Q. My company uses dash-cams to monitor driver conduct, but the company is not located in Illinois. Do I still have to comply with the Biometric Information Privacy Act?
A. Yes, as long as the company has drivers who are Illinois residents, you must comply with BIPA. The good news, however, is that as long as your company fully complies with the statute, it can continue to use telematics.
The newest target for plaintiffs wielding their private right of action under Illinois’ Biometric Information Privacy Act (BIPA) are companies offering dash-cam “telematics.” Telematics involves use of an in-vehicle camera device that employs artificial intelligence, machine learning, and “computer vision” to collect and analyze, among other things, driver behavior. In the last few weeks, at least two complaints were filed against non-Illinois companies asserting violations of BIPA through use of telematics.
As a refresher, BIPA regulates the collection, use, safeguarding, and storage of biometric information (such as fingerprints, retina scans, or face scans). It generally requires any private entity in possession of such biometric information to: (1) develop a written policy governing management of the information; (2) inform the owner of the biometric information in writing; and (3) obtain informed prior consent to collect the biometric information and a retention schedule for destroying it.
The first telematics class action filed last week, Arendt et al. v. Netradyne Inc., No. 2022-CH-00097 (Cook County, Illinois), alleges that Netradyne supplied a “multi-use camera hardware device” to Bob’s Discount Furniture’s fleet of trucks. According to the complaint, the device captures a driver’s face geometry to “continuously monitor and classify the driver’s status as well as external variables like cars or road signs.” The data is then allegedly sent to Netradyne, which analyzes it using “vision-based artificial intelligence.” The plaintiff alleges he and class members never received notice of the collection, purpose, and length of retention of their biometric information, and never gave written consent for that collection and retention.
The second complaint, Hernandez v. Omnitracs, LLC, No. 1:22-cv-00109 (Northern District of Illinois), was brought against Omnitracs, a company that allegedly provides telematics hardware and data analytics to over 15,000 customers. According to the complaint, Omnitracs collects and scans a driver’s facial geometry to analyze his/her driving behavior, including, for example, whether the driver’s eyes are closed or if the driver is looking down. The plaintiff claims he was a driver whose employer implemented Omnitracs telematics (he does not identify his employer) and that he was never informed that the technology would be collecting his biometric information, of the purpose for the collection, or of the length of time the information would be retained. He also alleges he never gave written consent to the collection or retention.
A similar class action was brought last November against non-Illinois companies Maveric Transportation LLC and Lytx, Inc. in Madison County, IL by plaintiff Joshua Lewis (No. 2021-L-001379). Maveric is a transportation and logistics company, and Lytx offers video telematics and fleet management systems, including a DriveCam using machine vision and artificial intelligence to collect and assess facial geometry. Like the other class actions, the plaintiff in this case alleges Maveric and Lytx never provided notice of the collection, purpose, and length of retention of his biometric information and that he never gave written consent for that collection and retention. He also alleges the defendants sold, leased, traded, or otherwise profited from his biometric information.
Telematics is a critical tool to help fleet operators ensure that their drivers are safe and — ironically — to avoid exposure to litigation, resulting from automobile collisions and other road incidents. The recent flurry of telematics litigation should be a warning to companies using such technology that they must comply with BIPA if they have Illinois drivers. Such companies should make sure they comply with BIPA by, among other things, providing written notice, obtaining informed consent, and creating a publicly available retention schedule.