Hyatt Illegally Obtains Employee Fingerprints, Plaintiff Claims

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

Hotel chain Hyatt Corp. was hit by a class action alleging the company runs afoul of an Illinois biometric privacy law by collecting employees’ fingerprints.

Lead plaintiff Robin Rapai alleges in her class action lawsuit that Hyatt uses a fingerprint-based clock-in system without giving proper disclosure and getting employees’ consent. The Illinois Biometric Information Privacy Act requires written permission and disclosure of privacy policies that the plaintiff alleges Hyatt does not use.

The plaintiff alleges that as a Hyatt employee, she was required to provide her fingerprints for the company’s time accounting system in September 2017. She says she was never asked permission as required by the biometric privacy act and that Hyatt failed to post or provide any information about how it keeps employee fingerprints secure.

“Unlike traditional time clock punch cards which can be changed or replaced if lost or compromised, fingerprints are unique, permanent biometric identifiers associated with each employee,” alleges the Hyatt class action lawsuit. “This exposes Defendant’s workforce to serious and irreversible privacy risk. For example, if a fingerprint database is hacked, breached, or otherwise exposed, employees have no means by which to prevent identity theft and unauthorized hacking.”

A number of other companies in Illinois have been sued under the state’s Biometric Privacy Act recently. Most cases concern a similar situation – employers require employees to clock-in using their fingerprints, but fail to follow permission and disclosure requirements under the law. Employers like to use employee fingerprints to limit the practice of “buddy punching,” or having fellow employees clock-in for others running late or missing work.

The Illinois law went into effect in 2008 after biometrics company Pay By Touch failed, raising concerns about the security of the information collected by the company. Cell phones and computers also use biometric data in their security systems.

Under the law, companies must ask for permission to retain biometric information like fingerprints, and they must disclose how long the information will be retained. Companies are also prohibited from selling biometric information under the Illinois Biometric Privacy Act.

“BIPA expressly obligates defendant to obtain an executed, written release from an individual, as a condition of employment, in order to capture, collect and store an individual’s biometric identifiers, especially a fingerprint, and biometric information derived from it,” contends the Hyatt class action lawsuit.

Violations of the law can lead to damages of $1,000 to $5,000 for each infraction.

The plaintiff seeks to represent a Class of Hyatt employees from Illinois who were required to be finger-scanned when clocking in or out of work or were fingerprinted between Oct. 30, 2014 and the present.

The Hyatt class action lawsuit is seeking damages and an injunction against the fingerprinting practice.

Rapai is represented by James X. Bormes and Catherine P. Sons of The Law Office of James X. Bromes PC, and Frank Castiglione and Kasif Khowaja of The Khowaja Law Firm.

The Hyatt BIPA Class Action Lawsuit is Robin Rapai v. Hyatt Corp., Case No. 2017-CH-14483, in the Circuit Court of Cook County, Chancery Division.