas and Washington have enacted similar laws, and we should expect more biometric specific privacy laws will be proposed in 2023 (there was even SB 1189 in California last year to add even more restrictions on use of biometric information than what is already in the CPRA). 

While the collection and use of biometric information from all categories of individuals is generally subject to these laws, as my colleagues have recently written about here, one of the biggest areas in BIPA litigation is in the employment context, where "consent" for processing is often overlooked. As this case shows, the collection and use of voice prints used to recognize an individual without consent, even when they clearly know about the collection and use, can lead to liability. Companies of all kinds should be careful about their collection and use of biometric information, especially from employees.