Former McDonald’s Employee Files Fingerprint Privacy Class Action Lawsuit

An Illinois McDonald’s franchise has been hit with a class action lawsuit from a former employee who claims the restaurant unlawfully collects, uses, stores and discloses employees’ biometric information without consent.

Plaintiff Joanna Currie says she worked for McDonald’s as a cashier from October 2019 to April 2020 in Zion, Ill. She claims that as a condition of her employment, she was required to scan her fingerprint so that McDonald’s could use it as an authentication method to track her time and breaks.

Currie states she was required to scan her fingerprint each time she began and ended her workday as well as each time she took a break. She claims she was not informed in writing of the purpose and length of time for which her fingerprint data would be collected.

In addition, Currie maintains that McDonald’s did not obtain a release to collect, store or use her fingerprint data, nor did it obtain her consent before disclosing and disseminating her biometric data to third parties.

The McDonald’s class action lawsuit states that employees were never informed of the specific limited purposes or length of time for which McDonald’s collects, stores, uses and disseminates biometric data.

She asserts that she would not have provided her biometric data to the defendant if she had known McDonald’s would retain the information for an indefinite period of time without her consent.

The McDonald’s class action lawsuit goes on to say that when the defendant hires an employee, he or she is enrolled in its employee database by using a scan of his or her fingerprint. Currie says the defendant’s employees are required to have their fingerprints scanned by a biometric scanning device.

Seeing the need to protect its citizens, Illinois enacted the Biometric Information Privacy Act (BIPA) to regulate companies that collect, store and use Illinois citizens’ biometrics, such as fingerprints. 

“Notwithstanding the clear and unequivocal requirements of the law, Defendant disregards Plaintiff’s and other similarly-situated employees’ statutorily protected privacy rights and unlawfully collects, stores, disseminates, and uses Plaintiff’s and other similarly-situated employees’ biometric data in violation of BIPA,” the McDonald’s class action lawsuit says.

Currie explains that McDonald’s has violated the BIPA and continues to violate the law because it did not properly inform her of the specific purpose and length of time for which her fingerprints were being collected, stored and used.

The plaintiff, on behalf of herself as well as the putative Class, is seeking an order declaring that the defendant’s conduct violated BIPA; requiring the defendant to cease the unlawful activities set forth in the complaint; and awarding statutory damages to the Currie and the proposed Class.

The McDonald’s class action lawsuit says that, under the BIPA, for each violation, the prevailing party may recover $1,000 or actual damages, whichever is greater, for negligent violations and $5,000, or actual damages, whichever is greater, for reckless and intentional violations.

Currie says biometric identifiers include retina and iris scans, voiceprints, scans of hand and face geometry and fingerprints. In addition, biometric information is separately defined to include any information based on an individual’s biometric identifier that is used to identify an individual.

In addition, the BIPA prohibits private entities from disclosing a person’s or customer’s biometric identifier or biometric information without first obtaining consent for such disclosure, according to the plaintiff.

Currie says the BIPA also prohibits selling, leasing, trading or otherwise profiting from a person’s biometric identifiers or biometric information as well as establishing a retention schedule for permanently destroying biometric identifiers and biometric information.

“The Illinois legislature enacted BIPA due to the increasing use of biometric data in financial and security settings, the general public’s hesitation to use biometric information, and – most significantly – the unknown ramifications of biometric technology,” the McDonald’s class action lawsuit goes on to state.

Currie claims that biometrics are biologically unique to the individual and, once compromised, an individual is at a heightened risk for identity theft and left without any recourse. She says biometric data cannot be replaced or changed or replaced if hacked or stolen.

Also, since McDonald’s neither publishes a BIPA-mandated data retention policy nor discloses the purposes for its collection and use of biometric data, the defendant’s employees have no idea at the time of collection whether it sells, discloses, re-discloses or otherwise disseminates their biometric data, the complaint says.

Currie says McDonald’s discloses or otherwise disseminates the plaintiff’s biometric data to at least one third-party, which raises a material risk that the data will be accessed by other third-parties.

Have you had your biometric data collected without your permission? Leave a message in the comments section below.

The plaintiff is represented by Ryan Stephan and Haley Jenkins of Stephan Zouras LLP.

The McDonald’s Biometric Class Action Lawsuit is Joanna Currie, et al. v. McEssy Investment Co., Case No. 2020-CH-04825, in the Circuit Court of the 19th Judicial District, Lake County, Illinois.

Read More Lawsuit & Settlement News:

Google Class Action Says Tracking Violates Consumer Privacy

McDonald’s Lawsuit Says Workers Needlessly Exposed To Coronavirus

OxyCide Cleaner Hazards: An Overview of OSHA Regulations

Ethicon Surgical Staplers Recalled by Manufacturer