February 4, 2023

Volume XIII, Number 35

Error message

  • Warning: Undefined variable $settings in include_once() (line 135 of /var/www/html/docroot/sites/default/settings.php).
  • Warning: Trying to access array offset on value of type null in include_once() (line 135 of /var/www/html/docroot/sites/default/settings.php).
Advertisement

February 03, 2023

Subscribe to Latest Legal News and Analysis

February 02, 2023

Subscribe to Latest Legal News and Analysis
Advertisement

DashCam Developer Insulated From BIPA Liability

On November 3, 2022, an Illinois circuit court judge dismissed a Biometric Information Privacy Act (Privacy Act or BIPA) putative class action against Samsara, Inc., a DashCam developer. DashCam is a safety technology for trucking companies such as Samsara’s customer and co-defendant, Beelman Truck Co. The DashCam device points an internet-connected dashboard camera at the driver to detect risky driving behaviors. The device also has a “Camera ID” feature, which allegedly scans the driver’s facial geometry to assign trips and to identify the driver to the DOT-mandated electronic logging device (ELD) system used to comply with federal hours of service regulations.

The Guszkiewicz v. Beelman Truck Co. lawsuit alleged that Beelman (the plaintiff’s employer) and Samsara (a third-party technology developer with no direct relationship with the plaintiff) were both responsible for providing written notice and obtaining signed consents from Beelman’s Illinois drivers under Section 15(b) of BIPA.

Samsara argued that requiring third-party technology developers and vendors to provide notice and obtain consent leads to absurd results. Samsara explained that it was not in a position to know which of its customers’ employees drive in Illinois or to obtain their signed consent. According to Samsara, Section 15(b) applies only to the employer because the employer is the one with the relationship with the employees who use the technology, controls and directs the collection of biometric information, and is, therefore, the entity that can provide the required written notice and obtain the executed release.

Samsara instead advised its customers in writing that BIPA could potentially apply to its technology—specifically its Camera ID feature. It provided its customers with a sample BIPA policy and consent form and required customers to twice certify to Samsara that they had complied with BIPA and obtained signed consent forms from their drivers, before it activated the Camera ID feature. Samsara’s motion to dismiss pointed to a line of federal court cases that suggest, in dicta, that technology developers or vendors may discharge their obligations under Section 15(b) by contractually requiring their customers to obtain their employees’ informed consent as a precondition to use of the technology.

DuPage County Circuit Judge Neal Cerne agreed and held that Samsara discharged its notice and consent obligations under Section 15(b), dismissing the BIPA claims against Samsara. The November 3, 2022, dismissal did not include a written opinion but was stated on the record in court. The court found that Samsara complied with BIPA by (a) putting its customers on notice of BIPA’s requirements and possible application to its technology, (b) providing customers with a sample BIPA policy and consent form, and (c) contractually requiring customers to certify twice that they had obtained written consents from their Illinois drivers before activating the Camera ID feature. The court then set a hearing date to consider a proposed class action settlement between plaintiff and Beelman, the trucking company employer.

The Privacy Act

Illinois’s Privacy Act was enacted in 2008 and governs the collection, use, and storage of biometric data such as fingerprints, voiceprints, and scans of the retina, iris, hand or facial geometry. Specifically, it prohibits private entities from collecting or capturing a person’s biometric identifiers or biometric information without first informing them what data is being collected and stored, the reason for doing so, and the length of time for the data collection, and then obtaining that person’s signed consent or “written release.”

Key Takeaways

The Guszkiewicz case is the latest to review the bounds of the Privacy Act amid evolving technologies that are increasingly able to collect data. The grant of Samsara’s motion to dismiss furthers the argument that technology developers and vendors may avoid liability under the Privacy Act by requiring their clients, as a precondition to the use of the technology, to meet Section 15(b)’s notice and consent requirements.

However, it is not clear that courts will allow developers and vendors to contract away their Privacy Act compliance obligations in all situations. Developers or vendors may wish to plainly assert in their client contracts that they are not collecting or storing biometric data and have no access to any biometric data collected by the customer.

Companies should benefit from this ruling as it should focus developers and vendors on alerting their customers to devices with biometric capability. The plaintiff’s bar appears to be running out of biometric time clock cases to bring and is instead filing suit on new technologies where the biometric capability is either unknown or in dispute. Thus, companies may want to watch for such provisions in their vendor contracts, which should help in identifying biometric devices. Companies presented with such provisions may then need to ensure they are in compliance with the Privacy Act, no further revisions are needed to existing policies and consent forms, and consents are being timely signed.

© 2023, Ogletree, Deakins, Nash, Smoak & Stewart, P.C., All Rights Reserved.National Law Review, Volume XII, Number 315
Advertisement
Advertisement
Advertisement

About this Author

Shareholder

Anne Larson is a Shareholder in the firm’s Chicago office.  Anne concentrates her practice on management-side labor and employment matters and defends discrimination, retaliation, whistleblower, non-competition and FLSA disputes, including EEOC systemic investigations and class actions.  She excels at litigation prevention when advising businesses on their hiring and firing practices, reductions-in-force, disability accommodations, FMLA and social media issues.  Anne also directs targeted FLSA compliance audits and conducts interactive anti-harassment, wage and hour and HR training.

...
3125581253
Senior Marketing Counsel

In the Senior Marketing Counsel role, Zachary develops strategy for the firm’s blog and other content. He serves as a lead writer for articles and blog posts for publication on the firm’s website both individually and in consultation with firm attorneys. He also works closely with the Client Services department and firm attorneys to develop relevant content, including through use of webinars, publications, blogs, podcasts, and graphics.

Prior to joining Ogletree Deakins, Zachary served as a Senior Reporter for Law360, a leading online legal news publication, covering the sports and...

864-241-1852
Advertisement
Advertisement
Advertisement