Amazon’s cloud division has been hit with multiple lawsuits, alleging the tech giant violated state law in Illinois by obtaining and storing biometric data without appropriate public disclosures.
But there’s a twist: Amazon is the target in the lawsuits because the company “obtains and stores biometric data on behalf of its customers,” according to the complaints. In that way, the litigation could serve as a test case for the legal liability of cloud services that indirectly — and perhaps even unknowingly — enable allegedly illegal activity by their customers.
At least two lawsuits have been filed against Amazon Web Services in the last six weeks, accusing it of violating the Illinois Biometric Information Privacy Act. The use of biometric identification, such as fingerprint, facial and retina scans, has become more common in the workplace, and the law 11-year-old law places requirements on companies that collect and store that data.
Amazon has come under fire for selling its facial recognition software to law enforcement agencies in recent years. But the lawsuit does not mention specific software for obtaining biometric data and focuses more closely on the tech giant’s storage of information for customers.
We’ve contacted Amazon for comment, and we will update this story if we hear back.
The two lawsuits feature identical language in places, and both plaintiffs are represented by the same firm. Both plaintiffs say Amazon has obtained and stored their biometric information on behalf of its customers, and the two lawsuits seek class action certification.
Amazon has failed to establish a “publicly available data retention and destruction policy,” according to the lawsuits, or notify people why and for how long it is storing their information.
“Compliance with BIPA is straightforward and minimally burdensome,” both suits state. “For example, the necessary disclosures may be accomplished through a single sheet of paper or through a prominently featured notice affixed to a biometric-enabled device.”
Though similar laws exist in places like Washington state and Texas, the Illinois law is unique in that companies can be sued for violations of the law by people who aren’t directly harmed by their actions. A court ruling earlier this year re-enforced the broad nature of the law and has paved the way for several class action suits, according to the law firm Winston & Strawn.
Both lawsuits seek $5,000 for each “willful and/or reckless violation” of the law, and another $1,000 for every “negligent violation” of BIPA.
Here are the two lawsuits:
AWS lawsuit 1 by Nat Levy on Scribd
AWS lawsuit 2 by Nat Levy on Scribd
